Direct and Indirect Methods of Proof
In the CFE discipline of tracing assets and proving illicit income, investigators rely on two broad approaches: the direct method and indirect methods of proof. The direct method (also called the specific items method) establishes a subject's illicit income or hidden assets through explicit, transaction-level evidence. The examiner identifies specific deposits, payments, purchases, or transfers and ties each to its source and destination using documents such as bank statements, cancelled checks, wire records, invoices, contracts, and witness testimony. For example, tracing a kickback from a vendor's account into a suspect's brokerage account documents a specific item of unexplained income. The direct method is the most persuasive in court because it leaves little room for alternative explanations, but it depends on access to complete records and cooperation, which fraudsters often frustrate through cash dealings, nominees, or offshore entities. Indirect methods are circumstantial techniques used when records are incomplete, destroyed, or unavailable. Rather than proving each transaction, they infer unreported or illicit income by comparing what the subject spent, acquired, or deposited against known legitimate sources. The principal indirect methods are: (1) the net worth method, which measures year-over-year increases in assets minus liabilities, adds living expenses, and subtracts known income to reveal unexplained gains; (2) the expenditures (sources and applications of funds) method, which compares total outflows to total legitimate inflows for a period; and (3) the bank deposits method, which analyzes all deposits, removes transfers and known income, and treats the remainder as unexplained. Investigators must establish a firm starting point, eliminate non-taxable or legitimate sources (gifts, loans, inheritances), and address the subject's explanations to withstand challenge. In practice, CFEs often combine both: indirect methods flag the likely magnitude of concealed funds and guide the search, while direct evidence corroborates specific items and strengthens the case for recovery or prosecution.
Direct and Indirect Methods of Proof (Tracing Assets) – Complete CFE Exam Guide
Fraud examiners are frequently asked to answer one deceptively simple question: Where did the money come from, and where did it go? When a subject has lived far beyond their legitimate means, a court, prosecutor, employer or insurer wants to know whether the excess can be tied to illicit income. The methods used to establish that link are called the direct and indirect methods of proof. They sit inside the Tracing Illicit Transactions portion of the CFE Investigation section, and the ACFE tests them heavily because they combine three core CFE skills: financial analysis, evidence gathering and an understanding of what courts will accept. If you cannot identify which method fits a fact pattern, or cannot run the arithmetic for a net worth or bank deposits computation, you will lose easy points. In practice, these methods are also the backbone of money laundering, embezzlement, tax evasion and corruption cases where the subject deals in cash or has destroyed records.
2. What the Methods Are – The Big Picture
Proof of illicit income can be built in two fundamentally different ways:
Direct method (the specific items method) – the examiner uses specific, identifiable transactions supported by documents to show that funds moved from the victim (or a bribe payer, vendor, etc.) directly to the subject or for the subject's benefit. Each illicit receipt is proven item by item. Examples: a cancelled check from a vendor deposited into the subject's personal account; a wire transfer from a shell company to the subject's spouse; a kickback recorded on a bribe payer's ledger and matched to a deposit.
Indirect methods (circumstantial methods) – the examiner cannot tie each dollar to a specific illicit source, so instead he or she demonstrates that the subject's financial activity (assets acquired, money spent, or money deposited) exceeds all known legitimate sources of funds. The unexplained excess is inferred to be income from unknown, and presumably illicit, sources. The three indirect methods the CFE exam expects you to know are the net worth method, the expenditures method (also called the sources and applications of funds method) and the bank deposits method.
3. The Direct (Specific Items) Method in Detail
When it is used: whenever adequate books, records and third-party documents exist. It is always the preferred approach because it is the most persuasive to a jury and the hardest for a defendant to rebut.
What it relies on: bank statements, deposit slips, cancelled checks, wire transfer records, credit card statements, invoices, contracts, real estate closing statements, brokerage statements, and testimony of co-conspirators or bribe payers who can confirm a specific payment.
Typical workflow: identify the suspected illicit payment; obtain the paying party's records; follow the instrument through the banking system (the check, the wire, the cashier's check); locate the receiving account or asset; confirm the subject's control over that account or asset; document the chain in a schedule or flow chart.
Strengths: precise, document-based, easily understood, directly proves the offense element of receiving funds.
Weaknesses: useless when the subject deals in cash, when records have been destroyed or never existed, or when the illicit scheme generated hundreds of small untraceable receipts.
4. Indirect Methods – When and Why They Are Needed
Indirect methods are used when the direct approach is impossible or incomplete, typically because:
• The subject deals primarily in cash (drug trafficking, bribery, skimming, cash-intensive businesses).
• Records are missing, destroyed, falsified or were never kept.
• The subject's books do not reflect true income (unreported income cases).
• There are too many small transactions to prove item by item.
• The examiner needs to corroborate direct evidence or show the magnitude of the fraud.
They are circumstantial, so they rest on a logical inference: if a person spends, saves or deposits more than all legitimate sources could have produced, the difference came from somewhere else. For this inference to hold up, the examiner must thoroughly identify and eliminate all legitimate sources (salary, loans, gifts, inheritances, insurance proceeds, asset sales, prior savings or cash hoards).
Legal foundation to remember: the indirect approach, specifically the net worth method, was approved by the U.S. Supreme Court in Holland v. United States (1954). The Court required that the prosecution (1) establish an opening net worth with reasonable certainty, (2) investigate and negate reasonable leads furnished by the subject that could explain the increase, and (3) show a likely source of the unreported income or negate all non-taxable sources. These safeguards are frequently tested and apply by analogy to all indirect methods.
5. The Net Worth Method
Best used when: the subject is accumulating assets (real estate, vehicles, investments, cash in accounts) rather than spending the illicit funds on consumables.
Core logic: an increase in net worth plus non-deductible living expenses must have been funded by something. Subtract known legitimate income and the remainder is income from unknown sources.
The formula (memorize it):
Assets – Liabilities = Net Worth
Net Worth – Prior Year Net Worth = Increase (Decrease) in Net Worth
Increase in Net Worth + Living Expenses = Total Income (Expenditures)
Total Income – Funds from Known Sources = Funds from Unknown Sources
Key rules:
• Assets are recorded at cost (historical acquisition cost), not fair market value. Appreciation is not income the subject received.
• The base year (opening net worth) is the most critical and most attacked figure. If it is understated, the whole analysis collapses. Establish cash on hand at the start of the period with as much documentation as possible (financial statements submitted for loans, divorce filings, tax returns, prior investigations, interviews).
• Identify all assets, including those held in nominee names (spouse, children, trusts, corporations).
• Living expenses are the money spent that leaves no asset behind (food, rent, travel, utilities, entertainment).
Worked example:
Opening net worth (Year 1): 200,000
Year 2 assets at cost: 450,000; Year 2 liabilities: 100,000; Year 2 net worth: 350,000
Increase in net worth: 350,000 – 200,000 = 150,000
Add living expenses: 60,000 → total income/expenditures: 210,000
Less known sources (salary, documented gifts): 90,000
Funds from unknown sources: 120,000
6. The Expenditures (Sources and Applications of Funds) Method
Best used when: the subject spends illicit income on lifestyle, travel, gambling, entertainment and other consumables, so that net worth does not grow noticeably. It is essentially a variation of the net worth method that focuses on the flow of funds rather than the balance of assets.
Core logic: total applications (uses) of funds during a period must equal total sources of funds. If applications exceed known sources, the excess came from unknown sources.
Formula:
Total Expenditures (Applications of Funds) – Funds from Known Sources = Funds from Unknown Sources
Applications include: increases in assets, decreases in liabilities, and personal living expenses. Known sources include: salary and other legitimate income, decreases in assets (e.g., sale of a car), increases in liabilities (e.g., new loans), gifts, inheritances, and opening cash on hand.
Worked example:
Payments on a mortgage, vehicle purchases, travel, tuition, cash gambling losses and other living costs: 250,000
Known sources (salary 120,000, new loan 30,000, documented gift 20,000): 170,000
Funds from unknown sources: 80,000
7. The Bank Deposits Method
Best used when: the subject deposits most of his or her receipts into bank accounts. It is the method of choice for business owners or employees who run funds through accounts, and it is often used in skimming and unreported income cases.
Core logic: total deposits, after removing non-income items, plus any cash spent without being deposited, equals total receipts. Receipts in excess of known sources are unexplained.
Formula (memorize it):
Total Deposits to All Accounts – Transfers and Redeposits = Net Deposits
Net Deposits + Cash Expenditures = Total Receipts from All Sources
Total Receipts – Funds from Known Sources = Funds from Unknown Sources
Key rules:
• Eliminate inter-account transfers, redeposited checks, loan proceeds and other non-income deposits so they are not double counted.
• Cash expenditures are expenses paid in currency that never hit the account; they are added back because they represent receipts the subject obtained but did not deposit.
• Obtain records for every account the subject controls, including those in nominee or business names.
Worked example:
Total deposits all accounts: 300,000
Less transfers between accounts and redeposits: 40,000 → net deposits: 260,000
Add cash expenditures (rent and purchases paid in currency): 30,000 → total receipts: 290,000
Less known sources (salary, documented loan): 180,000
Funds from unknown sources: 110,000
8. Choosing the Right Method – Quick Decision Guide
• Good records and identifiable payments → Direct / specific items method.
• Subject is buying property, investments, vehicles and building wealth → Net worth method.
• Subject spends lavishly but owns little → Expenditures (sources and applications) method.
• Subject runs money through bank accounts → Bank deposits method.
In real engagements the examiner often uses more than one indirect method to corroborate the result, and uses indirect analysis to point the way toward direct evidence (for example, a large unexplained deposit identified through bank deposits analysis is then traced directly to its source).
9. Anticipating the Subject's Defenses
Because indirect methods are circumstantial, the defense will try to supply an innocent explanation for the unexplained funds. The examiner must proactively investigate and rebut:
• Cash hoard defense – the claim that large cash savings existed before the period began. Rebut by establishing opening net worth and cash on hand carefully, and by showing the subject borrowed money, bounced checks, filed for credit or reported modest income during the alleged hoard period.
• Loans, gifts and inheritances – demand documentation; interview the alleged lender or donor; check whether the donor had the capacity to give.
• Asset sales or gambling winnings – verify with records; gambling winnings usually come with offsetting losses.
• Misclassified transfers – in the bank deposits method, defense will argue deposits were redeposits or transfers; keep meticulous tie-outs.
Documenting these rebuttals is as important as the arithmetic.
10. Exam Tips: Answering Questions on Direct and Indirect Methods of Proof
Tip 1 – Know the synonyms. The exam may call the direct method the specific items method and the expenditures method the sources and applications of funds method. Indirect methods are also described as circumstantial methods. Do not be thrown by alternative names.
Tip 2 – Match the scenario to the method using one clue. Look for the single word that tells you how the subject handles money: accumulates/acquires assets = net worth; spends/lifestyle/consumables = expenditures; deposits/bank accounts = bank deposits; specific documented transactions = direct method.
Tip 3 – Be ready to compute. Calculation questions are common. Write the formula down first, then plug in numbers. Watch for distractor items: appreciation in asset value (ignore – assets at cost), transfers between accounts (subtract in bank deposits method), loans (a known source, not unknown income), and living expenses (add in the net worth method).
Tip 4 – Remember that assets are valued at cost, not market value. A question stating that the subject's house increased in market value is testing whether you wrongly treat appreciation as income.
Tip 5 – The opening net worth / starting point is the most important figure. If asked what the most critical or most vulnerable element of a net worth analysis is, the answer is establishing the base year (opening net worth, including cash on hand) with reasonable certainty.
Tip 6 – Know the Holland requirements. Establish opening net worth with reasonable certainty, investigate reasonable leads offered by the subject, and identify a likely source or negate non-taxable sources. Questions phrased as what the government must prove when using indirect methods point here.
Tip 7 – Indirect methods are circumstantial, not inferior. A true/false item may claim indirect methods are inadmissible or can never be used in criminal cases. That is false; they are widely accepted when properly prepared.
Tip 8 – Direct method is preferred when records exist. If a question asks which method is best when adequate documentation is available, choose the direct/specific items method, even if an indirect method could also work.
Tip 9 – Understand which items are sources and which are applications. In the expenditures method, an increase in liabilities (new loan) is a source; a decrease in liabilities (paying down a loan) is an application. A decrease in assets (selling a car) is a source; an increase in assets (buying a car) is an application.
Tip 10 – Read the question stem for cash expenditures. In bank deposits questions, if the subject paid some expenses in cash, those must be added to net deposits. Forgetting this step produces one of the wrong answer choices.
Tip 11 – Eliminate obviously wrong choices. Answers that mix up methods (for example, saying the bank deposits method starts with assets minus liabilities) can be discarded immediately, improving your odds on the remaining options.
Tip 12 – Think like a court. When a question asks why an examiner should document legitimate sources exhaustively, the answer relates to negating defenses such as the cash hoard, gifts and loans, and to meeting the reasonable certainty standard.
11. Key Terms Recap
• Direct / specific items method – proves illicit receipts transaction by transaction with documents.
• Indirect / circumstantial methods – infer illicit income from unexplained financial activity.
• Net worth method – asset-based; increase in net worth + living expenses – known sources = unknown sources; assets at cost; base year critical.
• Expenditures / sources and applications of funds method – spending-based; applications – known sources = unknown sources.
• Bank deposits method – deposit-based; net deposits + cash expenditures – known sources = unknown sources.
• Holland v. United States – reasonable certainty for opening net worth, investigate leads, likely source.
• Cash hoard defense – the most common rebuttal to indirect proof; defeat it by nailing down opening cash on hand.
Master the decision guide, the three formulas and the legal safeguards, and you will be able to handle any direct and indirect methods of proof question the CFE exam presents.
CFE - Direct and Indirect Methods of Proof Example Questions
Test your knowledge of Direct and Indirect Methods of Proof
Question 1
Which of the following BEST describes how indirect methods of proof, such as the net worth method, establish a subject's illicit income?
Question 2
A fraud examiner suspects that a purchasing manager has accepted cash kickbacks from vendors, but no vendor records documenting the payments can be obtained. The manager's bank deposits match reported salary, and records show no growth in property, investments or savings. Over two years, however, the manager has paid in cash for luxury travel, private school tuition and frequent entertainment. Which method of proof is MOST suitable for estimating the manager's unexplained income?
Question 3
A fraud examiner suspects that a warehouse supervisor is living beyond legitimate means. The examiner is preparing an expenditures (sources and applications of funds) analysis to estimate the supervisor's income from unknown sources. The supervisor's records for the year show a salary, several large personal purchases and a number of other transactions. Which of the following items should the examiner list as a known source of funds rather than as an expenditure?