Forensic audit: what it is and when a startup orders one

A forensic audit is an investigation by accountants and investigators who follow money, documents and digital records to establish what happened. It is ordered when something looks wrong: missing funds, a whistleblower complaint, odd related-party payments or a failed loan.

The word forensic means suitable for use in a legal dispute. The auditors keep a record of how evidence was collected, so the findings can support a complaint, a court case or an insurance claim. The work often includes emails, bank trails, vendor checks and interviews. A live case on StopDown is Capillary Technologies, where a forensic review found that its Czech unit lost over €3 million to fraudsters posing as executives and lawyers.

A statutory audit is the yearly check required by the Companies Act, 2013. An independent auditor gives an opinion on whether the financial statements give a true and fair view. It samples transactions and looks for material errors, not for every possible fraud.

A forensic audit is narrower and deeper. It targets a specific concern, tests far more transactions and asks who, how and how much. It does not give a yearly opinion on the accounts. Its report may list losses, people involved and control failures.

• Statutory audit: yearly, required by law, gives an opinion on the accounts.
• Forensic audit: ordered when needed, investigates suspected fraud, gives findings and evidence.
• Internal audit: ongoing checks by the company's own team or an outsourced firm.

The board or its audit committee can order one after a complaint or a red flag. Lenders can require one when a loan turns doubtful, and regulators or investors can ask for one as a condition of a deal. In the case of a fraud already found, the company may hire the investigators to trace the money and the people.

The findings can be technical as well as financial. In the Capillary story, the review points to social engineering and a lookalike web domain, with no sign of malware or a hacked mailbox. That shapes the fix: tighter payment approvals and domain checks, not only a new security tool.

Under the SEBI Listing Obligations and Disclosure Requirements (LODR) Regulations, 2015, Schedule III Part A, a listed company must tell the stock exchanges when a forensic audit begins and when it concludes. As of November 2026, the notice of initiation names the entity that started it and the reasons if available, and the final report with management's comments is disclosed on receipt.

These are deemed material events, so the company cannot decide it is too small to report. Regulation 30 sets the timing of such disclosures, generally within 24 hours of the event in the usual case. Audits begun by a regulator or an enforcement agency are treated differently on the final-report requirement, so read the exact text before relying on it.

Section 143(12) of the Companies Act, 2013 requires a statutory auditor who suspects an offence of fraud by officers or employees to report it to the government, or first to the board or audit committee depending on the amount. Section 447 defines and punishes fraud, with imprisonment and fines in serious cases.

Separate laws may apply to the underlying act, such as criminal breach of trust or cheating, or to online crime. A forensic report can be handed to the police or investigating agencies to support a complaint.

A startup might order a forensic audit after a payment fraud, before an acquisition or IPO, or when investors raise doubts about founders' spending. Investors sometimes demand an audit when numbers do not reconcile, and a clean report can restore trust and ease a fundraising.

Some founders see an audit as an accusation, but it can also protect them. A report that clears an issue is often useful in due diligence.

The work usually follows a plan. The investigators first secure the records, including emails, bank statements and accounting data, so that nothing is altered. They then trace the money from the account where the loss occurred to its destination, test whether approvals were followed, and interview staff and vendors.

Data analysis is a large part of the job. Software can flag duplicate invoices, payments just under approval limits, vendors sharing an address with an employee or transfers at odd hours. The result is a report with the amount, the method used, the people or systems involved and suggested fixes.

The board decides what to do. Options include a police complaint, an insurance claim, recovery proceedings against the people or banks involved, disciplinary action and changes to controls. In a listed company, the report and management's comments go to the exchanges, and shareholders can read them.

Reports can be long and technical, and the company may share only a summary. Readers should note whether the loss was recovered, whether insurance responded and whether the controls were changed, since that shows what the company learned.

A forensic audit depends on the records it can reach. Cash deals, deleted messages and dealings outside the company can leave gaps, and an audit with a narrow scope will not look at areas outside it. Findings may also be contested by the people named in them.

The report is a finding of fact by private investigators. It is not a verdict, and the same facts can be read differently by a court. Readers should treat it as a strong lead, then watch for any police case, regulator action or recovery that follows.

Separate the stages. An audit that has begun proves nothing. A report with findings is a stronger signal, and only a court or regulator decides guilt. Note who ordered it, who carried it out and whether the full report was published or only a summary. Check whether the issue is a loss to outsiders, such as a scam, or by insiders. Findings about a lookalike email domain point to a control gap, while findings about related-party payments point to governance. This guide is general information. Check with a lawyer or accountant on how it applies to a specific case.