How the questions usually arrive
Few owners hear about a PPP loan review from an investigator first. It comes as a forgiveness denial, a lender asking for supporting documents it never requested at the time, a subpoena to a bank, a civil demand letter, or a call about records. Many reviews begin by comparing applications against each other and against filings made elsewhere, so what triggered the look is often a mismatch rather than a complaint. A recurring difficulty is that owners are being asked about a submission they never saw, because an agent, a payroll service, or a preparer filled it in and pressed send on their behalf. Answering from memory about figures you did not calculate is where a routine reply starts to go wrong.
Rebuild the file that was actually submitted
Ask the lender in writing for a copy of the application as submitted, including attachments, because what you signed and what was uploaded are not always the same document. Then gather payroll records for the period claimed, tax filings covering it, and bank statements showing the funds arriving and what they were used for. Add the forgiveness submission and any correspondence about it. Keep everything exchanged with whoever prepared the application, including how that person was paid. If the business changed hands, closed, or merged, find out who holds the records now before they are discarded.
Different tracks, and telling them apart
These matters resolve in quite different ways: repayment, denied or reduced forgiveness, a civil claim, or a criminal case. The opening letter does not always reveal which one you are on, and a request that reads like routine paperwork can be groundwork for something else. That is where most avoidable harm happens, because documents and explanations get sent quickly to make the problem go away. In a first conversation we work out who is asking and why, what the application actually said, and who prepared it. We also go through where the money went and what has already been said or sent on your behalf.