A financial statement is not the truth. It is an assertion made under rules that leave enormous room for judgment. Forensic work does not require you to become an accountant; it requires one question: did the reported profit ever turn into cash? Four tools this issue — reconstruct owner earnings, watch the accrual gap, recognize revenue-recognition tricks, and read the incentives behind the audit.
The Principle
What belongs to shareholders is not reported net income but net income + non-cash charges − the capital spending required to maintain the current competitive position and unit volume. That figure, not the headline, is the input to a valuation.
Origin · Quote
"(a) reported earnings plus (b) depreciation, depletion, amortization, and certain other non-cash charges … less (c) the average annual amount of capitalized expenditures for plant and equipment, etc. that the business requires to fully maintain its long-term competitive position and its unit volume."
— Warren Buffett, Berkshire Hathaway 1986 Letter to Shareholders, Appendix
Reading It Closely
Two things get missed. First, item (c) cannot be read off the statements — companies disclose total capital expenditure without separating "maintenance" from "expansion." Owner earnings is therefore inherently a range, not a number; a DCF carried to the decimal is only pretending the problem away. Second, depreciation is a real cost that was simply paid earlier. Munger's jibe that EBITDA means "bullshit earnings" is aimed precisely at adding back (b) while never subtracting (c).
The Case
WorldCom booked line costs — an operating expense — as capital expenditure. The first disclosure on June 25, 2002 put the figure at roughly $3.8 billion; the fraud was ultimately assessed at about $11 billion. The company filed for bankruptcy on July 21, 2002 with roughly $104 billion in assets, the largest US filing to that date.
The point is this: the trick inflated profit and operating cash flow at the same time — the cash really did leave, it was simply recorded under investing activities. So "just look at cash flow and you won't be fooled" is false. What actually leaked was capital spending swelling against both peers and the company's own history while capacity and revenue did not follow.
Limits · Decision Checklist
Weak cash flow does not mean weak quality: negative free cash flow is often correct for a capital-intensive company in its growth phase (Amazon for years after its IPO), and businesses with deferred revenue or insurance float — software, insurers — collect cash before they earn profit. In the other direction, a flattering ratio can simply mean payables were stretched — that is borrowing from suppliers.
- Is cumulative five-year operating cash flow ÷ cumulative net income ≥ 0.9? Where did the gap go?
- How does capex split between maintenance and expansion? Has management ever given the split?
- Is D&A persistently below maintenance capex (i.e. the asset base is being run down)?
- Has anything that belongs in expenses been capitalized — R&D, software, customer acquisition, network costs?
The Essence · This Week's Reflection
Profit is opinion, cash is fact — but moving an expense into investing activities lets both of them lie at once.
Take a core holding and compute cumulative five-year operating cash flow against cumulative net income. If it is below 0.9, write one sentence naming where the gap went. If you cannot, you do not know what you own.
The Principle
Accruals = net income − operating cash flow. The larger the accrual component, the less persistent the current period's earnings — and the market systematically treats the two components as equally reliable.
Origin · Quote
"The persistence of current earnings performance is decreasing in the magnitude of the accrual component of earnings and increasing in the magnitude of the cash flow component."
— Richard G. Sloan, The Accounting Review, Vol. 71, No. 3 (1996)
Reading It Closely
The reason lies in what accruals are made of: bad-debt provisions, inventory write-downs, revenue-recognition timing, deferrals — all estimates. Estimates are easier to stretch and they naturally revert: revenue pulled forward this year is a hole in next year's books. Using 1962–1991 data, Sloan's long-low-accrual / short-high-accrual portfolio earned roughly 10.4% in size-adjusted abnormal return the following year — all of it from numbers on the face of public filings.
Year 1 · net income (top) vs operating cash flow (bottom)
100
93
Schematic: profit accelerates while cash stalls, and the gap widens year by year. The gap is not evidence of fraud — it is a coordinate marked "an explanation is required here."
The Case
In 1992 Enron obtained SEC approval to use mark-to-market accounting for its gas trading business: the estimated net present value of long-dated contracts could be booked into current earnings, while the cash would take a decade or more — or never arrive. The company reported net income of $979 million for 2000. On November 8, 2001 it restated, cutting 1997–2000 net income by roughly $591 million; it filed for bankruptcy on December 2.
Jim Chanos began shorting Enron in November 2000 entirely on public filings — what he read was exactly this gap: returns on capital of only 6%–7%, below the cost of capital, while profits climbed.
Limits · Decision Checklist
The signal both decays and misfires. Green, Hand and Soliman (2011, Management Science) documented the accrual anomaly essentially disappearing around 2003 as hedge-fund capital poured in — a published factor gets killed by its own readers. False positives are just as common: receivables and inventory rise with scale at a fast-growing company, and a large write-down at a cyclical trough drives accruals sharply negative, which looks like superb quality.
- Is the accrual ratio — (net income − operating cash flow) ÷ average total assets — positive and rising for three consecutive years?
- Have receivables and inventory grown faster than revenue several years running?
- Are days sales outstanding (DSO) lengthening even as revenue grows?
The Essence · This Week's Reflection
An accrual gap is not evidence of fraud; it is a coordinate saying "an explanation is required here" — and with no explanation, move on.
For your fastest-growing holding, chart three years of accrual ratio and DSO. If both are rising, can you name one verifiable reason why?
The Principle
Every line of revenue must answer three questions: was it actually sold (did control transfer), will the cash be collected, and is this gross or net. Stretch any one of them and the growth is fictional.
Origin · Quote
"How many legs does a dog have if you call his tail a leg? The answer: Four, because calling a tail a leg does not make it a leg."
— Abraham Lincoln's riddle, quoted by Warren Buffett in the Berkshire Hathaway 2002 Letter to Shareholders
Reading It Closely
Four common techniques, most of them grey rather than illegal: channel stuffing (pushing next period's volume onto distributors); bill-and-hold (booking revenue before shipment); gross accounting (reporting transaction volume as your own revenue); and related-party or round-trip transactions (selling from one hand to the other). One test covers all four: ask where the cash, the inventory and the risk sit right now. If the goods are still in your warehouse, the money is still in the customer's pocket and return risk has not transferred, it is not revenue.
The Cases
Bill-and-hold: in the winter of 1997 Sunbeam sold barbecue grills to retailers at deep discounts with delivery deferred to the following spring, inflating that year's revenue. The SEC sued then-CEO Al Dunlap and others in 2001; the company restated and filed for bankruptcy the same year.
Gross vs net: during its 2011 IPO process Groupon was required to report revenue net of payments to merchants, cutting reported 2010 revenue from $713 million to $312 million. The business did not change for a single day; the entire valuation anchor did.
Fabricated transactions: on January 31, 2020 Muddy Waters published an anonymously authored short report built on 11,260 hours of store video and 25,843 customer receipts. On April 2 Luckin Coffee disclosed an internal investigation: roughly RMB 2.2 billion of sales fabricated across Q2–Q4 2019. The stock fell about 75% that day, was delisted from Nasdaq on June 29, and settled with the SEC for $180 million in December.
Limits · Decision Checklist
Spotting a fraud is not the same as making money on it. Luckin replaced its management, restructured, and years later surpassed Starbucks in store count and revenue in China while returning to profit — the short seller earned that one day, not that company's future (see Day 53). On the other side, a change in presentation is not always manipulation: ASC 606 / IFRS 15, effective from 2018, re-sequenced revenue timing and gross-versus-net judgments for a great many companies. Calibrate the basis before comparing across years, or you will read a standards change as fraud.
- Can the spread between revenue growth and operating cash flow growth be explained? For how many years has it persisted?
- Is deferred revenue / contract liability growing or shrinking? (A leading indicator of real demand.)
- Is there sizable "other revenue" or related-party revenue? What share, and who is the counterparty?
The Essence · This Week's Reflection
Call the tail a leg and the dog still has four; call transaction volume revenue and the business is still the same business.
Find the fastest-growing revenue line in your portfolio and write down when it is recognized — on shipment, on acceptance, amortized over a subscription term? If you cannot say when, you cannot say whether the growth is real.
The Principle
Accounting fraud rarely starts in accounting; it starts in incentives. Look first at who is driven by what, who is watching, and who pays the watcher — then look at the numbers. Reverse that order and a handsome report will convince you.
Origin · Quote
"Show me the incentive and I will show you the outcome."
— Charlie Munger, "The Psychology of Human Misjudgment" (Harvard lecture, 1995; collected in Poor Charlie's Almanack)
Reading It Closely
The structural red flags make a short list: an auditor replaced or resigning, especially near a reporting date; an irregular CFO departure; late annual filings; disclosed material weaknesses in internal control; large related-party transactions and off-balance-sheet vehicles; pay tied hard to revenue or EPS with results that just clear the bar year after year; and non-GAAP adjustments multiplying over time. None of these is evidence. Their function is to raise the standard of proof you demand.
The Case
Enron's off-balance-sheet vehicles — Chewco, LJM1, LJM2 — were controlled by CFO Andrew Fastow himself, who profited from them, and exploited the then-current rule that 3% outside equity was enough to avoid consolidation, moving vast debt off the balance sheet. Its auditor, Arthur Andersen, collected about $52 million in fees from Enron in 2000, split roughly evenly between audit and consulting — the watchdog's largest client was the thing it was watching. In June 2002 Andersen was convicted of obstruction of justice and some 85,000 people lost their jobs; the US Supreme Court unanimously overturned the conviction in 2005, long after the firm had disintegrated. This directly produced the Sarbanes-Oxley Act, under which the CEO and CFO must personally certify the financial statements.
Limits · Decision Checklist
Red flags have a high false-positive rate. Auditors are often changed purely over fees or mandatory rotation, and related-party transactions are normal rather than fraudulent in family-controlled structures and parts of the emerging world (see Day 48 and Day 49). Restatements fell after SOX, at the cost of high compliance burdens that pushed small companies toward delisting — the benefits and the costs of regulation are both real. The correct use of a red flag is not a death sentence but a reversal of the burden of proof: from "what reason is there not to buy" to "what reason makes it have to be this one."
- Has the auditor or CFO changed in the past three years? Does the stated reason survive scrutiny?
- Which metric drives executive bonuses? Has the company "just cleared the bar" repeatedly?
- What share of revenue is related-party? How is the counterparty connected to the controlling shareholder?
- How has the gap between non-GAAP and GAAP profit trended over three years? Do the excluded items include "one-offs" that recur every year?
The Essence · This Week's Reflection
Numbers are the outcome; incentives are the cause. If you cannot read the incentive structure, all you can do is choose to believe the numbers.
Open a holding's compensation plan and find the one or two metrics that decide management's bonus. If you were CEO and 2% short of the target this year, which accounting estimate would you reach for first? That is the line item to examine.
Going Deeper
Can an ordinary investor really detect fraud by reading filings?
Usually not — and it is not necessary. Nine-tenths of the value of forensic work is keeping yourself out of the worst cohort of companies, not catching the next Enron. A cheap exclusion screen is enough: five-year OCF/net income, the accrual ratio, the DSO trend, auditor and CFO changes. That is a ten-minute pass per company; if it fails, move on. The cost of passing is trivial — there are thousands of others — while the cost of a miss can be permanent.
AI can read every annual report. Is forensic work already automated?
The quantifiable part is being automated: accruals, changes in presentation, year-over-year drift in the language of the footnotes — machines are far faster than people, so the excess returns to those signals will decay just as the accrual anomaly did. Two things will not disappear. First, the people committing the fraud are also using AI to make the text look more like a normal sample; detection and evasion co-evolve as an arms race. Second, the last step of forensic work is a judgment about motive and people, which is not something text statistics can answer.
Accounting standards keep growing more complex. Protection or cover?
Both. The precise definitions of a rules-based regime (US GAAP) are also a map for misleading people while remaining compliant — Enron's 3% consolidation rule was exploited exactly. A principles-based regime (IFRS) leaves room for judgment, and therefore room for interpretation. The real variable is not the standard but the probability of enforcement and the cost of violation: part of any discount is a governance discount, not a valuation opportunity.
Why does fraud so often appear when growth is fastest?
Because fraud is fundamentally borrowing from the future. Channel stuffing borrows next quarter's volume; early recognition borrows next year's revenue; and the price is that the following period must borrow more. It is structurally identical to a Ponzi scheme: nothing is exposed as long as the growth rate does not fall. So the most dangerous moment is not when a company visibly deteriorates but when growth decelerates for the first time and the report still comes in "in line" — that is where the hole starts being filled and the accrual gap starts to open.