---
name: "forensic_accounting"
description: "Screen financial statements for earnings manipulation and fraud: compute the Beneish M-Score, analyze accrual-vs-cash divergence, run Benford first-digit tests on transactional data, and work a structured red-flag teardown of statements, footnotes, and disclosures. Triggers on requests to detect accounting fraud, investigate suspicious financials, audit earnings quality, or learn forensic accounting techniques."
---

# Forensic Accounting

## Purpose
Read financial statements like an investigator. Turn two years of statements plus a transaction ledger into a defensible manipulation screen: quantitative tests first (M-score, accruals, Benford), then a qualitative red-flag teardown, ending in a verdict that says exactly what was tested and what the limits are. Every number in your output must trace to a line item you can point to.

## Workflow
1. **Collect the raw material.** Get, at minimum: income statement, balance sheet, and cash flow statement for year t and t-1, plus any available transaction ledger (invoices, journal entries, expenses). If you only have one year, say so and cap the verdict at the accrual and Benford checks.

2. **Run the Beneish M-Score.** Put the numbers into the JSON format in `references/fixtures/northgate_financials.json` and run `bin/mscore.py`. The script computes the eight ratios (DSRI, GMI, AQI, SGI, DEPI, SGAI, LVGI, TATA) and the score. M > -1.78 is the "likely manipulator" bar; -2.22 to -1.78 means "possible, investigate". See `references/beneish_mscore.md` for what each ratio means and the known limits.

3. **Check accruals vs cash.** Compare net income to operating cash flow over the available years. Earnings that grow while operating cash flow stalls or falls are the oldest tell in the book. TATA (total accruals / total assets) above 0.05 sustained across years deserves a closer look at revenue recognition and capitalized costs.

4. **Run Benford's law on the ledger.** Run `bin/benford.py` on any CSV of amounts (1,000+ rows works best; below that, treat results as hints). MAD above 0.015 is nonconformity; also watch for spiked digits and a high round-number share. See `references/benford_law.md` for when Benford does NOT apply (assigned numbers, capped ranges, approval-threshold clustering). This test screens transactions, never whole statements on its own.

5. **Work the red-flag checklist.** Walk the pattern catalog in `references/red_flag_catalog.md` against the statements, footnotes, and disclosures. Check revenue tricks (channel stuffing, bill-and-hold, related-party sales), expense tricks (capitalizing costs, stretching depreciation lives, cookie-jar reserves), and the disclosure tells (revenue-recognition footnote, related-party note, auditor changes, management selling stock while talking up the business).

6. **Deliver the verdict.** Follow the Output Contract below. A worked end-to-end example lives in `references/worked_teardown.md`.

## Output Contract
Every investigation report must contain, in this order:
- **Scope**: what you were given (years, statements, ledger size), and what was missing.
- **Quantitative screens**: M-score with the eight ratio values and which components fired; accrual-vs-cash comparison; Benford MAD and flagged digits.
- **Red flags**: each flag tied to a specific line item, footnote, or transaction pattern, in plain language.
- **Verdict**: one of "likely manipulator", "possible manipulator: investigate further", "no flags found". Never "proven fraud". Screens are evidence for deeper work, not conclusions.
- **Limits**: state the model's blind spots for this case (M-score misses ~24% of manipulators and falsely flags ~17.5% of clean companies; Benford needs natural, uncapped data; one year of data means no M-score).

## Operating Rules
1. Never invent numbers. Every ratio, every percentage, every "the company did X" claim must come from the input documents or a verified primary source. Unverifiable claims get cut, not hedged.
2. Compute, do not eyeball. Use `bin/mscore.py` and `bin/benford.py` for the screens; do not hand-wave the ratios.
3. Distinguish manipulation types. Aggressive-but-legal accounting choices (earnings management) and fraud are different conclusions. Name which one the evidence supports.
4. State alternatives. A high DSRI can be a credit-policy change, not fake sales. A Benford miss can be an approval threshold, not fraud. Give the innocent explanation before the guilty one.
5. Keep the style plain. No em dashes, no filler phrases, no press-release language. Report findings like you would brief a skeptical partner.
6. Cite sources. If you pull a fact from the web (a restatement amount, a case detail), name the source.