Findings that survive challenge
Every conclusion is traced to an exhibit. When the subject’s counsel tests the report, the answer is a document reference rather than a recollection.
Advisory & Transactions
Forensic Advisory & Investigation
Scoped investigations into suspected fraud, misappropriation and financial misstatement, conducted under the ICAI forensic standards with an evidence trail built to survive examination outside your boardroom.
Most financial fraud inside a mid-sized company is discovered by accident. A supplier calls about an invoice nobody raised, a reconciliation refuses to close, an employee resigns and the numbers change. By the time the pattern is visible, the question is no longer whether something happened but how much, for how long, and what can be proved.
Overview
An allegation has been made, or a control failure has surfaced something that does not have an innocent explanation. The instinct is to act quickly. The risk in acting quickly is that evidence is destroyed, the subject is alerted, an interview taints a later proceeding, or the company takes an employment decision it cannot support on the record.
Forensic advisory brings method to that position. We define the question narrowly, preserve the evidence before it can move, test the transactions rather than the rumour, and report findings that are traced to documents. Work follows the ICAI Forensic Accounting and Investigation Standards, and reports separate what the evidence establishes from what it merely suggests. That distinction is the difference between a report that holds up when it is challenged and one that does not.
Scope of engagement
- Evidence preservation: forensic imaging of laptops, servers and mail archives, SHA-256 hash verification of every image, and a chain of custody log maintained from collection to reporting.
- Transaction testing across the general ledger: journal entries posted outside business hours or by users without posting rights, entries reversed shortly after period close, round-sum transfers, and postings to suspense and unallocated accounts.
- Vendor integrity testing: duplicate vendor records, vendors sharing a bank account, PAN, address or telephone number with an employee, vendors created and paid within a short window, and payments split to stay below an approval limit.
- Payroll testing: ghost employees, duplicate bank accounts across employee records, employees with no attendance record, and reimbursement patterns inconsistent with role.
- Bank and cash tracing: funds flow from the point of loss through intermediate accounts, matched against the ledger and, where the entity is in insolvency, against the look-back periods.
- Insolvency-related transaction review: preferential transactions under Section 43, undervalued transactions under Section 45, transactions defrauding creditors under Section 49, extortionate credit under Section 50 and fraudulent or wrongful trading under Section 66 of the Insolvency and Bankruptcy Code 2016, with the relevant look-back period applied and related parties treated separately.
- Fraud reporting analysis under Section 143(12) of the Companies Act 2013 and Rule 13 of the Companies (Audit and Auditors) Rules 2014, identifying whether the amount involved crosses the threshold for reporting to the Central Government and what the board and audit committee must document either way.
- Quantification of loss, and control gap analysis identifying the specific failures that allowed the conduct to continue undetected.
Deliverables
- A preservation note recording what was collected, when, from whom and in what state, with hash values for every electronic image.
- An interim findings note as soon as the evidence supports a conclusion that changes what you should do next, circulated only to the restricted list agreed at scoping.
- A final investigation report separating established facts, reasonable inferences and matters that remain unresolved, with each finding cross-referenced to an exhibit.
- An indexed exhibit bundle, paginated and cross-referenced, suitable for handing to counsel without rework.
- A quantification schedule showing the loss by period, by transaction stream and by counterparty, with the method and any assumption stated.
- A control failure memorandum: the specific control that failed, why it failed, and the remediation that would prevent recurrence.
Process
-
Confidential scoping
A restricted conversation to define the allegation, the period, the entities and the people who may be told the review is happening. Independence and conflict checks are completed here.
-
Preservation
Devices imaged, mailboxes and system logs secured, physical documents collected and logged. Nothing is requested through channels the subject controls until preservation is complete.
-
Analysis
Ledger, vendor master, payroll, banking and procurement data tested against the anomaly set. Documents reviewed against transactions. The hypothesis is revised as evidence accumulates rather than defended.
-
Interviews
Conducted where authorised, after the documentary position is understood. Records are read back and signed where the interviewee agrees to sign.
-
Reporting
Findings, exhibits, quantification and control gaps issued in final form, with a working session for the board or audit committee.
-
Follow-through
Support to counsel, insurers or the resolution professional as the matter is taken forward, within whatever fresh scope is agreed for that stage.
Benefits
Preservation before enquiry
Data is secured before anyone knows a review has started. Deleted mail and altered ledgers are a common outcome of the opposite order.
Scope that matches the question
A diagnostic can establish whether there is anything to find before you commit to a full investigation, which is often the cheaper honest answer.
Industries served
Fraud takes the shape of the business it occurs in. In manufacturing, the recurring patterns are procurement kickbacks, scrap and by-product diversion, weighbridge manipulation and inflated consumption norms. In financial services, they are unauthorised customer transactions, misapplied collections, fictitious borrowers and evergreening of stressed exposures. In healthcare, they are consumable stock leakage, unbilled procedures and referral arrangements. In retail and e-commerce, they are return and refund abuse, gift card and loyalty point manipulation and marketplace settlement diversion.
Typical timeline
| Stage | Elapsed time |
|---|---|
| Scoping and conflict check | 1-2 business days |
| Evidence preservation | 2-5 business days |
| Diagnostic review, where commissioned alone | 1-2 weeks |
| Full analysis and document review | 2-6 weeks |
| Interviews and final report | 1-2 weeks |
A single-location matter with data available in usable form completes in three to four weeks. Multiple locations, mailbox review across several custodians, or records held only in paper move it toward ten.
Engagement model
Engagements are contracted on a fixed fee for the diagnostic and a stage-based fee for the investigation, quoted after scoping and set out in an engagement letter that names the allegation, the period, the custodians and the restricted circulation list. Fees are never contingent on findings, on the amount recovered, or on any outcome for an individual.
Delivery is virtual, with evidence collection arranged on site where imaging requires physical access.
What is not included
These are outside the mandate. Several are outside it as a matter of principle rather than scope.
- Any audit or assurance opinion. An investigation report is a finding of fact on a defined question and does not replace the statutory audit or any part of it.
- Legal opinions, advice on employment action, and any recommendation on whether to dismiss, prosecute or settle. Those decisions are yours, taken with counsel.
- Covert surveillance, interception of communications, pretexting, access to personal devices or accounts without documented consent, and any technique that would put the evidence or the company at risk.
- Filing a first information report, a complaint to the Economic Offences Wing, or any submission to a law enforcement agency on your behalf.
- Filing Form ADT-4 under Rule 13, which is the statutory auditor’s duty and cannot be discharged by us.
- Filing avoidance transaction applications under the Insolvency and Bankruptcy Code. Those are filed by the resolution professional, whose work we support.
- Expert testimony, deposition or appearance before any court, tribunal or arbitral panel. Testimony is scoped and engaged separately if you require it.
Findings are limited to the evidence made available within the agreed scope and period. Where records were incomplete, destroyed or withheld, the report says so and states what could not be tested as a result.
If evidence may be at risk, the first conversation is about preservation, not scope. That call can happen the same day.
Frequently asked questions
No. An audit gives reasonable assurance that financial statements are free of material misstatement, and it is designed around materiality. An investigation is directed at a specific allegation or anomaly, examines items an audit would pass over as immaterial, and reaches findings of fact rather than an opinion. Our reports carry no audit opinion and are not a substitute for the statutory audit.
It is prepared so that it can be. Documents are collected with a chain of custody log, electronic records are imaged and hash-verified, and each finding is traced to the evidence supporting it. Electronic records require a certificate under Section 63 of the Bharatiya Sakshya Adhiniyam 2023 to be admissible, and we prepare our work to support that certification. Whether to file it is your decision with your counsel.
Yes, where the mandate includes it and the company authorises it. Interviews are conducted with two of our people present, on notice, with a written record read back to the interviewee. We do not record covertly, we do not interrogate, and we do not put anyone under pressure to sign a statement. Employment consequences are the company's decision and are outside our scope.
Scoping addresses this before anything is requested. Where the subject controls the systems holding the evidence, data is preserved first through the IT function or an external image, and only then is anything requested through normal channels. Distribution of interim findings is restricted to a named list agreed at the outset, usually the audit committee or a specific director rather than management generally.
That is a common starting point and it is workable. A scoping diagnostic runs anomaly testing across the ledger, vendor master, payroll and bank data, looking for duplicate payments, vendors sharing bank or address details with employees, round-sum transfers, out-of-hours journal postings and unusual approval patterns. The output tells you whether there is something to investigate before you commit to a full mandate.
We quantify the loss, identify where value went and document it to a standard your lawyers can use. Recovery itself is legal work: civil suit, criminal complaint, insurance claim under a fidelity policy, or action under the Insolvency and Bankruptcy Code where the counterparty is in process. We support the claim with schedules and, where separately engaged, expert evidence. We do not pursue recovery ourselves.
Collection is limited to what the scope requires, held on encrypted storage with access restricted to the engagement team, and processed on the company's instructions as the data fiduciary under the Digital Personal Data Protection Act 2023. Material outside scope that is picked up incidentally is quarantined rather than reviewed. Retention and destruction dates are stated in the engagement letter.
Related services
Data Reconciliation Services
Structured reconciliation of ledgers, bank data, marketplace settlements and subsidiary systems, where differences need resolving rather than investigating.
Data Analytics & Business Intelligence
Continuous anomaly testing built into reporting, so the exceptions surface monthly instead of during a review two years later.
Transaction Advisory Services
Due diligence on either side of a deal, including the vendor, payroll and related party testing that a buyer expects to see performed.