Management Override & Fraud-Control Review in India: Manual Journals, Vendor Changes, Discounts, Write-Offs, Payments & Board Oversight 2026
A board-level framework for identifying where seniority, emergency authority or privileged access can bypass otherwise sound financial, procurement, commercial and system controls.
Management override is the ability—formal or informal—to bypass a normal control because of seniority, emergency authority, privileged system access or influence over subordinate approvers. Override is not automatically improper. Companies need legitimate exception mechanisms for urgent payments, customer issues, crises and unusual transactions. The risk arises when exceptions become routine, undocumented or immune from independent review.
A mature review asks: which controls can senior personnel bypass, how often does that happen, what evidence supports the exception, who independently reviews it, and whether the same person can initiate, approve and conceal the transaction.
1. Why management override deserves separate review
Controls designed for ordinary employees can be ineffective where senior users possess broad system rights or can instruct others to bypass procedure. This is particularly important in promoter-led or fast-growing companies where informal authority may develop faster than written governance.
Companies Act concepts concerning safeguarding assets, prevention and detection of fraud and irregularities, internal financial controls where applicable, audit oversight and vigil mechanisms make override a governance concern as well as an operational one.
See the broader Corporate Fraud Risk Assessment in India.
2. Build an override universe
| Area | Typical override | Evidence |
|---|---|---|
| Accounting | Manual journals, backdating, provision changes | ERP logs, journal support, user rights |
| Procurement | Single-source buy, emergency PO, rate override | Bids, POs, approval logs |
| Vendor master | Bank-detail or KYC change | Master-data audit log and verification record |
| Sales | Price, discount, credit note or credit-limit override | CRM/ERP approvals, customer correspondence |
| Claims | Settlement above evidence or policy threshold | Claim file, authority and settlement note |
| HR/payroll | Off-cycle payment, allowance, bonus or exception | HRMS, payroll and approval records |
3. Manual journal-entry testing
Manual journals deserve targeted review because they can alter reported results without passing through ordinary transaction flows. Useful analytics include entries posted by privileged users, after-hours entries, period-end entries, round amounts, unusual account combinations, reversals shortly after period close and entries lacking supporting documents.
An unusual journal is not necessarily improper. The reviewer should verify accounting rationale, authority, supporting evidence and whether the entry was independently reviewed.
4. Vendor-master override and bank changes
Vendor-bank changes are high-risk because a single incorrect change can redirect legitimate payments. Review who may edit vendor master data, whether the same person can approve payment, how changes are independently verified and whether audit logs can be altered.
Repeated urgent bank changes, changes immediately before large payments or instructions from senior personnel to bypass verification deserve enhanced testing.
See Vendor & Procurement Fraud Risk in India.
5. Emergency procurement and single-source approvals
Emergency procurement can be legitimate, particularly during breakdowns, shortages, customer-critical events or crises. The control weakness is when emergency classification becomes the normal route for avoiding competitive sourcing or higher approvals.
Analyse repeated emergency purchases by vendor, department and approver, and determine whether post-event benchmarking or ratification occurs.
6. Pricing, discounts and credit notes
Commercial overrides can transfer significant value without a direct cash payment. Review discounts outside policy, customer-specific price changes, credit-note spikes, rebates, free goods, retrospective discounts and sales incentives influenced by the same decision-maker.
High-risk patterns include repeated override for one customer, discounts immediately before period end, credit notes after revenue recognition or undocumented verbal commitments.
7. Write-offs, waivers and settlements
Bad-debt write-offs, inventory write-offs, claim settlements, penalty waivers and recovery compromises should be supported by evidence and authority. A write-off can conceal poor controls or related-party benefit if no independent review exists.
For claims-focused controls, see Claims Fraud & Claims Risk Assessment in India.
8. Privileged system access
Administrators and super-users may be able to change workflows, master data, approval limits or logs. Privileged access should be limited, monitored and periodically recertified. Emergency access should be time-limited and independently reviewed.
The audit should test whether users can both modify a control and approve the transaction affected by that control.
9. Executive instructions outside the system
Informal instructions through calls, messaging apps or verbal directions can pressure control staff to bypass normal procedure. Material exceptions should be moved into a documented workflow even when originated by senior leadership.
Finance, procurement and HR should have a clear escalation path if instructed to take an action outside policy. A healthy governance culture allows control functions to ask for written authority without fear of retaliation.
10. Override analytics
Useful analytics include transactions just below approval thresholds, after-hours approvals, weekend postings, repeated manual entries by privileged users, vendor changes followed by payment, high discount concentration, repeated post-facto approvals, off-cycle payroll, unusual write-offs and exceptions involving the same manager across multiple processes.
Analytics identify patterns for verification; they do not establish intent.
11. Link override review to whistleblower and investigation data
Whistleblower complaints may identify where formal controls are routinely bypassed. Compare allegations with override logs, user rights and transaction data. If a credible allegation involves senior management, investigation oversight should be independent.
See Whistleblower Investigation Protocol in India once published and Board-Led Corporate Internal Investigations in India.
12. Override severity matrix
| Rating | Illustrative condition | Response |
|---|---|---|
| Critical | Override linked to material loss, false records, senior-management allegation or evidence destruction | Independent investigation and immediate control restriction |
| High | Repeated post-facto approvals, privileged conflicts, unsupported vendor/payment changes | Targeted review and redesign |
| Medium | Documented exception but weak independent review | Strengthen governance and monitoring |
| Low | Rare, justified and fully approved exception | Routine tracking |
13. Board-ready deliverables
- override universe and risk map;
- manual journal exception analysis;
- vendor-master and bank-change report;
- emergency procurement register;
- pricing/discount/credit-note exception schedule;
- write-off and settlement review;
- privileged-access conflict report;
- post-facto approval trend analysis;
- management override heat map;
- independent-review protocol; and
- 30/60/90-day remediation plan.
14. 30/60/90-day remediation
0–30 days: preserve logs, identify privileged users, restrict incompatible access, review major recent overrides and introduce mandatory documentation for emergency transactions.
31–60 days: automate exception reporting, strengthen vendor-bank verification, redesign discount/write-off controls and create independent approval for high-risk overrides.
61–90 days: implement quarterly privileged-access review, trend dashboards, Audit Committee/board reporting where appropriate and periodic data analytics for override patterns.
15. Frequently asked questions
Is every management override suspicious?
No. Legitimate exceptions occur. The question is whether they are justified, authorised, documented and independently reviewed.
Who should review CEO or promoter overrides?
The appropriate independent governance body depends on the company; material matters may require board, Audit Committee or independent director oversight.
What data is most useful?
ERP audit logs, approval workflows, manual journals, vendor changes, payment data, pricing exceptions, write-offs and user-access records.
Should emergency authority be removed?
No. It should be limited, documented, time-bound where appropriate and subject to post-event review.
What is the strongest preventive control?
No single control is sufficient. Segregation of duties, independent review, system logging and board visibility over material exceptions work together.
Authoritative references
Author: Adv. Govind Bali, Fastrack Legal Solutions LLP.