Forensic Audit · Corporate Fraud · Financial Investigation · Electronic Evidence · Litigation

Forensic Audit in India: Fraud Investigation, Evidence, Corporate Law, Banking, IBC & Litigation

A forensic audit is a purpose-driven investigation of financial records, transactions, digital material and control failures designed to answer a defined allegation or suspicion and preserve findings for regulatory, disciplinary, civil or criminal use. It is not merely a more detailed statutory audit. Its scope, methodology and evidentiary discipline depend on the suspected wrongdoing, the legal forum and the data available.

1. What does “forensic audit” mean?

There is no single Indian statute that gives one universal definition applicable to every forensic engagement. In practice, the term describes an investigation using accounting, transaction analysis, document examination, digital evidence and interviewing techniques to test suspected misconduct or identify unexplained financial events.

The expression “forensic” reflects the possibility that the work product may later be scrutinised by a court, tribunal, regulator, lender, disciplinary authority, board committee, insolvency professional or law-enforcement agency. That possibility changes how the engagement should be planned. The investigator must be able to explain data sources, assumptions, exclusions, calculations and the chain from raw records to findings.

2. Forensic audit is not the same as statutory audit

Issue	Statutory / financial statement audit	Forensic audit / investigation
Primary objective	Audit opinion on financial statements under the applicable framework.	Investigate a defined suspicion, allegation, loss or transaction pattern.
Approach	Risk-based audit procedures and sampling within auditing standards.	Issue-led testing, reconstruction, data analytics, document tracing and interviews.
Materiality	Financial statement materiality is central.	A small transaction may be critical if it proves concealment, collusion or intent.
Output	Audit report/opinion.	Findings report, transaction schedules, evidence map, quantified exposure and limitations.
Likely later use	Shareholders, regulators and statutory users.	Board action, recovery, litigation, regulatory reporting, insolvency or criminal investigation.

3. When is a forensic audit usually commissioned?

Typical triggers include:

• unexpected cash or inventory losses;
• unexplained payments to vendors or consultants;
• duplicate invoices or round-sum payments;
• related-party transactions not matching commercial terms;
• suspected diversion or siphoning of loan funds;
• employee expense or procurement fraud;
• fictitious employees, customers or vendors;
• kickbacks, bribery or conflicts of interest;
• financial-statement manipulation;
• fraud allegations in a whistleblower complaint;
• bank or lender concerns about end-use of funds;
• insolvency-related review of preferential, undervalued, extortionate or fraudulent transactions;
• shareholder or joint-venture disputes;
• suspected data manipulation or destruction of records; or
• a regulator, board committee, lender or investigating agency requiring a focused review.

4. A forensic audit should begin with a written scope

The investigation should not begin with the vague instruction “find fraud”. A defensible scope identifies:

1. the allegation or red flag;
2. the relevant entities and individuals;
3. the review period;
4. accounts, systems and data sources to be examined;
5. specific questions to be answered;
6. legal or regulatory deadlines;
7. who may receive the report;
8. whether litigation or law-enforcement use is contemplated; and
9. what limitations exist on access to records, devices, third parties or overseas data.

Scope discipline is important because a forensic report is only as strong as the records tested. The report should distinguish between matters proved by records, matters supported by indicators, matters dependent on an interview account and matters that could not be verified.

5. Evidence preservation comes before analysis

Once misconduct is suspected, uncontrolled access to systems can compromise the evidence. Relevant email, accounting ledgers, ERP logs, bank data, mobile-device material, CCTV, access logs, cloud files, invoices and physical records should be preserved under an appropriate legal and technical protocol.

Preservation should record who collected the material, when it was collected, the source, whether the original was altered, and how working copies were created. For digital evidence, forensic imaging, metadata preservation, access controls and hash verification may be important depending on the nature of the case.

6. Electronic records under the Bharatiya Sakshya Adhiniyam, 2023

Electronic evidence now falls within the Bharatiya Sakshya Adhiniyam, 2023. Sections 61–63 recognise electronic or digital records and prescribe the legal framework for proving their contents. A forensic audit team should therefore avoid treating screenshots, spreadsheets or exported emails as self-proving merely because they look authentic.

Where litigation is foreseeable, counsel and the technical team should consider at the preservation stage how the underlying electronic record will later be proved, what system generated it, who controlled the system, whether metadata is available and what certificate or foundational evidence the applicable provision requires.

Official text: Bharatiya Sakshya Adhiniyam, 2023.

7. Transaction reconstruction

The central forensic exercise is often reconstruction. Instead of reading the general ledger in isolation, the investigator traces a transaction from commercial origin to final economic destination:

purchase request → approval → vendor master → purchase order → invoice → goods receipt → payment approval → bank debit → beneficiary account → subsequent movement of funds.

Where records are inconsistent, the investigator should document the break in the chain rather than infer facts that the documents do not establish.

8. Common red flags in vendor and procurement fraud

• vendor bank account matching an employee or connected person;
• multiple vendors sharing addresses, phone numbers, GST details or bank accounts;
• vendors created shortly before high-value payments;
• invoice splitting below approval thresholds;
• repeated round-number invoices;
• lack of competitive bids where policy required them;
• goods receipts without corresponding logistics or inventory movement;
• payments materially above comparable market pricing;
• payments made just before quarter/year-end and reversed later;
• consultancy descriptions too vague to establish deliverables; and
• unusual concentration of business with a vendor linked to an employee or director.

9. Related-party and management override risk

Some investigations fail because they examine only routine controls. Fraud involving senior management frequently uses override: manual journal entries, exceptions to procurement policy, unilateral vendor onboarding, off-system approvals, informal instructions or transactions routed through ostensibly independent third parties.

A forensic review should therefore compare the formal approval trail with actual decision-making. Company-law disclosure obligations, board minutes, registers of contracts, related-party records and beneficial ownership information may be relevant depending on the allegation.

10. Companies Act, 2013: fraud investigation and auditor reporting

The Companies Act contains several provisions relevant to corporate fraud. Section 143(12) creates a statutory reporting framework where a company auditor, in the course of performing audit duties, has reason to believe that fraud by officers or employees is being or has been committed, subject to the prescribed thresholds and procedure. This is distinct from a private forensic engagement.

Section 212 provides the statutory framework for investigation by the Serious Fraud Investigation Office (SFIO) when the Central Government assigns a company investigation to it. SFIO describes its function as investigating and prosecuting complex corporate frauds assigned under Section 212.

Official sources: Companies Act, 2013 and Serious Fraud Investigation Office.

11. A private forensic audit is not an SFIO investigation

A company, lender, investor, resolution professional or board may commission a private forensic review. That engagement does not acquire statutory investigative powers merely because it is called “forensic”. Investigators cannot compel third-party evidence unless a lawful process gives them that power. They must work with the records legitimately available, contractual access rights, consent and any court/regulatory process that may later be invoked.

12. Banking and NBFC fraud-risk investigations

The Reserve Bank of India issued revised Fraud Risk Management Master Directions on 15 July 2024 for commercial banks/AIFIs, cooperative banks and applicable NBFCs. The regime strengthens board oversight, early-warning systems, reporting, internal audit/control frameworks and the process for identifying fraud. The Directions also incorporate natural-justice requirements before persons or entities are classified as fraud, reflecting the Supreme Court’s decision in State Bank of India v. Rajesh Agarwal.

Forensic review in a lending context may therefore interact with regulatory governance, end-use of funds, borrower responses, red-flagged accounts and reporting to law-enforcement agencies. A forensic finding and a regulatory fraud-classification decision are related but legally distinct steps.

RBI source: Revised Fraud Risk Management Directions, 2024.

13. Listed companies and SEBI disclosure

For listed entities, forensic audit can also create securities-law disclosure consequences. Schedule III of the SEBI Listing Regulations framework includes disclosure relating to initiation of a forensic audit and the final forensic audit report in the circumstances specified by the regulation/circular framework. The precise current disclosure requirement should be checked against the version of the LODR Regulations and SEBI circulars applicable on the date.

This is important because a board cannot treat every forensic engagement as a purely confidential internal exercise without first checking securities-law disclosure obligations.

14. Insolvency: transaction audits and avoidance transactions

During a corporate insolvency resolution process, a resolution professional must examine whether transactions attract the avoidance and fraudulent-trading provisions of the Insolvency and Bankruptcy Code. Transaction or forensic reviews are often used to analyse payments, asset transfers, related-party dealings, preferential transactions and conduct potentially relevant to Sections 43, 45, 50 and 66.

A forensic report does not itself make an avoidance transaction legally established; the statutory application must be brought before the adjudicating authority and proved under the applicable provision. IBBI disciplinary orders illustrate that findings in a forensic audit may provide important material requiring an insolvency professional to examine and act on suspected avoidance transactions.

For related corporate-liability issues, see When Directors May Be Personally Liable for Company Debts, Fraud and IBC Claims.

15. GST and tax-related forensic work

Tax fraud investigations may require reconciliation across invoices, e-way bills, GST returns, vendor/customer ledgers, bank entries and underlying supply records. The legal question may be whether a supply actually occurred, whether an invoice is genuine, whether input tax credit is supported, or whether transactions form part of a circular or accommodation-entry structure.

A forensic report should distinguish accounting anomalies from statutory tax violations. The tax consequence should be analysed under the applicable GST or income-tax provision rather than inferred solely from unusual accounting.

16. Money laundering and proceeds-of-crime analysis

Where an underlying scheduled offence is alleged, transaction tracing may become relevant to money-laundering proceedings. A forensic review can map flows, layering, beneficial recipients and asset acquisition, but a private report cannot itself determine that property is “proceeds of crime” within the Prevention of Money Laundering Act. That conclusion depends on the statutory ingredients, the scheduled offence and the competent legal process.

For the separate bail framework, see PMLA Bail: Section 45, Long Custody and Supreme Court Law.

17. Employee fraud investigations

Employment-linked investigations require particular care because evidence gathering may lead to suspension, disciplinary proceedings, termination, recovery or a criminal complaint. The employer should align the forensic investigation with employment contracts, standing orders/service rules, privacy obligations, device-use policies and principles of procedural fairness applicable to the organisation.

An internal investigator should avoid converting interviews into coerced confessions. Interview notes should record who attended, whether documents were shown, whether the interviewee accepted or disputed them, and whether follow-up documents were promised.

18. Interview evidence

Interviews are useful for understanding process and obtaining explanations, but they should not replace documentary proof. A strong report distinguishes:

• what the records show;
• what a person stated;
• what the investigator independently corroborated;
• what remains disputed; and
• what could not be tested because evidence was unavailable.

Where criminal exposure is possible, the legal implications of interviewing suspects, employees or directors should be considered before the interview strategy is finalised.

19. Data analytics in forensic work

Modern investigations may test thousands or millions of transactions. Useful analytics include:

• duplicate invoice and payment detection;
• Benford-style anomaly screening where suitable;
• round-value and weekend/holiday transaction analysis;
• split purchases below approval thresholds;
• vendor-bank-account matching;
• journal entries posted by unusual users or at unusual times;
• rapid movement of funds after receipt;
• network analysis of common addresses, directors, phones or accounts;
• inventory movement inconsistent with recorded sales/purchases; and
• time-sequence testing against approvals and supporting documents.

Analytics identifies anomalies; it does not itself prove fraud. Each significant anomaly must be investigated against source records and plausible explanations.

20. Quantifying loss

Financial loss should be calculated transparently. Depending on the case, the report may separate:

• confirmed unauthorised payments;
• suspected payments requiring further evidence;
• overpricing compared with a stated benchmark;
• inventory shortages;
• tax exposure;
• interest or financing cost;
• consequential loss that requires legal proof; and
• recoveries already made.

The report should avoid presenting every suspicious transaction as final “loss” if goods/services may have been received or the figure depends on assumptions.

21. What a professional forensic report should contain

1. Mandate and scope — who commissioned the review and the questions asked.
2. Period and entities examined.
3. Data received and data not received.
4. Methodology — transaction testing, analytics, interviews and verification.
5. Executive findings separated by issue.
6. Detailed factual analysis with document references.
7. Transaction schedules linking conclusions to source records.
8. Management/subject responses where obtained.
9. Quantification with assumptions clearly stated.
10. Control failures distinct from allegations of misconduct.
11. Limitations — inaccessible data, missing documents or uncooperative witnesses.
12. Appendices/evidence index.

22. Avoid conclusory criminal labels unless the legal test is established

A report should be precise about its role. Terms such as “fraud”, “cheating”, “criminal breach of trust”, “forgery”, “money laundering” and “conspiracy” have legal ingredients. An accounting anomaly may support investigation of those offences, but the forensic auditor should not substitute an unsupported legal conclusion for evidence.

Where counsel is involved, the report can identify facts potentially relevant to specified legal provisions while reserving the ultimate legal conclusion for the competent authority or court.

23. Evidentiary value of a forensic audit report

A forensic report is not automatically conclusive evidence merely because it was prepared by a specialist. In litigation, the opposing party may challenge the data source, methodology, assumptions, chain of custody, completeness of records and expertise of the person giving evidence.

If the report is relied on through an expert witness, the legal rules governing expert opinion and proof of the underlying documents matter. If the report merely compiles accounting data, the person who collected or generated the source records may also be necessary depending on the issue.

24. Legal privilege and investigation structure

Businesses often assume that labeling a document “confidential” or “forensic” makes it legally privileged. That is unsafe. Privilege depends on the applicable legal doctrine, purpose and communication, not the document title. Where litigation is anticipated, counsel should structure communications and engagement carefully while recognising that factual source documents do not become privileged merely by being sent to a lawyer or investigator.

25. Board and management response after findings

Once findings are delivered, the organisation should distinguish among:

• control remediation;
• employee disciplinary action;
• civil recovery;
• insurance notification;
• regulatory disclosure/reporting;
• lender or shareholder communication;
• criminal complaint or law-enforcement cooperation;
• restatement/correction of accounts if required; and
• preservation for pending litigation.

Different findings may require different responses. A governance failure does not automatically justify a criminal complaint; a proved diversion of funds may require more than a control-policy amendment.

26. Common mistakes in forensic investigations

• starting analysis before preserving digital evidence;
• allowing a suspected user to keep administrator access;
• using an undefined scope;
• relying only on management-provided spreadsheets without source verification;
• failing to reconcile bank statements to ledger data;
• treating every policy violation as fraud;
• ignoring exculpatory or contradictory evidence;
• conducting interviews before reviewing the documents needed for effective questioning;
• failing to record limitations;
• quantifying “loss” without showing the calculation;
• circulating draft allegations too widely and compromising confidentiality; and
• assuming the final report will be admissible without planning how source records will be proved.

27. Documents commonly reviewed

Area	Typical records
Accounting	General ledger, trial balance, journal entries, sub-ledgers and financial statements.
Banking	Bank statements, payment files, beneficiary details, loan accounts and confirmations.
Procurement	Vendor master, bids, POs, invoices, GRNs, contracts and approval matrices.
Corporate	Board minutes, related-party records, registers, shareholding and beneficial-ownership information.
Digital	Email, ERP logs, device data, cloud records, access logs and metadata.
Tax	GST returns, e-way bills, tax invoices, TDS data and income-tax records.

28. Questions to ask before appointing a forensic investigator

1. What exact issue is being investigated?
2. Is independence required from management or the board?
3. Will digital forensics be needed?
4. Is specialist industry knowledge required?
5. Is court testimony likely?
6. Who owns and may disclose the report?
7. Will third-party confirmations be required?
8. What legal/regulatory deadlines exist?
9. How will evidence be preserved?
10. Will counsel coordinate privilege, interviews and litigation strategy?

29. Frequently asked questions

Is a forensic audit compulsory for every suspected fraud?

No universal rule makes a private forensic audit compulsory for every suspected fraud. The requirement may arise from a regulator, lender, insolvency process, board decision, contractual framework or the circumstances of the case.

Can a forensic auditor declare someone guilty of a crime?

A forensic report may identify facts, anomalies and evidence relevant to suspected wrongdoing. Criminal guilt is determined through the competent legal process.

Can a forensic audit report be used in court?

It may be relied upon, but its evidentiary weight depends on proof of the underlying records, methodology, witness competence and applicable evidence law. It is not automatically conclusive.

Does forensic audit mean only accounting fraud?

No. It may involve procurement, inventory, digital systems, bribery, conflicts, related parties, loan funds, tax records or other financial misconduct.

What is the difference between forensic audit and internal audit?

Internal audit is a continuing assurance/control function. A forensic investigation is ordinarily issue-specific and evidence-oriented, often triggered by a suspected irregularity.

Can forensic audit findings support an IBC avoidance application?

They can provide investigative material, but the statutory transaction must still be pleaded and proved before the adjudicating authority under the relevant IBC provision.

30. Related legal reading

For connected corporate and financial-risk issues, see Director Personal Liability for Fraud, GST, Guarantees and IBC, PMLA Bail and Section 45, and the firm’s broader corporate/criminal-law research resources.

31. Conclusion

A forensic audit is most useful when it converts suspicion into a transparent evidence trail. The quality of the engagement depends on scope, preservation, source verification, transaction reconstruction, fair testing of explanations and disciplined separation between accounting findings and legal conclusions. Where litigation or regulatory action is foreseeable, evidence strategy should be designed at the beginning of the investigation—not after the report has already been written.