A borrower’s financial statements say: Rs 12 crore revenue, 14% EBITDA margin, Rs 1.7 crore operating profit, net worth of Rs 4.5 crore. The statements are audited. The numbers are compliant. The ratios are within covenant parameters.
The general ledger behind those statements contains 800,000 entries. Among them: 47 manual journal entries posted by the CFO on weekends. 12 entries affecting revenue accounts posted in the last 48 hours of the financial year. 8 entries debiting revenue and crediting an intercompany receivable that has grown by Rs 2 crore in two years without any corresponding cash receipt. 3 vendor payments of Rs 4.8 lakh, Rs 4.9 lakh and Rs 4.7 lakh to the same entity on three consecutive days, each just below the Rs 5 lakh approval threshold. A journal entry reversing a Rs 35 lakh provision on 31 March that was re-created on 2 April of the following year.
None of this appears in the financial statements. All of it sits in the general ledger, waiting for someone who knows what to look for.
The ten-filter triage
Pratham Sharma applies a ten-filter analytical methodology to the full GL population. The filters are applied concurrently, and transactions triggering multiple filters simultaneously are ranked highest.
- ✓Filter 1: Value: The largest transactions by amount in each category.
- ✓Filter 2: Manual entries: Journal entries bypassing the automated posting logic
- ✓Filter 3: Related-party counterparties: Transactions with disclosed or suspected connected entities.
- ✓Filter 4: Round numbers: Statistical concentration of round amounts inconsistent with genuine commerce.
- ✓Filter 5: Weekend and holiday postings: Entries processed outside normal business hours.
- ✓Filter 6: Period-end entries: Entries posted in the last three days of each reporting period.
- ✓Filter 7: Reversals: Entries posted and reversed within a short window, especially crossing period boundaries
- ✓Filter 8: Unusual counterparties: Vendors or customers incorporated shortly before their first transaction, with minimal capital and no other visible commercial activity.
- ✓Filter 9: Operational inconsistency: Purchases of services unrelated to the business, payments to entities in geographies where the company does not operate.
- ✓Filter 10: Duplicates: Identical amounts to the same or related counterparties on the same or adjacent dates.
The ten filters, applied to 800,000 entries, typically produce a flagged population of 300 to 500 entries. These are ranked by composite score: how many filters each entry triggers simultaneously. The top 100 by composite score are the starting investigation population.
In one forensic mandate under a PSU bank directive, the triage identified 287 flagged entries from a population of 1.2 million. Of the top 100, 34 were confirmed findings that appeared in the final forensic report. The remaining 66 had documented explanations that satisfied the evidential standard. Without the triage, the 34 findings would have been distributed across 1.2 million entries with no mechanism for locating them within the engagement timeline.
The reconstruction chain
For each flagged entry, Ashish Chaudhary applies the reconstruction chain:
Entry → supporting document → counterparty verification → bank trail → operational corroboration → conclusion
The entry says Rs 15 lakh was paid to Vendor X. The supporting document is a purchase order and an invoice for “consulting services.” The counterparty verification shows Vendor X was incorporated three months before the first transaction, shares a registered address with the borrower’s promoter’s residence and has no other customers. The bank trail shows the Rs 15 lakh was transferred by Vendor X to a personal account within 72 hours. The operational corroboration shows no evidence that any consulting service was delivered.
The entry passed every documentary test (PO exists, invoice exists, payment was approved). The reconstruction reveals what the documents were designed to conceal.
What the lender receives
A reconstructed transaction database with source referencing for the review period. The ten-filter exception report with composite risk scoring. Fund flow schedules tracing sanctioned facility utilisation from disbursement to final destination. A counterparty substance assessment for every flagged vendor and customer. A red flag matrix with each flag graded by evidentiary strength. The complete working paper file assembled for independent retracing.
Mobilisation within 48 hours. First exception list within 10 days. Complete reconstruction and report within 21 to 35 days.