A warning sign is a reason to look, not a finding. Internal investigations can be compromised when records are altered or staff are approached before evidence is preserved. Forensic accounting (kế toán điều tra) helps establish what the available evidence supports, and where uncertainty remains.
Warning signs worth acting on
| Area | Signal | What it may indicate |
|---|---|---|
| Suppliers | New supplier with large volume from the start; address or bank account shared with an employee or another supplier; invoices just under approval limits | Fictitious or connected vendors, split purchases |
| VAT invoices | Seller abandons its address or stops filing soon after issuing invoices; goods description does not match the buyer's business; payment routed to a third party | Invoice trading; input VAT and deductible cost at risk |
| Cash and advances | Advances repeatedly rolled over; cash payments just below non-cash payment thresholds; round-sum payments | Misappropriation, undocumented expenses |
| Revenue and inventory | Sales spikes at period end followed by returns; inventory differences written off without investigation | Earnings management, theft, off-book sales |
| People | One person controls a process end to end; refusal to take leave; resistance to system changes | Lack of segregation that enables concealment |
From signal to evidence: five disciplines
- Define the question and the audience. A board decision, a dismissal, a claim against a supplier, a response to a tax authority or a criminal report may involve different evidential and procedural requirements. The question determines the scope.
- Preserve before you probe. Secure accounting data, e-invoice records, emails and bank statements promptly, with a documented chain of custody and controlled access and disclosure. Retain the original data and document any later changes separately.
- Analyse the relevant transactions. Where complete data is available, use full-population testing: supplier–employee matching, duplicate and sequential invoices, payments outside working hours and digit-distribution tests. Record data gaps and testing limits. Use the results to select matters for further examination and corroborate them with supporting evidence.
- Corroborate with independent sources. Confirm with third parties, check the e-invoice and tax registration status of counterparties, trace goods physically, reconcile to bank records. State when a conclusion relies on a single source and explain the resulting limitation.
- Plan interviews around the evidence, and report on facts. Review available documents before substantive interviews where practicable. The report separates what the evidence shows from what it suggests, and states its limitations.
Why the standard of the work matters
For VAT invoice risks in Vietnam, Article 12(5)(b) of Decree 252/2026/ND-CP requires a buyer using invoices covered by a competent authority's conclusion on the seller's use of unlawful invoices or unlawful use of invoices to amend its returns, including for periods already inspected. Supplier checks and supporting records help establish the facts but do not automatically preserve the right to deduct VAT.
For international comparison, the EU judgments in Kittel (C-439/04 and C-440/04) and Mahagében and Dávid (C-80/11 and C-142/11), and the UK Mobilx decision, discuss the buyer's knowledge of fraud and the checks reasonably expected in the circumstances. These are comparative references, not the legal test applied in Vietnam.
A forensic report should make its evidence, reasoning and limitations clear enough for an independent reviewer to assess.
Relevant capability: Forensic Accounting, Investigations & Dispute Support (FAIR)
General information as at October 2026. It is not legal, tax or accounting advice for any specific situation; check the law in force and your own facts before acting.
