Advisory & Transactions

Forensic Advisory & Investigation

Establishing what happened, in a form that withstands cross-examination.

Independent investigation of suspected fraud, misappropriation, vendor collusion and financial misstatement. We preserve evidence properly, quantify the loss, identify the control failures that allowed it, and produce a report that holds up before a board, an insurer or a tribunal.

Typical turnaround
A scoped review of a single allegation with defined custodians typically runs 3 to 5 weeks. Multi-location, multi-year, multi-entity or fund-tracing investigations run 8 to 16 weeks and are structured in phases with interim reporting, since scope frequently widens once the first set of exceptions is examined.
Service code
ART-FAI-006
Engagement models
Fixed fee per phase · Time and materials with an agreed cap · Retainer for standing audit committee support
Delivery
Virtual, secure document exchange

Indicative fee from

₹4,50,000

Indicative starting fee for a scoped investigation into a single allegation with defined custodians and systems. Multi-location, multi-year and fund-tracing investigations are phased and quoted after an initial scoping review.

Request Consultation
  • Engagement letter issued before work begins
  • Named engagement lead and defined reporting cadence
  • Confidentiality and access controls on all workpapers
  • Fee adjusted if the confirmed scope is smaller

Prefer to talk first? Call +91 7303967800 or message us on WhatsApp.

Description

Suspected fraud puts an organisation into a decision it is poorly equipped to make quickly. Act too fast and evidence is destroyed, the wrong person is accused, and a wrongful termination claim follows. Act too slowly and records are altered, funds move, and the individuals concerned resign into an information vacuum. The instinct to have the internal team quietly look into it is understandable and almost always damaging, because the people best placed to investigate a process are frequently the people whose process is under examination.

Forensic work is built around a different question from audit. An audit asks whether financial statements are fairly stated. An investigation asks what specifically happened, who did it, how much was lost, how the control environment permitted it, and whether the resulting evidence will survive challenge in a disciplinary proceeding, an insurance claim, a civil recovery action or a criminal complaint. The standard applied to evidence handling, not the accounting skill, is what usually determines whether the answer is usable.

What the engagement covers

Every investigation begins with scope and preservation, in that order and quickly. We define the allegations, the period, the entities, the custodians and the systems, then move to preserve relevant data before it changes: forensic imaging of email and endpoints, extraction of ERP and accounting data with logs intact, and a documented chain of custody from the moment of collection. Working from a live production system, or from files an employee has been asked to email over, degrades the evidence permanently.

Analysis is then both data-led and human-led. On the data, we run transaction-level tests designed around known fraud patterns: duplicate and near-duplicate payments, purchase orders split just below approval thresholds, vendors sharing a bank account, address, PAN or directorship with employees, round-sum and weekend journal postings, manual entries to accounts that should only receive system-generated ones, credit notes issued after period end, and digit-frequency testing where the population supports it. Master data is compared against MCA and GST registries to expose entities that do not trade in reality. Fund tracing follows the money through bank statements and layered entities to identify where it ultimately came to rest. On the human side, structured interviews with process owners and, where appropriate, the individuals concerned are conducted alongside counsel, documented contemporaneously, and sequenced so the most informed party is interviewed last.

Statutory and dispute contexts

Forensic work often sits inside a legal framework. Resolution professionals under the Insolvency and Bankruptcy Code 2016 require transaction audits identifying preferential, undervalued, extortionate credit and fraudulent trading transactions within the applicable look-back periods, in a form capable of supporting an application to the adjudicating authority. Auditors carry a fraud reporting obligation under Section 143(12) of the Companies Act 2013, and boards need a defensible factual basis before that threshold is engaged. Audit committees have their own responsibility for the whistleblower mechanism under Section 177(9). Insurers require quantification prepared to the terms of the fidelity policy. Personal data collected during an investigation is subject to the Digital Personal Data Protection Act 2023 and equivalent regimes elsewhere, which constrains how it may be collected, processed, stored and transferred across borders.

Who this is built for

Boards and audit committees responding to a whistleblower complaint. Promoters facing unexplained margin erosion or cash leakage. Investors who suspect the numbers presented before investment were not the numbers. Resolution professionals and lenders examining pre-insolvency conduct. Insurers and policyholders quantifying a fidelity claim. And parties in litigation or arbitration who need financial facts established by someone independent of the dispute.

Engagement models

Fixed fee per phase · Time and materials with an agreed cap · Retainer for standing audit committee support

Expected turnaround

A scoped review of a single allegation with defined custodians typically runs 3 to 5 weeks. Multi-location, multi-year, multi-entity or fund-tracing investigations run 8 to 16 weeks and are structured in phases with interim reporting, since scope frequently widens once the first set of exceptions is examined.

Scope of Work

  • Investigation planning and hypothesis development, scoping the allegations, custodians, systems, entities and period under review before any evidence is touched
  • Evidence preservation including forensic imaging of email and endpoint data and controlled extraction of ERP and accounting records, with a documented chain of custody
  • Transaction analytics covering duplicate and near-duplicate payments, purchase orders split below approval thresholds, round-sum entries, and after-hours or weekend postings
  • Digit-frequency and Benford's law testing on transaction populations large enough to support statistical inference, used to direct sampling rather than to conclude
  • Vendor and customer integrity screening against MCA and GST registries for common directors, shared addresses, shared bank accounts and shell entity indicators
  • Journal entry testing focused on manual postings, back-dated entries, unusual account pairings and entries booked close to period ends or by unexpected users
  • Fund tracing across bank statements, layered entities and related parties to reconstruct the flow of funds through to the end beneficiary where records permit
  • Revenue leakage and discount or rebate abuse review, including pricing master overrides, unauthorised credit notes and unrecorded scrap and by-product sales
  • Payroll and expense reimbursement testing for duplicate bank accounts, ghost employees, split claims below approval limits and policy circumvention patterns
  • Structured interviews with process owners and, where appropriate, the individuals concerned, conducted with counsel present and documented contemporaneously
  • Transaction audit under the Insolvency and Bankruptcy Code 2016 identifying preferential, undervalued, extortionate credit and fraudulent trading transactions within the statutory look-back periods
  • Loss quantification prepared to the standard the intended forum requires, whether that is an insurance claim, a civil recovery action, a disciplinary proceeding or a criminal complaint
  • Root cause and control failure analysis identifying the specific control that was absent, overridden or ineffective, with a prioritised remediation roadmap
  • Fraud risk assessment and control redesign covering segregation of duties, delegation of authority, vendor onboarding and the whistleblower mechanism under Section 177(9)

Key Deliverables

Investigation Report

A factual report setting out the allegations, procedures performed, evidence examined, findings and quantification, distinguishing clearly between what is established by evidence, what is inferred, and what remains unresolved.

Evidence Register and Chain of Custody Log

A complete record of every item collected, when, from whom, by what method and where it has been held since, so that admissibility is not lost on a procedural objection.

Loss Quantification Schedule

The computed financial impact broken down by scheme, period and individual, with the basis of each computation stated and prepared to suit the forum in which it will be used.

Root Cause and Control Failure Analysis

Identification of the specific control breakdown at each point of loss, whether by absence, override or ineffectiveness, and how long the exposure persisted undetected.

Remediation Roadmap

A prioritised set of control changes, system configuration adjustments and process redesigns addressing the identified failures, sequenced by risk reduction and implementation effort.

Board and Audit Committee Briefing

A closed session presenting findings, the evidential basis, the residual uncertainty, and the options available, so that the board can take decisions on a documented record.

Litigation and Recovery Support File

Underlying workpapers, exhibits and schedules organised for use by counsel, including support for expert evidence where the engagement provides for it.

How the Engagement Runs

Intake and preservation

We take instructions from the board, audit committee or counsel, define the allegation and the scope, and move immediately to preserve relevant data before it can change. Access is compartmentalised to a minimal group. The phase closes when the evidence set is secured and the chain of custody is opened.

Planning and hypothesis development

We map the process under examination, identify the points at which value could be diverted, and build testable hypotheses covering each. Counsel is engaged on privilege and on the sequencing of any interviews. The phase closes with an approved investigation plan and testing programme.

Data analysis and document review

Transaction analytics, master data screening, journal testing and document review run in parallel, with findings narrowing the scope as they emerge. Fund tracing begins where the data supports it. The phase closes when the testable population has been examined and exceptions are isolated.

Interviews and corroboration

Structured interviews are conducted with counsel present, sequenced from peripheral to central parties, and documented contemporaneously. Statements are tested against the documentary and data evidence. The phase closes when accounts have been obtained and corroborated or contradicted.

Quantification and reporting

Losses are computed by scheme, period and individual, and the report is drafted to the standard the intended forum requires. Findings are presented to the board or audit committee in closed session. The phase closes on issue of the final report.

Remediation and downstream support

We support control remediation, and where required assist counsel, insurers or a resolution professional with the underlying workpapers, exhibits and any expert evidence. This phase runs for as long as the downstream proceedings require.

What You Gain

Evidence that remains usable

Proper preservation and chain of custody from day one protect the organisation's options. Evidence gathered informally often cannot be relied on later, whatever it shows.

Loss quantified, not estimated

A computed figure with a stated basis supports an insurance claim, a recovery action or a settlement negotiation. An approximate internal estimate supports none of them.

Independence from the parties involved

Findings produced by an external team are materially harder to characterise as internal politics, which matters when the outcome affects senior employees or related parties.

The gap closed, not just named

Identifying the control failure that permitted the loss, and remediating it, prevents recurrence through the same route. Recovery alone leaves the mechanism fully intact.

A defensible record for the board

Directors carry obligations once a suspicion arises. A documented, independent investigation demonstrates that the board acted on the concern rather than absorbed it.

Discretion through the process

Remote, compartmentalised working reduces visible activity inside the organisation, which limits the risk of tipping off, of evidence loss, and of reputational damage to people later cleared.

Industries We Serve With This Engagement

Manufacturing and industrial operationsRetail, distribution and consumerFinancial services and NBFCsInfrastructure, EPC and constructionHealthcare and hospitalsLogistics and warehousingTechnology and services companiesNot-for-profit and grant-funded organisationsCompanies under insolvency resolution

Frequently Asked Questions

The most common triggers are a whistleblower complaint through the vigil mechanism, an anonymous letter, an unexplained margin decline that operational explanations do not account for, a bank reconciliation difference that will not resolve, a vendor or customer raising a concern, and the sudden resignation of someone holding a sensitive process. Investors and acquirers also commission forensic work when diligence surfaces patterns rather than isolated errors. In insolvency, the resolution professional has a statutory obligation to examine specified transactions in the period preceding commencement, which is investigation work by another name.

No. A statutory audit provides reasonable assurance that financial statements are free from material misstatement, using sampling and a materiality threshold set for the entity as a whole. An investigation examines a specific allegation, often exhaustively rather than by sample, with no materiality threshold, because a fraud of modest value can still require dismissal, disclosure and prosecution. The evidence standards also differ. Forensic work is conducted from the outset on the assumption that its output may be examined by an opposing party in a proceeding, which changes how evidence is collected and recorded.

Digital evidence is collected through forensic imaging that captures the data without altering it, and hash values are recorded so any subsequent change can be detected. Every item is logged into an evidence register recording what was collected, when, from which custodian, by which method and where it has been held since. Analysis is performed on working copies, never on the original image or a live production system. Interview notes are prepared contemporaneously and, where appropriate, acknowledged. The purpose throughout is to ensure the evidence cannot later be excluded on grounds of handling rather than substance.

Yes. Resolution professionals require examination of transactions preceding the insolvency commencement date to identify preferential transactions under Section 43, undervalued transactions under Section 45, extortionate credit transactions under Section 50 and fraudulent or wrongful trading under Sections 66 and 67, each with its own look-back period and its own test for related and unrelated parties. The output must be capable of supporting an application to the adjudicating authority, which means the analysis has to establish the statutory elements specifically, not merely describe transactions that appear commercially unusual.

Investigations necessarily involve personal data, and the Digital Personal Data Protection Act 2023 applies to how it is collected, processed, stored and transferred. We work to a defined lawful basis, limit collection to what the scope requires, restrict access to the named engagement team, hold data in controlled environments with logged access, and agree retention and destruction terms in the engagement letter. Where custodians or data sit in other jurisdictions, the applicable local regime, including GDPR where relevant, is assessed before collection rather than after. Counsel is involved in these decisions from the outset.

Yes, and the intended use shapes the work from the beginning. A fidelity insurance claim must be quantified to the definitions, exclusions and proof requirements of the specific policy, which frequently differ from a straightforward accounting measure of loss. A civil recovery action requires loss attributed to identified individuals and transactions, with the evidence trail behind each. Tell us the intended forum at scoping. Reworking a quantification after the report has been issued is possible but weaker, because the procedures were designed against a different requirement.

It is managed carefully, though it cannot be guaranteed. Evidence preservation is generally performed before any visible activity begins, access to the engagement is restricted to a minimal group, and remote working reduces the physical presence that signals an investigation. Interviews are sequenced so that peripheral parties are seen first and the individuals of principal interest last, by which point their accounts can be tested against evidence already secured. Where employment action is contemplated, timing is agreed with counsel so that the process does not compromise either the investigation or the organisation's legal position.

Reporting obligations attach to specific roles. Section 143(12) of the Companies Act 2013 places a fraud reporting obligation on the statutory auditor, with thresholds determining whether the report goes to the Central Government or to the audit committee. Directors and the board carry their own responsibilities. As investigators engaged by the company or its counsel, our role is to establish the facts and to make clear where a reportable threshold may be engaged, so that the board and its legal advisers can discharge their obligations on an informed basis. We do not substitute our judgement for the board's legal advice.

Related engagements

Often scoped alongside this

Want this scoped to your situation first?

Tell us the specifics. We will confirm whether this is the right engagement, what it would cost, and how long it would take.

Request Consultation Browse Services