Plumbline Forensic Group Request a consult
Plumbline — Forensic Accounting & Investigations

The numbers always confess.

Corporate fraud hides in the invoices, the vendors, and the expenses no one questions. Plumbline reads the records line by line and shows you exactly where the money went — with proof that holds up in court.

Request a confidential consult What we do
Founded byDiane Lynn
DisciplineForensic accounting & fraud investigation
Experience30+ years on the ledger
BasedTucson · Phoenix · Nationwide
What we find

Most fraud isn't clever.
It's patient — and it's already in your books.

It looks like an ordinary line item until someone finally reads it closely. These are the schemes we're hired to unwind.

Phantom vendors Inflated invoicing Duplicate payments Kickbacks Expense abuse Ghost payroll Skimming Billing for work never done Vendor collusion
Practice

Six ways we get to the truth.

One discipline, applied wherever the money went. Every engagement starts with the records and ends with something you can act on.

01

Forensic Accounting

Reconstructing records, tracing funds, and quantifying loss when the books stop telling the truth.

02

Vendor & Invoice Fraud

Phantom vendors, inflated billing, and kickbacks hidden in accounts payable — matched line by line to work that was actually done.

03

Asset Misappropriation

Skimming, expense abuse, and ghost payroll — the slow theft that rarely shows up in any single entry.

04

Corporate Spend Audits

An independent read of where the money actually goes, before a suspicion turns into a lawsuit.

05

Litigation Support

Clear exhibits, defensible methodology, and expert testimony that holds up under cross-examination.

06

Fraud Risk & Controls

Closing the gaps that let it happen in the first place — so it doesn't happen to you twice.

Approach

How an investigation runs.

A forensic engagement is a sequence, not a scramble. Everything is documented as if it will be read aloud in court — because it might be.

01

Intake

A confidential conversation about what you're seeing and what you suspect. No commitment, no paper trail on your end.

02

Examine

We pull the records — ledgers, invoices, statements, systems — and read them the way the people who built the scheme hoped no one ever would.

03

Trace

We follow each dollar to its destination and document the path with evidence that stands on its own.

04

Report

Findings in plain language, with exhibits a board member, a jury, or a prosecutor can follow without an accounting degree.

05

Testify

When it goes to court, we're there — to explain the numbers to a judge and jury, and to defend how we found them.

06

Independence

We're hired by a party. We don't report to one. A record we can't verify leaves the report entirely — with a note naming what we asked for and who declined to produce it.

Independence

We're retained by a party.
We don't report to one.

The engaging party selects the matter and pays the fee. It does not select the findings.

Every conclusion rests on records we examined ourselves. Where those records support the client's position, the report says so. Where they don't, the report says that too — same place, same language, same prominence.

A report written to please the party who commissioned it isn't a forensic report. It's an argument with footnotes. We don't produce them.

So the reader can assume one thing throughout: no finding was shaped by who is paying for it.

Method

How we decide what counts.

A document earns its place in a report by being what it claims to be. That's a question about the document — not about which side produced it.

A record produced by our own client gets the same examination as one produced by the other side. Neither is credited for its source, and neither is discounted for it. Before we rely on anything, we test four things.

Internal consistency
Totals that foot, dates in sequence, balances that carry forward from one period to the next.
Independent agreement
Whether the record matches other evidence of the same events — bank statements, processor records, system logs.
Native form
Whether the document looks like what the originating system actually produces, rather than something reshaped on the way out.
Signs of later editing
Entries changed, recategorized, or added after an earlier version of the same record was already produced.

When a document doesn't hold up: the protocol.

Three steps, applied in order — and applied identically no matter which party the document favors.

01

Examine

The document is tested against every criterion above, and against every other record in the file that touches the same transactions.

02

Request

If a question remains, we ask for what would answer it — in writing, to a named recipient, with the date recorded.

03

Omit

If it isn't produced, the document comes out in full. Not weighted, not caveated, not partially credited. Out.

What we ask for at step two.

Not a password. Three things that let anyone confirm a produced record matches what the system holds.

The native file
In its original format with metadata intact — not a printout, a screenshot, or a flattened export.
The audit log
Covering the relevant period, showing what was entered, changed, or deleted — by which user account, and when.
Supervised access
Read-only, to the originating system, sufficient to confirm the produced record and the system record are the same record.

These are ordinary requests. A party with nothing to hide produces them as a matter of course — which is precisely why a refusal is worth recording.

Omission is recorded. Never silent.

An excluded document doesn't quietly disappear. It's entered in the Schedule of Excluded Records, a numbered exhibit in every report. Where nothing was excluded, the schedule says so.

Document
Title, date, page or entry count, and the party that produced it.
Question raised
The specific reason authenticity or completeness could not be confirmed.
Requested
Exactly what was asked for — native file, audit log, or system access.
Requested from
The named individual or firm, and the method of the request.
Date requested
The date of the written request, and of any follow-up.
Response
What was produced, what was refused, or that no reply came.
Effect on findings
Every figure, schedule, or conclusion that would have relied on the record — and is therefore absent from this report.

That last line is the one that matters. A reader has to be able to see not only that a document was pulled, but what the report would have been able to say if it hadn't been. Nothing is reconstructed from an omitted record, and no figure it contains is carried into any total.

Why we build it this way.

Three reasons — and the third is the one that survives cross-examination.

It shows the whole file
The reader sees every record we were handed — not merely the subset we relied on. Nothing leaves without appearing in the same report that removed it.
It's reproducible
Another examiner, given the same records and the same protocol, should arrive at the same exclusions. An exclusion that can't be reproduced is a preference, not a method.
The reason sits beside the gap
A document is never excluded for what it says — only because a specific request for verification went unanswered. The schedule names the request and the party who declined it.

The exclusion of a record is a finding. We report it as one — regardless of which party the excluded record would have favored.

What our reports don't do.

A report states what the records show. It does not state what they mean legally.

No legal conclusions
No opinion on liability, on intent, on whether anyone acted knowingly, or on how a payment or relationship should be characterized in law. Those belong to the finder of fact.
No estimates in place of evidence
Where the records can't answer a question, we say the question can't be answered on the present record — and identify what would answer it.
Facts kept separate
Facts, assumptions, and conclusions are labeled as such throughout. An inference is never presented as a measurement.
Findings can change
Findings are stated on the records available at the date of the report. If more records surface, or something we relied on proves unreliable, we amend — including when the amendment runs against our own client.
A document we can't verify contributes nothing to any conclusion — in either direction. — Plumbline Forensics, Statement of Method
The Founder

Diane Lynn

Founder & Principal Forensic Accountant

Diane spent more than thirty years in accounting before the work found its edge. The turn came at JD Demolition, where a routine look at the books turned up thousands of dollars in fraudulent invoicing that no one else had caught — bills for work that was never done, approved and paid, quarter after quarter.

Chasing that trail — matching invoices to jobs, jobs to sites, sites to the dates they were supposedly worked — she found the part of accounting she'd been missing her whole career. Not keeping the books. Reading them.

When she finally retired, retirement didn't take. Within months she was restless, certain there were other companies quietly bleeding money to the same tired schemes, with no one looking closely enough to notice.

So she founded Plumbline — to give owners, boards, and counsel someone who would look. Today she leads a team of accountants and investigators who do exactly that.

Fraud isn't clever. It's patient. To catch it, you just have to be more patient than the person who built it. — Diane Lynn
The Team

One name on the door.
A team behind it.

Diane doesn't work alone. Plumbline's other investigators and accountants stay out of the spotlight by design — professionals who've worked both sides of the ledger.

Confidentiality is the whole point of the work. We don't put their faces on a website. We won't put yours on one either.

01Forensic CPAsFinancial reconstruction
02Certified Fraud ExaminersScheme detection
03Former Internal AuditorsControls & risk
04Licensed InvestigatorsField & asset tracing
05Data AnalystsAnomaly & pattern review
06AML / CAMS SpecialistsMoney-movement tracing
Representative Matters

What it looks like when it works.

Every engagement is confidential, so details below are anonymized. The patterns are exactly what we're hired to unwind.

Matter A — Construction

The invoices for work that was never done

A contractor's payables had been padded for years with billing for jobs that existed only on paper. We matched every invoice against site records and schedules.

Six-figure recovery · referred to counsel
Matter B — Distribution

The vendor that didn't exist

A phantom supplier had been set up inside the payment system by someone with the access to approve it. We traced the routing back to a single controlling hand.

Scheme documented · referred for prosecution
Matter C — Professional Services

The expenses that never added up

Executive reimbursements that outran any plausible business purpose, spread thin across enough categories to avoid a second look — until someone took one.

Loss quantified · settled before trial

Representative matters are composites drawn from real engagement types and anonymized to protect client confidentiality. Outcomes are illustrative and not a prediction or guarantee of results in any specific matter.

Contact

Something doesn't add up. Let's find out why.

Every conversation starts confidential and stays that way. Tell us what you're seeing — no engagement, no obligation.

ServingTucson · Phoenix · Nationwide
HoursBy appointment — discretion assured

Encrypted intake · never shared · response within one business day

Thank you — your note is on its way to Diane's desk. We'll be in touch within one business day.