A payment of Rs 50 lakh from the company to a vendor is a single line in the bank statement. It appears legitimate: a purchase order exists, a goods receipt note was signed, an invoice was processed and the payment was approved through the standard workflow.
But the vendor is owned by the promoter's brother-in-law. The goods receipt note was signed by a person who was not present at the warehouse on the date of delivery. The invoice was for services that the company does not operationally require. And the Rs 50 lakh, once received by the vendor, was transferred within 48 hours to a personal account that traces back to a trust controlled by the promoter's family.
The transaction was documented. The money trail reveals the fraud.
"Follow the money" is the foundational principle of forensic investigation because financial misconduct, regardless of its sophistication, ultimately involves the movement of value from where it should be (the company) to where it should not be (the beneficiary). The documentation may be fabricated, the counterparties may be layered and the routing may be complex. But the money moves, and the movement leaves traces that, when reconstructed, reveal the mechanism, the beneficiaries and the quantum.
The Reconstruction Methodology
Layer 1: The transaction
Identify the transaction that triggered the investigation: a payment, a journal entry, a revenue recognition, a related-party balance, an asset purchase, a write-off. Document its stated purpose, its documentation, its approvals and its financial statement impact.
At this layer, the transaction appears as management presented it: a legitimate business event, properly documented and approved.
Layer 2: The counterparty
Investigate the entity that received the payment or recorded the transaction. Who owns it? When was it incorporated? Does it have employees, premises, other customers? Does it share any characteristics (directors, addresses, phone numbers, email domains, bank account signatories) with the company, its promoters or their associates?
At this layer, the investigation determines whether the counterparty is genuinely independent or connected to the company through relationships that the transaction documentation does not disclose.
Layer 3: The bank trail
Trace the cash from the company's bank account to the counterparty's bank account. Then trace it further: where did the counterparty send the money next? Did it flow to another entity, to a personal account, back to the company, or to a third party connected to the promoter?
The bank trail is the most reliable evidence in forensic investigation because it is produced by a third party (the bank), records actual cash movements (not accounting entries) and is difficult to fabricate comprehensively across multiple banking relationships.
Layer 4: The related-party network
Map the connections between the company, the counterparty, the ultimate recipient and the promoter group. Use MCA filings (DIN cross-referencing), shareholder records, bank account signatories, GST registrations, addresses, contact information and family relationships to establish the connection that the transaction documentation was designed to conceal.
Layer 5: The beneficiary
Identify the ultimate economic beneficiary: the person or entity that received the value that was extracted from the company. The beneficiary may not be the counterparty that received the initial payment. The money may have passed through two, three or four intermediaries before reaching its destination.
The beneficiary identification is the conclusion of the money trail. It answers the question that the transaction documentation, however elaborate, was designed to obscure: who benefited from this movement of value, and at whose expense?
The Evidence Standard
In Northrop Management Private Limited's forensic practice, the money trail is reconstructed to a standard that can withstand regulatory scrutiny, legal proceedings and adjudication.
Each link in the trail must be supported by primary evidence: bank statements (not management representations), MCA filings (not oral assertions), GST records (not self-declarations), counterparty financial statements (not the company's own records). The chain must be continuous: every rupee that leaves the company must be traceable to an intermediate recipient and ultimately to a final beneficiary.
Gaps in the trail are themselves findings. A Rs 50 lakh payment that reaches the counterparty's account and then disappears (withdrawn in cash, transferred to an unidentifiable account, routed through a jurisdiction without banking transparency) is a gap that warrants further investigation and, in many cases, supports an adverse inference.
Ashish Chaudhary, frames the forensic methodology directly: "The transaction is only the beginning of the money trail. The documentation tells you what management wants you to believe. The bank trail tells you what actually happened. And the gap between the two is where the forensic finding lives."
Questions for the Boardroom
- For every significant related-party transaction or unusual payment, can we trace the cash from our bank account to the ultimate recipient?
- Have we verified the independence of our significant counterparties using MCA, GST and banking records, not just management representations?
- If a forensic investigator followed the money on our ten largest unusual transactions, would the trail corroborate the stated business purpose?
- Do we have a process for investigating payments to vendors that were created recently, have no other customers or share characteristics with our promoter group?
- When was the last time the audit committee commissioned a transaction-level money-trail investigation on a sample of significant payments?
Closing Implication
Financial misconduct hides behind documentation. The purchase order exists. The invoice is filed. The approval is signed. Every document checks out. The money trail reveals what the documents were designed to conceal: where the value actually went and who actually benefited. Following the money is not one step in a forensic investigation. It is the investigation.
