Forensic accounting engagement letter: retained by counsel, scoped to one question
By Arthur Teboul, DokuTrak · Published
In brief
A forensic accounting engagement letter states who retains the accountant, usually the lawyer, the exact question to investigate, the period and entities in scope, and how records and data are handled. It also says the accountant reports findings, and that whether fraud occurred is for the trier of fact to settle.
The template: Forensic accounting engagement letter
Written for an accountant retained by counsel. For a client-retained investigation, use the optional variant clause and delete the counsel-direction clause. Check it against your firm’s risk policy before you send it.
- WordEdit the bracketed parts and put it on your letterhead.Free, with your email
- PDFRead-only copy, to print or keep on file.Free, no email
Fill it in online: The engagement letter generator fills this template with your firm and client, keeps the optional clauses you pick, and gives you the letter to copy, print or save.
[Forensic accounting firm name] [Firm address] [Date] Privileged and confidential, prepared at the request of counsel [Attorney name], [Law firm name] [Law firm address] Re: [Matter name]
Dear [Attorney name],
Retention through counsel
[Law firm name] retains [Firm name] to assist it in advising [client name] in [matter name]. We will work at your direction, report to you, and send our communications through you. Any choices about privilege and work product are yours.
Client-retained variant(optional)
[Client name] retains us directly to investigate [concern]. We will report to [board committee or officer]. Our work may not be protected by attorney-client privilege or work-product protection.
Question we will address
You have asked us to analyze: [question, for example whether payments from (entity) were made to accounts connected with (person)]. We will not expand the work beyond this question without your written request.
Period, entities and people
Our work covers [start date] to [end date]; the entities [list]; the accounts [list]; and the records of [individuals]. Anything outside these limits needs an amendment to this letter.
Applicable standard
We will perform this [litigation / investigation] engagement under the AICPA Statement on Standards for Forensic Services. It is not an audit, review or other attest engagement, and we will give no assurance on any financial statements.
Nature of our conclusions
We will report our findings and whether the evidence is consistent with the matters you asked about. We will not express a conclusion that fraud occurred; that determination belongs to the trier of fact.
Records requested
Please provide by [date]: the general ledger and journals in native format; bank and credit card statements with check images and wire details; payroll registers; the vendor master file with change history; federal tax returns for [years]; and any data exports you choose to give us.
Evidence handling
We will not alter original records. We will work from copies and forensic images, keep a chain of custody log for every item received, and store all material in [secure storage]. Only staff assigned to this matter will have access.
Conflicts
We have checked the parties and law firms you identified and found no conflict, except [disclosure, if any]. We will tell you promptly if one arises.
If we are asked to testify
If you designate us as a testifying expert, we will sign an amended letter covering the expert report, deposition and trial terms before we prepare any report.
Fees
We bill hourly: partner [rate], manager [rate], staff [rate], data specialist [rate], plus data processing costs at [rate]. A retainer of [amount] is due on signing and will be applied to our final invoice. Our fees do not depend on our findings or on the outcome of the matter.
Confidentiality and data at the end
We will follow any protective order you send us. When the matter and any appeals end, we will return or destroy the data you provided, at your choice, and keep our working papers under our retention policy.
Termination
You or we may end this engagement by written notice. Fees and costs are due through the date it ends, and we will return your materials as described above.
Liability and governing law(optional)
Our total liability for any claim about this engagement is limited to the fees paid to us, except where the law does not allow such a limit. This letter is governed by the laws of [state].
Signatures
Please countersign below. If [client name] will guarantee our fees, please have it sign as well.
Yours sincerely, [Partner name], [credentials] [Forensic accounting firm name] Signature: ____________________ Date: __________ Retaining counsel: [Attorney name] Signature: ____________________ Date: __________ Client (fee guarantor): [Client name] Signature: ____________________ Date: __________
Litigation or investigation: name the engagement
The AICPA forensic standard covers two kinds of work. A litigation engagement is work for an actual or potential legal or regulatory proceeding, as an expert, consultant, neutral, mediator or arbitrator (AICPA Statement on Standards for Forensic Services No. 1). An investigation engagement is work done in response to specific concerns of wrongdoing, to collect and analyze evidence for the people who need answers, such as a board (AICPA Statement on Standards for Forensic Services No. 1).
The label matters because the standard follows the purpose, not the skills used. The same data analysis can fall under it or outside it depending on why you were hired (AICPA Statement on Standards for Forensic Services No. 1). If a routine engagement turns into a dispute, the standard says to modify the understanding with the client (AICPA Statement on Standards for Forensic Services No. 1). In practice, that means a new letter.
Retained by counsel or by the client
In a dispute, the lawyer often retains the forensic accountant. The work is done at the lawyer’s direction to help the lawyer advise the client, and reports go through counsel. Whether privilege or work-product protection applies is the lawyer’s call, so the letter should leave that strategy with counsel and not promise it.
Protection can be lost by a careless disclosure. In federal proceedings, an inadvertent disclosure does not waive privilege only if the holder took reasonable steps to prevent it and promptly took steps to fix it (Federal Rules of Evidence (December 1, 2024), Rule 502, Attorney-Client Privilege and Work Product). A letter that sets who may receive drafts and how files are marked is one of those reasonable steps.
When management or a board hires the accountant directly, for example to look into a suspected theft before any lawyer is involved, use the client-retained variant. Say plainly that privilege may not attach to the work.
Scope it to the question, the period and the people
A forensic engagement without a sharp question grows without limit. Write the question as counsel would put it to a court, then fence it in. The table shows the four fences and an example of each.
| Scope element | What to write | Example |
|---|---|---|
| Question | The allegation or issue to analyze | Were company funds paid to accounts tied to the former controller? |
| Period | Start and end dates | [Start date] to [end date] |
| Entities and accounts | Every company and account in scope | Operating company, two bank accounts, one card program |
| Individuals | People whose records you may examine | The former controller and two vendors |
| Output | Oral findings, a written report, or both | Oral findings to counsel first |
Findings, not verdicts on fraud
Clients often want the letter to promise a finding of fraud. It cannot. Under the AICPA forensic standard, the ultimate call on whether fraud occurred belongs to the trier of fact, and a member may not opine on that ultimate conclusion (AICPA Statement on Standards for Forensic Services No. 1). The member may say whether evidence is consistent with certain elements of fraud, based on an objective evaluation (AICPA Statement on Standards for Forensic Services No. 1).
Write the same limit into the letter, and add that the work is not an audit or a review and gives no assurance. Fees must not depend on the findings either. If the accountant later testifies as an expert, opinions under a contingent fee are barred unless the AICPA contingent fee rule allows it (AICPA Statement on Standards for Forensic Services No. 1).
Check independence before signing. For an attest client, investigative work is allowed if the general requirements for nonattest services are met, but expert witness work impairs independence (AICPA Code of Professional Conduct, ET 1.295.140, Forensic Accounting).
Records, evidence and chain of custody
Evidence that cannot be traced is evidence the other side attacks. A chain of custody log is a record of who received each item, when, from whom, and where it is stored. Keep originals unaltered and work from copies, including forensic images of electronic data.
If the work turns into testimony, the expert’s report must list the facts or data considered (Federal Rule of Civil Procedure 26). The log then becomes that list. Say in the letter that a move to a testifying role needs an amended letter covering the report and deposition terms.
- General ledger and journals for the period, in native format.
- Bank and credit card statements, with check images and wire details.
- Payroll registers and the vendor master file, with change history.
- Federal tax returns for the entities and years in scope.
- Email or data exports, only as provided by counsel.
Questions people ask
Can a forensic accountant say that fraud occurred?
Not as an ultimate conclusion. The AICPA forensic standard leaves that to the trier of fact, though the accountant may say whether evidence is consistent with elements of fraud (AICPA Statement on Standards for Forensic Services No. 1).
Should the attorney or the client hire the forensic accountant?
In a dispute, often the attorney, so the work supports the lawyer’s advice and privilege strategy. A board or manager may hire directly for an internal investigation, accepting that privilege may not apply.
Which standard applies to forensic accounting work by a CPA?
The AICPA Statement on Standards for Forensic Services, which covers litigation and investigation engagements and applies by the purpose of the engagement, not the skills used (AICPA Statement on Standards for Forensic Services No. 1).
What records does a forensic accountant ask for?
Usually the ledger and journals, bank and card statements with check images, payroll registers, the vendor master file, tax returns and any data exports counsel provides, all for the period in scope.
Sources
- AICPA Statement on Standards for Forensic Services No. 1: Defines litigation and investigation engagements, applies by purpose, requires a modified understanding when work converts, bars opining on the ultimate conclusion of fraud and contingent fees for expert opinions.
- AICPA Code of Professional Conduct, ET 1.295.140, Forensic Accounting: Investigative services for an attest client do not impair independence if the nonattest requirements are met; expert witness services do.
- Federal Rules of Evidence (December 1, 2024), Rule 502, Attorney-Client Privilege and Work Product: An inadvertent disclosure in a federal proceeding does not waive privilege if the holder took reasonable steps to prevent it and promptly to rectify it.
- Federal Rule of Civil Procedure 26: A retained testifying expert’s report lists the facts or data the expert considered.
About the author
Arthur Teboul (Founder, DokuTrak) is building DokuTrak after watching professionals lose hours chasing clients for documents over email. Arthur Teboul.
Editorial standards
How this page was made (methodology): it is built from the primary sources listed under Sources, and every rule and figure on it links to the source it comes from. Last updated October 25, 2026. Spotted an error or a rule that changed? Contact us.
Ask once. DokuTrak does the chasing.
- Your client uploads from one link, with no account and no password.
- Reminders go out on a schedule, by default 2, 5, 10 and 14 days after the request, until the file arrives.
- With AI review switched on in your workspace (it is off by default), each upload gets a first pass that flags a file that is not the requested document or an unreadable or blurry scan. It says so when it is not sure.
- You accept every file or mark it for re-upload, and your client gets the note by email. The AI never accepts a file.