Forensic Audit: 10 Red Flags and How an Investigation Runs

By SCORE Editorial Team · Prepared by SCORE’s audit, tax and advisory practice · Law stated as on 14 August 2026

Quick answer: A forensic audit is a focused, evidence-led investigation into suspected fraud, misappropriation or serious error. Companies commission one when red flags appear: unexplained margin erosion, stock or cash gaps, whistle-blower complaints or vendors linked to employees. Acting early limits losses and preserves evidence that may later be needed in court.

What is a forensic audit, and is it the same as an investigation audit?

The terms overlap. An investigation audit establishes the facts behind a specific concern. A forensic audit does the same, but gathers evidence to a standard that can stand up in disciplinary, civil or criminal proceedings.

In India, chartered accountants doing forensic work follow the ICAI’s Forensic Accounting and Investigation Standards (FAIS). These became mandatory for ICAI members undertaking forensic assignments from 1 July 2023.

How is a forensic audit different from a statutory or internal audit?

	Statutory or internal audit	Forensic or investigation audit
Purpose	Opinion on accounts, or assurance on controls	Establish facts about a specific concern
Trigger	Law or annual plan	Red flag, complaint or regulator
Scope	Broad, risk-based sampling	Narrow and deep, often 100% of transactions
Approach	Routine audit procedures	Data analytics, document forensics, digital evidence, interviews
Output	Audit report	Findings report with evidence, loss quantified and people responsible
Confidentiality	Standard	Strict, limited circulation

A statutory audit is not designed to find every fraud. It samples transactions to support an opinion. That gap is why investigation audits exist.

When does a company need a forensic audit? 10 red flags

1. Gross margin falls without a pricing or cost explanation.
2. Stock or cash variances keep recurring at specific locations.
3. A whistle-blower complaint arrives, even an anonymous one.
4. Vendors share addresses, bank accounts or PANs with employees.
5. Payments come in round sums, or invoices are split just below approval limits.
6. Certain customers get large credit notes or unusual discounts.
7. Employees with financial authority never take leave or resist rotation.
8. Staff with financial authority show sudden lifestyle changes.
9. Manual journal entries cluster at period-end.
10. Audit queries are answered late, partly or not at all.

One red flag is a reason to look closer. Two or more in the same area are a reason to act.

How does a forensic audit run, step by step?

1. Mandate. The Board or audit committee approves the scope, team and reporting line. Management under suspicion should not commission or steer it.
2. Preserve evidence. Secure system logs, emails, devices and documents before anyone is told. Keep a chain-of-custody record.
3. Analyse data. Test the full population of payments, vendor masters, discounts and inventory movements.
4. Corroborate. Check documents, visit sites and get third-party confirmations.
5. Interview. Move from witnesses to suspects. Keep a written record of each interview.
6. Quantify and report. Set out the loss, the method used, the control failures and the people involved.
7. Act. Pursue recovery, disciplinary action and legal remedies. Fix the controls that failed.

Investigation checklist for the audit committee

• ☐ Written mandate with scope, budget and timeline
• ☐ Independent team with no reporting line to suspected managers
• ☐ Evidence secured and logged before any interview
• ☐ Legal counsel engaged where criminal action or employment claims are likely
• ☐ Interim updates to the audit committee only
• ☐ Final report with remediation owners and dates

What should the company do in the first 48 hours?

The first two days decide how much evidence survives. Keep the circle small and avoid tipping off anyone involved.

• Limit access. Suspend system rights of people under suspicion, or quietly restrict them to read-only.
• Freeze payments. Hold pending payments to vendors or customers named in the concern.
• Image devices. Take forensic copies of laptops, phones and mailboxes before anyone is confronted.
• Brief the chair. Inform the audit committee chair and, where relevant, the statutory auditor.
• Protect the whistle-blower. Keep the complainant’s identity confidential under your vigil mechanism.

Who must report a fraud, and to whom?

Statutory auditors under Section 143(12)

A statutory auditor may find reason to believe that officers or employees have committed a fraud in the company. The auditor must then report it. The procedure is set out in Rule 13 of the Companies (Audit and Auditors) Rules, 2014.

Fraud amount	Auditor reports to	Timeline
₹1 crore or more	Board or audit committee first, then the Central Government in Form ADT-4	To the Board or committee within 2 days of knowledge. Reply sought within 45 days. Report goes to the Central Government within 15 days of the reply, or after 45 days if none comes.
Below ₹1 crore	Audit committee or Board	Within 2 days of knowledge. The company discloses the fraud in its Board’s Report.

The same duty applies to cost auditors and secretarial auditors under Section 143(14). NFRA’s June 2023 circular says a statutory auditor must file ADT-4 even if someone else found the fraud first.

Listed companies under SEBI LODR

Listed companies must disclose the start of a forensic audit to the stock exchanges under Regulation 30. They must also disclose the final forensic audit report on receipt, with management comments. Reports from audits started by regulators or enforcement agencies are excluded.

CARO 2020

Under clause 3(xi), the statutory auditor reports whether any fraud by or on the company was noticed during the year. The auditor also reports whether any ADT-4 was filed.

Frequently asked questions

When should a company order a forensic audit?

As soon as credible red flags appear. Delay lets evidence disappear and losses grow. Start with a short, confidential scoping review if the facts are unclear.

Who should commission a forensic audit?

The Board or the audit committee. Management whose area is under suspicion should not appoint, brief or receive reports from the investigators.

Is a forensic audit mandatory in India?

Not as a routine requirement. It is triggered by events: a fraud suspicion, a lender or regulator’s direction, or a dispute. Listed companies must disclose a forensic audit once it starts.

Do frauds have to be reported to the government?

Statutory auditors must report frauds of ₹1 crore or more to the Central Government in Form ADT-4. Smaller frauds go to the audit committee or Board and are disclosed in the Board’s Report.

How long does a forensic audit take?

It depends on scope, data quality and how many locations are involved. A focused review of one process can take a few weeks. A company-wide investigation takes longer.

How SCORE helps

SCORE conducts confidential investigation audits for boards, audit committees and promoters. We start with data analytics and move to evidence and interviews only where the data points. In one engagement, our audit detected ₹18 lakh of point-of-sale (POS) fraud.

Seeing red flags? Speak to a SCORE partner confidentially and ask for our Fraud Red-Flag Checklist.

Sources

• Fraud reporting by auditors under Section 143(12) (ICSI, Chartered Secretary, June 2024)
• SEBI document on disclosure of forensic audits by listed entities, October 2020 (SEBI)
• Reporting fraud by auditors (WIRC of ICAI)

This article is general information, not professional advice.