Forensic accounting and fraud detection

In short

Forensic accounting is the use of accounting, auditing and investigative skills to examine a suspected financial wrongdoing so that the findings stand up before a board, a regulator or a court. It differs from statutory audit in purpose (proof of a specific allegation, not an opinion on true and fair view), in scope (deep and targeted, not sample-based) and in output (an investigation report and expert evidence). In India it is driven by Section 143(12) of the Companies Act 2013, SA 240, the RBI fraud-risk framework, SEBI LODR, PMLA and the SFIO, and is supported by ICAI's Forensic Accounting and Investigation Standards (FAIS) and its FAFD certificate course. It is examined in B.Com law-and-audit papers, CA/CS/CMA audit papers, and is asked in placement interviews for Big Four forensic and risk advisory, bank credit-monitoring, internal audit and GRC roles.

Explained

What forensic accounting is, and how it differs from audit

• Forensic means "suitable for use in a court of law" - the work is designed for evidentiary standards, not only for accounting accuracy.
• Objective: establish whether a fraud occurred, who did it, how, over what period, and quantify the loss (the "what, who, how, how much, when" framework).
• Branches: investigative accounting (fraud examination), litigation support (damages, valuation disputes, matrimonial and partnership disputes), insurance claim and business-interruption reviews, anti-money-laundering reviews, bank forensic audits.
• Fraud under the Explanation to Section 447, Companies Act 2013: any act, omission, concealment of fact or abuse of position, with intent to deceive, gain undue advantage from or injure the interests of the company, its shareholders, creditors or any other person - whether or not there is wrongful gain or loss.
• Error vs fraud: an error is unintentional; fraud is intentional. Intent is the dividing line and the hardest element to evidence.
• Under SA 240, primary responsibility for prevention and detection of fraud rests with management and those charged with governance; the statutory auditor gives only reasonable assurance and is not an insurer against fraud (the principle in *Kingston Cotton Mill* survives in modern form, tempered by the duty of professional scepticism).

Why fraud happens: the theories examined

• Fraud triangle (Cressey): *pressure* (targets, debt, addiction, lifestyle), *opportunity* (weak controls, override, no segregation of duties), *rationalisation* ("it is a loan", "I am underpaid"). Controls can only attack opportunity.
• Fraud diamond (Wolfe and Hermanson): adds capability - position, technical skill and ego to execute and conceal.
• Fraud scale (Albrecht): where personal integrity is high, even high pressure and opportunity may not produce fraud.
• GONE theory: Greed, Opportunity, Need, Exposure (low probability of detection and punishment).
• Fraud tree (ACFE classification of occupational fraud) - three branches:
  1. Asset misappropriation - cash larceny, skimming (off-book), billing schemes (shell vendors), payroll and expense reimbursement schemes, cheque tampering, inventory and non-cash misuse. Most frequent, lowest median loss.
  2. Corruption - bribery, kickbacks, bid rigging, conflicts of interest, economic extortion.
  3. Financial statement fraud - fictitious revenue, timing differences (cut-off/channel stuffing), concealed liabilities and expenses, improper asset valuation, improper disclosures. Least frequent, highest loss.
• ACFE's *Report to the Nations* repeatedly estimates organisations lose about 5% of annual revenue to occupational fraud, with tips the single largest detection channel and internal/external audit detecting a minority - the strongest argument for a working whistle-blower channel. (Figures are survey-based and change each edition.)

Indian legal and regulatory framework

• Companies Act 2013, Section 143(12) with Rule 13, Companies (Audit and Auditors) Rules 2014: if an auditor (also cost auditor, secretarial auditor) has reason to believe an officer or employee has committed a fraud of ₹1 crore or above, report to the Board or audit committee seeking reply within 45 days, then forward to the Central Government (Secretary, MCA) in Form ADT-4 within 15 days of the reply - and within 15 days of the 45-day expiry if no reply. Below ₹1 crore: report only to the audit committee or Board, and the Board discloses it in the Board's report. Non-reporting attracts penalty under Section 143(15).
• Section 447: punishment for fraud - where the amount involved is at least ₹10 lakh or 1% of turnover (whichever is lower): imprisonment 6 months to 10 years plus fine of one to three times the amount involved; minimum 3 years if public interest is involved. Smaller frauds not involving public interest: up to 5 years, or fine up to ₹50 lakh, or both.
• Sections 211, 212: Serious Fraud Investigation Office (SFIO) under MCA; investigates on Central Government direction, with powers of arrest for Section 447 offences.
• Section 134(3)(ca) - Board's report discloses frauds reported by auditors other than those reportable to the Government; Section 177(9)-(10) - mandatory vigil mechanism with direct access to the audit committee chair; Section 143(3)(i) - auditor reports on adequacy and operating effectiveness of internal financial controls; CARO 2020 requires reporting on frauds noticed or reported, whistle-blower complaints considered, and resignation of statutory auditors.
• SEBI (LODR) Regulations 2015: Regulation 4(2)(d)(iv) and Regulation 22 - whistle-blower policy; Regulation 32(5)-(7) - deviation in use of issue proceeds; forensic audit disclosure requirement for listed companies (initiation and final report, as mandated by SEBI in 2020).
• RBI: Master Directions on Fraud Risk Management (July 2024) for commercial banks and AIFIs, co-operative banks and NBFCs - replaced the earlier Master Directions on Frauds. Core machinery: Early Warning Signals (EWS), classification of an account as Red Flagged Account (RFA), mandatory forensic audit for large exposures (the earlier framework prescribed it for accounts of ₹50 crore and above), reporting through FMR to RBI and the Central Fraud Registry; declaration of wilful defaulters sits in RBI's separate July 2024 Master Direction on wilful and large defaulters. Following *SBI v. Rajesh Agarwal* (SC, 2023), the borrower must be given a show-cause notice and a hearing before fraud classification - natural justice is now explicit in the directions.
• Other statutes: Prevention of Money-Laundering Act 2002 (proceeds of crime, attachment, reporting entities, FIU-IND); Prevention of Corruption Act 1988 (as amended 2018); Bharatiya Nyaya Sanhita 2023 (from 1 July 2024, replacing the IPC - cheating, criminal breach of trust, forgery, criminal conspiracy); Information Technology Act 2000; Benami Transactions (Prohibition) Act; FEMA; Insolvency and Bankruptcy Code (Sections 43-51 avoidance of preferential, undervalued, extortionate and fraudulent transactions; Section 66 fraudulent trading).
• Evidence: the Bharatiya Sakshya Adhiniyam 2023 (replacing the Indian Evidence Act 1872) governs electronic records and expert opinion; an electronic record needs the prescribed certificate to be admissible, and hash values and chain of custody are what make it survive cross-examination.
• Professional standards: ICAI's Digital Accounting and Assurance Board has issued the Forensic Accounting and Investigation Standards (FAIS) - roughly 30 standards grouped into key concepts, engagement management, executing (evidence, interview, digital evidence, data analysis) and reporting. Their mandatory-versus-recommendatory status and effective dates have been revised by ICAI, so verify the current position. Related credentials: ICAI FAFD, DISA, and ACFE's CFE.

The forensic investigation process, step by step

1. Accept the engagement - check independence, conflict, competence, legal privilege, scope and who the client is (board, audit committee, lender, insurer). Issue a clear engagement letter: forensic work is not a Section 143 audit.
2. Preserve evidence first - secure servers, email, ERP logs, CCTV, physical records before notice spreads; image devices and take hash values; document the chain of custody.
3. Plan and hypothesise - frame the fraud hypothesis (who could do it, how it would look in the books), identify data sources, build the team (accountant, IT forensic specialist, lawyer).
4. Collect data - ERP extracts (general ledger, vendor and employee masters, payroll, purchase and sales registers), bank statements, MCA filings, GSTN and e-way bill data, credit bureau, email and messaging data.
5. Analyse - reconciliations, analytical review, data analytics and digital forensics (see next sub-heading); follow the money through third parties and related entities.
6. Interview - start with neutral third parties and witnesses, move to the suspect last; ACFE practice ends with an admission-seeking interview. Never promise, threaten or confiscate; respect the right against self-incrimination (Article 20(3)).
7. Quantify loss - direct loss, consequential loss, recoveries, insurance claim (fidelity guarantee), tax and interest impact.
8. Report - factual, source-referenced, no adjectives, opinions clearly labelled as opinions; list limitations and documents not made available.
9. Remediate and support action - control redesign, recovery, FIR or complaint, Section 143(12)/ADT-4 or RBI FMR filing, disciplinary action, expert testimony.

Detection techniques: analytical, data and digital

• Red flags (symptoms, not proof): vendors with no GSTIN or matching an employee's address or bank account; round-sum payments just under an approval limit; sudden margin or receivable spikes; negative operating cash flow with rising profit; reconciliation items that never clear; employees refusing leave or rotation; lifestyle beyond salary; overrides by senior management; audit trail switched off.
• Analytical review: horizontal and vertical analysis, ratio analysis (receivable days, inventory days, gross margin, cash flow to net profit), segment and branch benchmarking, same-store comparison.
• Statistical and model-based tools: Benford's Law on first/first-two digits of transaction amounts; Beneish M-score for earnings manipulation; Altman Z-score for distress (frauds cluster in distressed firms); relative size factor (RSF) for outliers; duplicate and gap testing; Dechow-Dichev accrual quality; Montier C-score.
• CAAT / data analytics: IDEA, ACL, SQL, Excel Power Query, Python. Standard scripts - duplicate invoice numbers or amounts, payments on holidays or outside office hours, vendor-employee bank account match, ghost employees (no PF/ESI or duplicate PAN), journal entries posted by unauthorised users or on the last day of the quarter, split purchase orders, dormant vendors reactivated, round-number and threshold clustering.
• Digital forensics: write-blocked bit-stream imaging, MD5/SHA-256 hashing, recovery of deleted files and slack space, metadata and timeline analysis, email and chat review with keyword and concept searching, link analysis of counterparties.
• Public-record and background checks: MCA21 master data and charges, GST portal, IBBI, EPFO, credit bureaus, litigation databases, sanctions and PEP lists, property records - to establish shell companies, related parties and benami holdings.
• Preventive side: segregation of duties, maker-checker, delegation of authority, mandatory leave and job rotation, surprise verification, vendor due diligence, access controls and SoD conflict reports, a working whistle-blower hotline, continuous auditing and fraud-risk assessment (COSO 2013 Principle 8).
• Limitations: collusion and management override defeat controls; evidence may be destroyed before engagement; data in legacy or unstructured form; costly and slow; a model score is only a flag and never proof; false positives can damage innocent people; forensic accountants have no statutory powers of search or seizure.

Key points

• Forensic accounting - accounting plus investigation plus law, producing court-usable findings on a specific allegation.
• Fraud (Section 447) - deception, concealment or abuse of position with intent; wrongful gain is not essential.
• Section 143(12) - fraud of ₹1 crore or above goes to the Central Government in ADT-4 within 60 days overall; below that, to the audit committee or Board.
• Section 447 penalty - 6 months to 10 years and fine of 1 to 3 times the amount; 3-year minimum where public interest is involved.
• SA 240 - prevention and detection is management's primary duty; auditor applies professional scepticism, tests journal entries and presumes a fraud risk in revenue recognition.
• Fraud triangle - pressure, opportunity, rationalisation; fraud diamond adds capability.
• Fraud tree - asset misappropriation (most common), corruption, financial statement fraud (costliest).
• Benford's Law - natural transaction data has about 30.1% leading 1s; distortion suggests fabricated or split amounts.
• Beneish M-score - eight ratios; above about −1.78 flags possible earnings manipulation.
• Altman Z-score - below 1.81 distress, above 2.99 safe (original manufacturing model).
• Relative size factor - largest value divided by second largest in a group; a high RSF marks an outlier worth testing.
• EWS and RFA - RBI's early-warning and red-flagging machinery; triggers forensic audit and FMR reporting to the Central Fraud Registry.
• SFIO - MCA's multi-disciplinary investigating arm under Sections 211-212, with arrest powers for Section 447 offences.
• Chain of custody and hash values - what makes digital evidence admissible under the Bharatiya Sakshya Adhiniyam 2023.
• Vigil mechanism - Section 177(9)-(10) and SEBI LODR Regulation 22; tips are the leading source of fraud detection.
• FAIS - ICAI's forensic standards (engagement, evidence, interview, digital evidence, data analysis, reporting); check current effective status.
• Red flag is not proof - findings must be corroborated by documents, money trail and admissions.

Formulas and examples

1. Benford test on purchase vouchers. 10,000 vouchers; leading digit 4 appears 1,850 times.

• Expected for d = 4: log₁₀(1.25) = 0.0969 → 969 vouchers; observed 1,850, i.e. p = 0.185.
• SE = √(0.0969 × 0.9031 / 10,000) = √(8.752 × 10⁻⁶) = 0.00296.
• Z = (0.185 − 0.0969) / 0.00296 ≈ 29.8 - far beyond 1.96, so not chance.
• Drill-down: the approval limit for a junior officer is ₹50,000 and the excess 4s are amounts of ₹43,000-₹49,500 to five recent vendors - classic split purchase to stay below authority. Red flag, not yet proof: test vendor masters, GSTINs and bank accounts next.

2. Beneish M-score. Sales ₹1,000 cr → ₹1,400 cr; receivables ₹120 cr → ₹260 cr; gross margin 30% → 25%; net profit ₹120 cr; cash from operations ₹20 cr; total assets ₹1,000 cr; AQI 1.10, DEPI 1.05, SGAI 0.95, LVGI 1.08.

• DSRI = (260/1,400) / (120/1,000) = 0.1857/0.12 = 1.548; GMI = 0.30/0.25 = 1.20; SGI = 1,400/1,000 = 1.40; TATA = (120 − 20)/1,000 = 0.10.
• M = −4.84 + 0.920(1.548) + 0.528(1.20) + 0.404(1.10) + 0.892(1.40) + 0.115(1.05) − 0.172(0.95) + 4.679(0.10) − 0.327(1.08)
• = −4.84 + 1.424 + 0.634 + 0.444 + 1.249 + 0.121 − 0.163 + 0.468 − 0.353 = −1.02.
• −1.02 > −1.78 → flagged as a likely manipulator. Drivers: receivables growing far faster than sales and profit of ₹120 cr against operating cash of only ₹20 cr - the signature of fictitious or channel-stuffed revenue.

3. Altman Z-score (a separate borrower under credit review, ₹ crore). Total assets 500, working capital 40, retained earnings 30, EBIT 35, market value of equity 180, total liabilities 300, sales 450.

• X₁ = 0.08, X₂ = 0.06, X₃ = 0.07, X₄ = 180/300 = 0.60, X₅ = 0.90.
• Z = 1.2(0.08) + 1.4(0.06) + 3.3(0.07) + 0.6(0.60) + 1.0(0.90) = 0.096 + 0.084 + 0.231 + 0.360 + 0.900 = 1.67 → distress zone, an EWS trigger in itself and the condition that so often supplies the pressure leg of the fraud triangle.

4. Relative size factor and duplicate payments. Vendor "Shree Traders": 42 invoices in the year, largest ₹48,00,000, second largest ₹1,60,000.

• RSF = 48,00,000 / 1,60,000 = 30 against a normal range of 1-3 → single abnormal payment.
• Duplicate test on the full ledger finds the same invoice number and amount of ₹6,50,000 paid twice 11 days apart, and two more pairs of ₹2,10,000 and ₹1,45,000.
• Quantified exposure = 6,50,000 + 2,10,000 + 1,45,000 = ₹10,05,000 recoverable, plus the ₹48 lakh item to be vouched to a purchase order, GRN and GST 2B.

5. Section 143(12) decision. An auditor finds a store manager diverted stock worth ₹1.25 crore.

• ₹1.25 crore ≥ ₹1 crore → reportable to the Central Government.
• Report to the Board or audit committee seeking reply within 45 days; reply received on day 40 → forward to the Secretary, MCA in Form ADT-4 within 15 days of that reply (by day 55). No reply → file by day 60 with a note recording it.
• If the amount were ₹80 lakh: no ADT-4; report to the audit committee and the Board, and the Board discloses the nature, amount and action taken in its report.

Where it is used

• Big Four and consulting forensic practices (Deloitte FA, EY Forensic and Integrity Services, KPMG FRM, PwC Forensics) and Indian firms - fraud investigations, FCPA/UKBA compliance reviews, third-party and vendor integrity due diligence, dispute advisory.
• Banks and NBFCs - credit monitoring, EWS analytics, RFA classification, forensic audits of stressed borrowers, FMR and Central Fraud Registry reporting, wilful defaulter proceedings; large Indian cases (Satyam, PNB-Nirav Modi, IL&FS, DHFL, ABG Shipyard) are standard interview talking points.
• Corporate internal audit, risk and compliance - whistle-blower investigation, continuous control monitoring in SAP/Oracle, expense and procurement analytics, insider-trading and conflict-of-interest reviews.
• Regulators and enforcement - SFIO, SEBI, ED (PMLA), CBI, Income Tax investigation wing, GST intelligence, CAG and state audit, IBBI-registered professionals running avoidance-transaction reviews under IBC Sections 43-66.
• Insurance and litigation support - fidelity guarantee and business-interruption claim quantification, valuation and damages in arbitration, expert witness work.
• Job roles and credentials - forensic analyst, fraud risk manager, AML/KYC analyst, internal auditor, GRC consultant; valued add-ons are ICAI FAFD, CFE, DISA, CAMS and tools such as IDEA, ACL, SQL and Python.

Interview questions

• Q: How does a forensic audit differ from a statutory audit? A: A statutory audit gives a reasonable-assurance opinion on the financial statements using sampling and materiality; a forensic audit tests a specific allegation exhaustively, with no materiality floor, and produces legally usable evidence and findings.
• Q: Whose responsibility is it to prevent and detect fraud? A: Under SA 240 it is primarily management's and those charged with governance; the auditor plans and performs the audit to obtain reasonable assurance about material misstatement from fraud or error.
• Q: What must an auditor do on finding a ₹3 crore fraud by an employee? A: Report it under Section 143(12) to the Board or audit committee seeking a reply within 45 days, then file Form ADT-4 with the Central Government within 15 days of the reply - within 60 days in all.
• Q: Explain the fraud triangle and which leg a company can actually control. A: Pressure, opportunity and rationalisation; internal controls can realistically only reduce opportunity, while culture and tone at the top address rationalisation.
• Q: What is Benford's Law and when should it not be used? A: Naturally occurring amounts follow P(d) = log₁₀(1 + 1/d), so about 30% begin with 1; it fails on assigned or constrained numbers such as invoice series, PINs, prices set at ₹99 or data with a narrow range.
• Q: A company shows rising profits but negative operating cash flow. What do you suspect? A: Revenue or accrual manipulation - fictitious sales, channel stuffing, capitalised expenses or unrecorded liabilities; test receivable ageing, credit notes after year end, cut-off and the TATA component of the M-score.
• Q: What is a Red Flagged Account? A: A borrowal account where early warning signals throw up a suspicion of fraudulent activity; the bank flags it on the CRILC platform, usually orders a forensic audit, and decides within the RBI timeline whether to classify it as fraud, now only after a show-cause notice and hearing.
• Q: Why are hash values and chain of custody important? A: A hash such as SHA-256 proves the image is identical to the seized media and unaltered, and the custody log shows who held the evidence when - without both, electronic evidence can be challenged as tampered or inadmissible.
• Q: How would you detect a ghost employee? A: Match the payroll master against PAN, Aadhaar, PF/ESI and bank account numbers for duplicates, look for employees with no leave, no appraisal and no email activity, test bank accounts shared with other staff, and verify a sample physically.
• Q: What is the sequence of interviews in a fraud examination and why? A: Neutral third parties first, then corroborative witnesses, then co-conspirators and finally the suspect in an admission-seeking interview - so the examiner holds the facts before confronting anyone and does not alert the suspect early.
• Q: What is the difference between misappropriation of assets and financial statement fraud? A: The first steals assets (usually by employees, frequent and smaller), the second misstates the accounts to mislead stakeholders (usually by management, rarer and far costlier).
• Q: Can a forensic accountant conclude a person is guilty of fraud? A: No - that is for a court; the accountant reports facts, the money trail and an opinion on whether the evidence supports the allegation, clearly labelled as opinion.

Common mistakes

• Treating a red flag or a model score as proof of fraud instead of a trigger for further corroboration.
• Writing the wrong Section 143(12) answer - missing the ₹1 crore boundary, the Form ADT-4 requirement or the 45 + 15 day timeline.
• Saying the statutory auditor is responsible for detecting all fraud, or that SA 240 requires absolute assurance.
• Working on copies of data without imaging, hashing and a custody record, so the evidence collapses in cross-examination.
• Interviewing the suspect first, or making threats or promises - it destroys both the evidence and the investigation.
• Applying Benford's Law to assigned numbers, or quoting Altman Z and Beneish cut-offs without naming the model variant and its industry limits.
• Confusing forensic audit with internal audit or due diligence, and quoting the repealed IPC or Evidence Act instead of the Bharatiya Nyaya Sanhita 2023 and Bharatiya Sakshya Adhiniyam 2023.

Related topics

Auditing basics · Internal control and internal audit · Companies Act basics · Insolvency and Bankruptcy Code basics · Corporate governance and business ethics · Information systems audit and data analytics