A forensic audit is an investigation of accounts and records to find out whether fraud, misappropriation or manipulation has taken place, how it was done and who was involved, with evidence that can be used before a bank, regulator or court. It starts from a suspicion or a specific question, not from a routine annual cycle.
Facts checked: 9 October 2026. The RBI points rely on the Master Directions on Fraud Risk Management issued on 15 July 2024 for commercial banks. Banks, NBFCs and other regulated entities are covered by separate directions, so confirm which set applies. Where we have not verified a detail, we keep it general.
When a forensic audit is ordered
- Suspected fraud inside the business. Cash leakage, fake vendors, inflated expenses or inventory that does not reconcile.
- Lender or regulator requirement. Under the RBI's 2024 fraud directions, a bank or NBFC may use an external or internal audit for further investigation when an account is red flagged on early warning signals. The classification of an account as fraud must follow a notice to the borrower with a reasonable response period, and a reasoned order.
- Litigation or disputes. Partner exits, shareholder disputes, insurance claims and recovery suits.
- Government investigation. Section 212 of the Companies Act, 2013 gives the Serious Fraud Investigation Office (SFIO) power to investigate affairs of a company when ordered by the Central Government. SEBI can also order forensic audits of listed entities in the course of its enquiries.
Who performs it
Usually a chartered accountant or a firm with forensic and investigation experience, supported by data analysts and sometimes lawyers and IT forensic specialists. Independence matters more than in routine work: the team should have no prior role in the area under review. ICAI publishes guidance and standards on forensic accounting and investigation for members. Check the current text before citing a specific standard in an engagement letter. See the forensic audit guide and the audit glossary for terms.
The process
- Scoping. Fix the question to be answered, the period, the entities and who the report is for. Agree this in writing.
- Evidence preservation. Take forensic images of emails, ERP data and devices, secure physical records and record who handled each item, so that the evidence is admissible.
- Data analysis. Run tests on the full data set: duplicate payments, round-sum entries, weekend postings, vendors sharing bank accounts or addresses with employees, and unusual related-party flows.
- Interviews. Speak to staff and vendors, usually after the data tests so questions are specific.
- Report. Findings are tied to evidence, with an estimate of loss where it can be measured.
What the report contains
| Section | What it covers |
|---|---|
| Scope and limitations | Mandate, period, documents received and not received |
| Method | Tests performed and tools used |
| Findings | Each irregularity, amounts, dates and people involved |
| Evidence index | Source of each exhibit |
| Quantification | Estimated loss or diversion |
| Recommendations | Control fixes, recovery steps, disciplinary or legal options |
The report states facts and does not usually pronounce on guilt, which is for the court or the competent authority.
Forensic audit versus statutory audit
| Point | Forensic audit | Statutory audit |
|---|---|---|
| Trigger | Suspicion, regulator, litigation | Legal requirement every year |
| Question | Did fraud happen, how, who | Do financial statements give a true and fair view |
| Method | Targeted, full-data, evidence-led | Sample based, risk based |
| Output | Investigation report | Audit opinion |
A statutory audit is not designed to detect all fraud. See what is statutory audit and types of audit in India. For the routine control layer that often finds the first warning signs, read what is internal audit.
A worked scenario
A distributor's owner notices that purchase costs have risen faster than sales. The board appoints a CA firm for a forensic review of 24 months. Data tests show 40 vendors with the same bank account as one purchase executive's relative. The team preserves the ERP logs and mail, interviews the executive after the tests, and quantifies payments to those vendors against goods received. The report lets the company file a complaint and recover from the executive's dues.
Frequently asked questions
Is a forensic audit mandatory?
Not as a routine annual requirement. It is ordered when there is suspicion or when a lender, regulator or court needs it.
Who can order one?
The board or owners, a bank during fraud review, SEBI, or the Central Government through SFIO. Courts can also direct one.
Can the statutory auditor do it?
A statutory auditor has to stay independent, so a separate team or firm is normally engaged.
How long does it take?
It depends on the data volume and access. Fix a timeline in the scoping letter and revisit it as evidence comes in.
For a wider comparison, see the difference between internal, statutory and tax audit.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error