Fraud does not announce itself. It hides in the ordinary, disguised by volume, routine and the institutional assumption that documented transactions are legitimate transactions.
When a forensic investigator enters a company with a suspicion of financial irregularity, the initial challenge is not analytical. It is logistical. There may be 10 million transactions in the general ledger. The question is not where to start looking. It is how to identify, within the first 48 hours, the transactions most likely to reveal the mechanism of manipulation.
Speed matters. Evidence can be altered. Personnel can be coached. Systems can be modified. Documents can disappear. The forensic triage methodology must identify the highest-probability targets fast enough to preserve the evidentiary value of the data before the subjects of the investigation have time to respond.
The following ten categories, refined through Northrop Management Private Limited’s forensic practice, represent the transactions that most frequently contain the signature of deliberate misstatement. They are not proof of fraud. They are the starting point of investigation, designed to maximise the probability of finding the mechanism within the first week of fieldwork.
Category 1: The largest transactions by value
Fraud that is financially material must, by definition, flow through transactions of material size. A scheme designed to inflate revenue by Rs 50 crore cannot do so through thousands of small transactions without creating detection risk at the volume level. It must use transactions large enough to move the number.
The forensic approach: extract the top 50 transactions by value in each category (revenue, procurement, journal entries, intercompany transfers, payments) for each reporting period. Examine the counterparty, the documentation, the approval trail and the business rationale. The largest transactions are not inherently suspicious. But any scheme designed to create material misstatement will use them.
Category 2: Unusual journal entries
Journal entries that bypass the normal transactional flow are the single most common vehicle for financial statement manipulation. Revenue recognised through a manual journal rather than through the billing module. Cost reclassified from an expense account to an asset account. Provisions reversed through a manual entry rather than through the standard provisioning process.
The characteristic of an unusual journal entry is that it circumvents the controls embedded in the transactional system. An ERP’s billing module requires a sales order, a delivery note and an invoice before revenue is posted. A manual journal requires only an account code, an amount and a description. The control environment of the two paths is fundamentally different, and manipulation gravitates toward the path of least control.
The forensic approach: extract all manual journal entries above a defined threshold, all entries posted by users who do not normally post entries, and all entries affecting revenue, COGS, provisions, intercompany accounts and balance sheet reclassifications. The volume of suspicious entries is usually small relative to the total population. The financial impact is often disproportionately large.
Category 3: Related-party transactions
Every transaction with a party connected to the promoter, director, key managerial personnel or their associates is a transaction where the counterparty’s independence cannot be assumed. The pricing may not reflect arm’s length negotiation. The commercial substance may differ from the legal form. The economic benefit may flow to the related party rather than to the company.
The forensic approach: identify all transactions with disclosed related parties. Then, separately, identify all transactions with parties that meet the economic criteria for relatedness but may not be disclosed (common addresses, directors, shareholders, contact details). The gap between disclosed and actual related-party transactions is frequently where the most significant findings reside.
Category 4: Round-number transactions
Genuine commercial transactions produce irregular amounts. A purchase order for raw materials priced at Rs 47,83,219. A service invoice for Rs 12,06,547. The arithmetic of actual commerce produces numbers that reflect quantities, rates, taxes and adjustments that rarely result in round figures.
Fraudulent or fabricated transactions frequently produce round numbers: Rs 50,00,000. Rs 1,00,00,000. Rs 25,00,000. The reason is mechanical: when a person fabricates a transaction, they think in round numbers because the transaction is designed to produce a financial effect (inflate revenue by Rs 50 lakh) rather than to document a genuine commercial event.
The forensic approach: run a statistical analysis of transaction amounts across the dataset, testing whether the frequency of round numbers (ending in 000, 00000, or 0000000) exceeds the expected distribution. A dataset with a statistically anomalous concentration of round-number transactions warrants further investigation of those specific transactions.
Category 5: Weekend and holiday entries
Transactions posted on days when the business does not normally operate warrant scrutiny. A journal entry posted at 11pm on a Sunday. A vendor payment processed on a gazetted holiday. A revenue entry posted on a day when the factory was closed for maintenance.
The forensic significance is not that weekend or holiday entries are necessarily fraudulent. It is that they are unusual, and unusual entries deserve explanation. Legitimate reasons exist: global businesses operating across time zones, automated system postings, year-end close processes. But entries posted outside normal business hours by users who do not normally work outside those hours, affecting accounts that are high-risk for manipulation, constitute a pattern that justifies investigation.
The forensic approach: filter the general ledger for all entries posted on weekends, public holidays and outside normal business hours. Cross-reference the posting user, the accounts affected and the amounts. Investigate entries where the combination of timing, user and account is anomalous.
Category 6: Manual postings in an automated environment
In a company where the ERP generates most transactions automatically (purchase orders generate goods receipts generate invoices generate payments), a manual posting stands out. The question is always: why was the automated process bypassed?
Legitimate reasons include corrections, non-standard transactions and adjustments that the system cannot process automatically. Illegitimate reasons include avoiding system controls, creating entries without supporting documentation and manipulating account balances in ways that the automated process would not permit.
The forensic approach: identify all manual postings in transaction categories that are normally automated. For each, verify that a documented reason for the manual override exists, that the override was approved by an appropriate authority, and that the financial effect of the manual posting is consistent with the stated reason.
Category 7: Last-day-of-period entries
Transactions posted on the last day of a month, quarter or financial year are disproportionately likely to contain period-end adjustments designed to improve reported results. Revenue pulled forward from the next period. Expenses pushed into the next period. Provisions reversed to inflate profit. Accruals adjusted to smooth earnings.
The concentration of adjustments at period-end is not coincidental. It is structural: the incentive to manage reported results is highest at the reporting date, and the control environment around period-end entries is often stretched because the finance team is simultaneously closing the books.
The forensic approach: extract all entries posted on the last three days of each reporting period. Compare the aggregate financial impact of these entries to the company’s reported results. If last-three-day entries account for a disproportionate share of reported revenue, margin or profit, the pattern warrants detailed investigation of each entry.
Category 8: Reversals
A transaction that is posted and then reversed within a short period raises immediate questions. If the original posting was correct, why was it reversed? If it was incorrect, what was the nature of the error, and how was it identified?
Reversals that cross period boundaries are particularly significant. An entry posted on 31 March and reversed on 2 April may have been designed to inflate March’s results with the intention of correcting in April, when the reporting pressure has passed. The March financial statements capture the original entry. The April reversal corrects the underlying position. But anyone relying on the March statements has been given information that the company knew would be reversed within days.
The forensic approach: identify all reversals across the dataset. Flag reversals that cross period boundaries, reversals of large amounts, reversals processed by a different user than the original poster, and reversals with vague descriptions. Each warrants examination of the original entry, the reversal and the net effect on reported results.
Category 9: Unusual vendors
Vendors that exhibit specific characteristics warrant investigation because they may represent fictitious entities created for cash extraction.
Characteristics include: incorporation shortly before the first transaction with the company, minimal paid-up capital, no visible employees or premises, no other significant customers, common characteristics with the company or its promoters (shared address, directors, contact information), and supply of goods or services inconsistent with the company’s operations.
The forensic approach: profile every vendor above a defined materiality threshold across the characteristics above. Vendors that fail multiple substance tests should be subjected to full counterparty independence verification, including MCA filings, GST registration analysis, bank account examination and physical verification of premises.
Category 10: Transactions inconsistent with business operations
A manufacturing company purchasing consulting services from an entity with no apparent connection to its operations. A domestic services company making large international payments. A retail company recording significant intercompany loans to entities in unrelated sectors. Transactions that do not fit the company’s normal operating pattern require a business explanation that connects them to a genuine operational need.
The forensic significance is not that inconsistent transactions are always fraudulent. It is that they fall outside the pattern that the company’s business model would predict, and anything outside the predicted pattern deserves explanation before it is accepted.
The forensic approach: for each significant transaction, ask a simple question: is this transaction consistent with what this company does? If the answer requires an elaborate explanation involving multiple entities, unusual commercial arrangements or exceptional circumstances, the transaction warrants deeper investigation.
The Escalation Protocol
Identifying a suspicious transaction is not the same as proving fraud. Each category above generates a flag, not a conclusion. The forensic methodology requires escalation through evidence:
Flag → supporting documentation → counterparty verification → cash trail → operational corroboration → conclusion
A transaction that is flagged but supported by genuine documentation, confirmed by an independent counterparty, consistent with cash movements and corroborated by operational evidence is probably legitimate, regardless of its initial appearance. A transaction that is flagged and cannot be supported at one or more of these levels requires further investigation.
In Northrop Management forensic engagements, the first 10 transactions investigated using this triage methodology have, in the majority of cases, either confirmed or eliminated the fraud hypothesis within the first week of fieldwork. The methodology does not guarantee detection. It maximises the probability of early identification, which is the most valuable advantage in any forensic engagement.
Ashish Chaudhary, frames the forensic discipline directly: “Fraud hides in volume. The forensic investigator’s job is to reduce 10 million transactions to the 10 that matter most, fast enough that the evidence is still intact when they find them.”
Questions for the Boardroom
- Has our internal audit function ever conducted a forensic-style triage across these 10 categories on our general ledger data?
- Do we have the analytical capability to identify manual journal entries, round-number concentrations, weekend postings and period-end entry spikes in our own data?
- How many of our vendors have been subjected to a substance test (incorporation date, other customers, physical premises, director overlap) within the last 24 months?
- If a forensic investigator applied this triage methodology to our last three years of data, are we confident that none of the 10 categories would produce findings that the board is not currently aware of?
Closing Implication
Fraud does not hide in complexity. It hides in volume. The forensic triage methodology exists to cut through that volume and identify, within the first 48 hours, the transactions most likely to reveal the mechanism.
The ten categories are not a checklist. They are a prioritisation framework that concentrates investigative attention where the probability of finding manipulation is highest. A company whose transactions survive scrutiny across all ten categories has a control environment that is working. A company whose transactions produce findings in multiple categories has a control environment that requires immediate forensic attention.
The difference between a fraud that is detected in week one and a fraud that is detected in year five is not the sophistication of the scheme. It is the speed and precision of the initial triage.
