A finance manager notices that one vendor has been paid twice for invoices with almost identical numbers. A whistleblower email alleges that a purchase head is favouring a company owned by a relative. Stock counts keep falling short. Each of these could have an innocent explanation, or could point to something more serious. A forensic audit is how an organisation finds out which.

A forensic audit is a focused investigation of specific financial concerns, carried out to establish facts and present evidence-backed findings that can withstand scrutiny, including in disputes or legal proceedings where relevant. It answers defined questions. It is not a repeat of the annual statutory audit.

The sequence below reflects common professional practice. It is not a single statutory procedure that applies to every investigation. In India, Chartered Accountants carrying out such engagements must follow the ICAI’s Forensic Accounting and Investigation Standards (FAIS), which have been mandatory for ICAI members’ engagements beginning on or after 1 July 2023. FAIS itself prefers the term “forensic accounting and investigation” to “forensic audit”, although the latter remains common in business usage.

What Triggers a Forensic Audit?

Common triggers include:

• Unexplained accounting discrepancies that do not clear on reconciliation
• Unusual or unauthorised payments
• Duplicate invoices or suspicious vendor transactions
• Conflicts of interest or undisclosed related-party transactions
• Suspected employee or management fraud
• Inventory shortages or unexplained asset losses
• Signs of manipulated financial records
• Whistleblower complaints or credible internal allegations
• Irregularities flagged in an internal or statutory audit
• Concerns arising in a merger, acquisition, lending review or shareholder dispute

Red flags justify a closer look. They do not, by themselves, prove fraud. For more on early warning signs, see our guide to financial fraud red flags every CFO should know.

STEP 1Assess the Initial Suspicion

The process may begin with an allegation, a whistleblower report, an audit observation, a data anomaly or a management concern. An initial assessment usually involves understanding what has been reported; identifying the people, transactions, entities and period involved; reviewing readily available information; assessing how serious and credible the concern is; considering immediate risks to assets, records, operations and confidentiality; and deciding whether an independent investigation is warranted.

At this stage, avoid conclusions and accusations. Telling the wrong people too early can lead to records being destroyed or reputations being damaged unfairly.

STEP 2Define the Scope and Objectives

Clear objectives keep the investigation focused and defensible. Before extensive evidence collection, agree on:

• the suspected misconduct or irregularity;
• the entities, business units, transactions and individuals in scope;
• the relevant period;
• the specific questions the investigation must answer;
• the records and systems likely to be needed;
• who will receive the report and how communication will work;
• confidentiality, independence, conflict-of-interest checks and access permissions; and
• budget, timing and resources.

The engagement terms, including who has authorised the work and what records the investigator may access, should be settled in writing before investigative procedures begin. A forensic auditor engaged by a company does not have police powers and cannot compel third parties to hand over information.

STEP 3Develop the Investigation Plan

The plan turns scope into action. It typically covers risk-based prioritisation of accounts and transactions; preliminary hypotheses to be tested, not assumed; a document and data request list; the accounting systems, bank records, emails, contracts and operational records to be examined; team roles; a timeline with milestones and escalation points; and coordination with management, legal counsel, IT specialists or other experts where needed.

A structured plan keeps the work focused while leaving room to follow new evidence where it leads.

STEP 4Preserve and Secure Evidence

Evidence should be preserved early, before it can be lost, altered or deleted. Depending on the case, this may include accounting ledgers and transaction exports, bank statements and payment records, invoices, purchase orders and contracts, relevant business emails and communications, system and access logs, inventory records and asset registers, and electronic files or device data where access is authorised.

Chain of custody is the documented record of where each item of evidence came from, who collected it, when, how it was stored and whether it was changed during processing. A clean chain of custody helps show that evidence is what it claims to be.

Routine record collection is different from digital forensic acquisition, such as creating verified images of laptops or servers. That work needs qualified specialists and suitable tools. Access to devices, mailboxes and personal data must be lawful and properly authorised; investigators should never access personal accounts or devices without authority. Electronic evidence intended for legal proceedings may also need to meet the requirements of the Bharatiya Sakshya Adhiniyam, 2023, which governs evidence in India from 1 July 2024 and sets out how electronic records are admitted, including certification requirements under Section 63. Legal advice on these requirements is important.

STEP 5Collect and Organise Financial Records

Investigators gather and organise the records needed to test each question, for example:

• General ledgers and trial balances
• Bank statements and payment confirmations
• Vendor and customer ledgers
• Invoices, receipts, purchase orders and delivery records
• Payroll and reimbursement records
• Contracts and approval documentation
• Related-party transaction records
• Inventory movements and fixed asset records
• Accounting system exports and audit trails

Records should be reconciled across sources, such as ledger to bank to invoice to delivery note, rather than relying on a single document or database that could itself be wrong or manipulated.

STEP 6Analyse Transactions and Identify Patterns

This is where data turns into leads. Techniques, used as the case requires, include:

• transaction testing and reconciliation;
• duplicate invoice and payment analysis;
• trend and variance analysis;
• comparing vendor master data with employee data (addresses, bank accounts, phone numbers);
• related-party and conflict-of-interest checks;
• journal entry analysis, especially manual and period-end entries;
• fund tracing to follow money through accounts;
• Benford’s Law as a screening tool, which can flag unusual digit patterns in large data sets but proves nothing on its own and does not suit every data set; and
• analytics on unusual amounts, timing, frequency or approval patterns.

An anomaly is a lead for investigation, not proof of fraud.

STEP 7Corroborate Findings and Investigate Explanations

Preliminary findings must be tested against independent evidence. That means cross-checking records from multiple sources; verifying dates, amounts, approvals and beneficiaries; considering alternative explanations; reviewing contradictory or exculpatory evidence; conducting authorised interviews and documenting them carefully; giving fair consideration to explanations from relevant personnel; and recording limitations, missing records and unresolved questions.

An investigation that looks for evidence on both sides is far more credible than one designed only to confirm the original allegation.

STEP 8Quantify Financial Impact and Identify Control Weaknesses

Where irregularities are supported by evidence, the investigator may quantify their impact within the scope: amounts in questioned transactions, duplicate or unauthorised payments, misappropriated assets, or manipulated revenue or expenses. It is important to distinguish the gross questioned amount (everything that looked suspicious) from the substantiated loss (what the evidence actually supports). Indirect or consequential losses are often hard to measure precisely, and not every amount identified is recoverable.

The work usually also reveals the control weaknesses that allowed the issue, such as poor segregation of duties, weak vendor onboarding, missing approvals, loose system access, limited transaction monitoring, or inadequate records and reconciliations. A control weakness explains how something could happen; it does not, by itself, prove intentional misconduct. Fixing these gaps is where internal financial controls work comes in.

STEP 9Prepare the Forensic Audit Report

The forensic audit report communicates what was done, what was found and what it means, to the people entitled to receive it. Common components include:

1. Executive summary
2. Background and reason for the investigation
3. Scope, objectives and relevant period
4. Methodology and procedures performed
5. Documents and data examined
6. Findings organised by issue or allegation
7. Evidence supporting each material finding
8. Transaction schedules and calculations
9. Explanations received and contradictory evidence
10. Limitations and unresolved matters
11. Conclusions within the defined scope
12. Recommendations on corrective action and controls
13. Appendices and supporting schedules

The format depends on the engagement, the intended users, professional standards and the legal context. A good report keeps four things separate: an evidence-backed finding (what the evidence shows), a limitation (what could not be tested), an unresolved allegation (what remains unproven either way), and a legal conclusion (such as guilt or liability), which is for a court or competent authority, not the forensic auditor.

STEP 10Present Findings and Recommend Corrective Action

What happens next depends on the findings and the organisation’s obligations. Possible next steps include:

• presenting findings to authorised management, the Board, the audit committee or legal counsel;
• correcting accounting records where needed;
• strengthening controls, access permissions and approval processes;
• pursuing recovery of funds or assets through lawful channels;
• taking employment or disciplinary action in line with law and policy;
• obtaining legal advice on reporting obligations or proceedings; and
• cooperating with competent authorities where required or appropriate.

Some situations carry specific obligations. For example, a company’s statutory auditor has fraud reporting duties under Section 143(12) of the Companies Act, 2013, and listed companies must disclose the initiation of a forensic audit and the final report under SEBI’s listing regulations. If a criminal complaint is filed, investigation and procedure fall under the Bharatiya Nagarik Suraksha Sanhita, 2023 and are conducted by law enforcement, not the forensic auditor. Not every finding must be reported to the police, and the forensic auditor does not decide criminal liability.

How Long Does a Forensic Audit Take?

There is no standard timeline. Duration depends on the complexity and number of transactions, the entities, locations and accounts involved, the availability and quality of records, the volume of electronic data, the need for interviews or specialist analysis, cross-border elements, legal restrictions and approvals, and the depth of reporting and review. A narrow review of a few transactions may take weeks; a multi-year, multi-entity matter can take months. A defined scope is the only basis for a realistic estimate.

Forensic Audit vs. Statutory Audit vs. Internal Audit

Swipe the table sideways to see all columns.

Statutory and internal audits can and do identify fraud. A forensic engagement is what follows when a specific concern needs to be investigated in depth. Learn more about our internal audit services and statutory audit services.

Common Challenges in the Forensic Audit Process

• Missing, incomplete or altered records
• Delays in getting access to information
• Inconsistent data across systems
• Complex transaction structures or multiple entities
• Conflicting witness accounts
• Potential conflicts of interest within the organisation
• Difficulties preserving digital evidence
• Personal data and confidentiality restrictions
• Difficulty quantifying losses precisely
• Pressure to reach conclusions before the evidence is complete

Careful planning, thorough documentation, genuine independence, specialist support where needed and clear reporting of limitations help manage these challenges.

When Should a Business Consider a Forensic Audit?

Consider seeking advice when warning signs persist after normal reconciliation and review; when there is a credible allegation or whistleblower complaint; when an audit flags a significant irregularity; when you suspect employee, vendor or management misconduct; when assets or inventory go missing without explanation; when a lender, investor or acquirer raises concerns; or when a dispute may end up in court.

Early advice helps define the right scope and preserve records before they are lost. Not every discrepancy needs a full forensic investigation; sometimes a targeted review is enough. For a broader introduction, read when does your business need a forensic audit.

Frequently Asked Questions

From Suspicion to Evidence-Based Decisions

The forensic audit process exists to replace suspicion with facts. Done well, it is focused, documented, fair to the people involved and clear about what the evidence does and does not show. That gives management, Boards and their advisers a sound basis for whatever comes next.

This article is general information and not legal advice. Investigations involving evidence, employment or criminal matters should be planned with qualified legal counsel.

Sources: ICAI: Forensic Accounting and Investigation Standards · Companies Act, 2013 · India Code (Bharatiya Sakshya Adhiniyam, 2023; Bharatiya Nagarik Suraksha Sanhita, 2023) · SEBI FAQ on forensic audit disclosure