A forensic investigation audit examines financial records and related evidence to establish what happened, how much was lost and who was involved, in a form that can be used in a dispute, a regulator's inquiry or a court. It differs from a normal audit in its purpose: it is built around a specific suspicion, not a general opinion on the accounts.
Last reviewed: 17 October 2026. Facts checked. We ran a web search and read summaries from law-firm and ICAI regional council material on India's fraud investigation framework and on forensic audit scope. We could not open the Companies Act, 2013 or any SFIO report, and the searches did not return a step-by-step guide to how a company engages its own forensic auditor. The engagement steps below are therefore general good practice, not drawn from a rule, and are marked as such. Statutory references are given as pointers to look up. The scenario is invented.
If you want the basic meaning first, read what is a forensic audit. This post picks up from there and follows one engagement from the first call to the report.
Who can order a forensic investigation?
The sources we read describe several routes.
- The company itself. The board or audit committee asks an independent professional firm to investigate a suspicion, such as a vendor fraud or a missing cash balance.
- A lender. Banks may require a forensic audit of a borrower's accounts. We did not verify the specific rules.
- The government. Under section 212 of the Companies Act, 2013, the Central Government can assign serious fraud cases to the Serious Fraud Investigation Office. One source says SFIO acts on the government's order and cannot start a case on its own. Another says an SFIO investigation report is treated like a police report and is admissible in court. We could not check the statute, so confirm with a lawyer before relying on this.
- A regulator. Sources mention NFRA ordering forensic work in cases of suspected auditor negligence or fraud. We did not verify the details.
The route matters because it decides who the report goes to, and what the auditor can ask for.
Step by step (general practice)
1. Fix the question
A forensic engagement starts with a written question. "Check whether any vendor was paid for goods not received between April and September" is a workable question. "Look at everything" is not. The question controls cost, time and the quality of the answer.
2. Engagement letter and independence
The engagement letter should state:
- who is the client (the board, the audit committee, a named director);
- the scope and period;
- what is excluded;
- confidentiality and who may see drafts;
- access to people, systems and records;
- the form of the output.
Make sure the investigating firm is independent of the people under suspicion, and that it is not the firm that also does the statutory audit if that creates a conflict. Check the ICAI Code of Ethics and the applicable rules for the entity.
3. Secure the evidence first
Before anyone is interviewed, secure the data. That means copies of ledgers and bank statements, email and chat where permitted, system logs, and physical documents. The aim is to stop records from changing. A short chain-of-custody log (what was taken, when, by whom, where kept) protects the value of the evidence later. For more on this, see fraud investigation steps, evidence handling and reporting.
4. Analyse the records
Typical work includes:
- matching vendor and employee master data;
- testing payments against orders and receipts;
- looking for duplicates, round amounts, splits just under approval limits and unusual timing;
- tracing money through bank accounts;
- reviewing journal entries for override. Our post on Benford and divergence analysis explains one data technique.
Analytics point to items to examine. They are not proof.
5. Interviews
Interviews come after the document work, so the investigator knows what to ask. Keep notes, keep two people in the room if you can, and let the interviewee review a record of what was said where the engagement allows.
6. Quantify and conclude
State the loss or exposure, the method used to reach the figure, and the limits of the evidence. If a point cannot be proved, say so. A report that claims more than the evidence shows is worse than one that stops short.
7. Report
The report is built for a reader who may be hostile. See forensic audit report structure for what makes one usable.
What a forensic investigation is not
- It is not a statutory audit and gives no opinion on the true and fair view of the accounts.
- It is not a legal finding of guilt. Lawyers and courts decide that.
- It is not a fishing exercise. Without a defined question it drifts and costs more.
Frequently Asked Questions
What is a forensic investigation audit?
An examination of records to establish facts about suspected fraud or misconduct, in a form usable in legal or regulatory proceedings.
What is meant by forensic audit?
The use of audit and investigation techniques to find, quantify and document wrongdoing. See our basic explainer for more.
Who can order one in India?
A company's board or audit committee, a lender, or the government. Sources also mention regulators. Check the law for the route that applies.
How is it different from a statutory audit?
A statutory audit gives an opinion on the accounts as a whole. A forensic audit answers a specific question about suspected wrongdoing.
Can analytics prove fraud?
No. They highlight items for investigation. Proof comes from documents, third-party confirmation and interviews.
Related Articles
Last reviewed: 17 October 2026. Facts checked. Opened: web search results (law-firm articles and an ICAI regional council forensic audit presentation listing); our own site posts. Could not open: the Companies Act, 2013, SFIO reports, or any lender or regulator rule. The engagement steps are general practice, not from a rule.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error