The call usually comes from a board member, a promoter or a lender. Something looks wrong. A vendor payment that does not match a purchase order. A journal entry that moves money between accounts for no documented reason. A subsidiary that shows revenue from a customer nobody in the business can identify. An employee’s expense claim that routes through a company whose registered address is the employee’s home.
The instinct is to act immediately: confront the person, terminate the relationship, file a complaint, inform the regulator. The instinct is understandable. It is also premature.
An unusual transaction is not, by itself, evidence of fraud. It may be a processing error, a control failure, a policy violation, a misunderstanding or, yes, a deliberate diversion. The difference between these explanations is the difference between a correction, a disciplinary action, a recovery claim and a criminal complaint. Acting on the wrong explanation wastes resources, damages relationships and, in the worst case, exposes the company to claims of wrongful action against an employee or a counterparty who did nothing wrong.
The question is not “what should we do?” The question is “what do we actually know, and what can we prove?”
From anomaly to hypothesis
Every forensic investigation begins with an anomaly: a transaction, a pattern, a balance or a behaviour that does not fit the expected business logic. The anomaly is not a conclusion. It is a starting point.
The investigator’s first task is to convert the anomaly into a testable hypothesis. A duplicate vendor payment is an anomaly. The hypotheses are: processing error (the same invoice was entered twice), control failure (the approval system did not catch the duplicate), policy violation (someone bypassed the three-way match) or deliberate diversion (someone created or manipulated a duplicate payment to extract money from the business).
Each hypothesis requires different evidence, different procedures and different conclusions. The investigator does not assume the answer. The investigator tests each hypothesis against the available evidence and eliminates the explanations that the evidence does not support.
Tracing the transaction
The transaction trail is the investigator’s primary tool. Every financial transaction in a formal business creates a trail: a ledger entry, a bank debit or credit, an invoice, a contract, a purchase order, a delivery note, a receipt, a GST filing, a TDS deduction. The trail may be complete, partial, fabricated or deliberately destroyed. The condition of the trail is itself evidence.
The tracing process follows the money from its origin to its destination:
Step 1: The ledger. What does the accounting system show? Which account was debited? Which was credited? What is the narration? Who posted the entry? When was it posted? Was it part of a batch or a standalone entry? Was it posted during normal business hours or at an unusual time?
Step 2: The bank. Does the bank statement confirm the payment? When was the payment made? Was it a cheque, an RTGS, an NEFT or a cash withdrawal? Who was the beneficiary? Does the beneficiary match the vendor in the ledger? If the payment was by cheque, who endorsed the cheque?
Step 3: The supporting documents. Does an invoice exist? Does the invoice match the ledger entry (amount, date, description, vendor name, GST number)? Does a purchase order exist that predates the invoice? Does a delivery note or a goods receipt note confirm that the goods or services were actually received? If the transaction is a service, does a deliverable exist (a report, a design, a completed task)?
Step 4: The counterparty. Who is the vendor? Is the vendor a genuine commercial entity with operational premises, other customers, employees and a history of GST filings? Or is the vendor a shell: registered to a residential address, with no employees, no other customers and GST filings only in the months when it invoiced the company?
Step 5: The connections. Is the vendor connected to anyone inside the company? Common directors, common shareholders, common addresses, common phone numbers, common bank accounts, family relationships, former employment relationships? A vendor whose proprietor is the procurement manager’s spouse is not automatically fraudulent, but the connection must be disclosed, and the transaction must be evaluated for arm’s length pricing and genuine commercial substance.
Separating explanations
The investigator must resist the temptation to confirm the initial suspicion. The evidence must be evaluated objectively, testing every plausible explanation before arriving at a conclusion.
Accounting error. The duplicate payment was caused by a system glitch, a data entry mistake or a batch upload that processed the same file twice. The error is identifiable, quantifiable and correctable. The recovery is a debit note to the vendor. The control improvement is a duplicate-detection check in the payment system.
Control failure. The payment was processed without the required approvals, without a three-way match (PO, GRN, invoice) or without segregation of duties (the same person raised the PO, approved the invoice and released the payment). The failure enabled the anomaly but does not, by itself, prove intent. The response is a control remediation: tighten the approval matrix, enforce the three-way match, implement segregation.
Policy violation. An employee bypassed a policy (used an unapproved vendor, exceeded a spending limit without escalation, processed a payment outside the normal channel). The violation may be intentional (the employee wanted to avoid scrutiny) or administrative (the employee did not know the policy, or the policy was not enforced). The response depends on the severity and the pattern.
Deliberate diversion. The transaction was designed to extract money from the business: a fake vendor, an inflated invoice, a payment for goods never received, a kickback arrangement, a round-tripping scheme. The evidence must establish not just that the money left the business but that the stated purpose was false and that someone inside the business participated in or benefited from the falsehood.
The distinction between these explanations is the distinction between a Rs 0 loss (accounting error, fully recovered), a Rs 0 loss with a control cost (control failure, remediated), a disciplinary matter (policy violation) and a financial loss with potential legal consequences (deliberate diversion). The investigation’s value is in making this distinction with evidence, not with assumption.
Quantifying the exposure
Once the explanation is established, the exposure must be quantified. Quantification is not a single number. It is a classification:
Confirmed loss. The money left the business, the stated purpose was false, the supporting documentation was fabricated, the counterparty has no substance and the funds cannot be traced to a legitimate business activity. The confirmed loss is the amount paid minus any amount recovered or recoverable.
Probable loss. The transaction is suspicious, the supporting documentation is inadequate, the counterparty cannot be independently verified, but the investigation cannot conclusively establish that the stated purpose was entirely false. The probable loss is the amount at risk, pending further investigation or legal proceedings.
Contingent exposure. The investigation has identified a pattern (multiple transactions with connected vendors, a series of payments with inadequate documentation) that suggests the exposure may extend beyond the transactions already examined. The contingent exposure is the estimated additional amount that may be affected if the pattern extends to other transactions.
Unverifiable expenditure. The transaction occurred, the payment was made, but the supporting documentation is missing, inadequate or self-prepared. The expenditure cannot be confirmed as legitimate and cannot be confirmed as fraudulent. It is unverifiable, which is a finding in itself.
The classification matters because different categories require different responses. A confirmed loss triggers recovery action and potential legal proceedings. A probable loss triggers further investigation. A contingent exposure triggers a broader review. Unverifiable expenditure triggers a control remediation to ensure that future transactions are adequately documented.
Evidence integrity
The findings of a forensic investigation are useful only if the evidence supporting them is reliable, complete and preserved. Evidence that is contaminated (accessed by the subject of the investigation), incomplete (key documents are missing without explanation) or fabricated (created after the investigation began) undermines every conclusion.
The investigator must ensure: original documents are preserved (not photocopies of photocopies), digital evidence is extracted with appropriate chain-of-custody controls, witness statements are recorded contemporaneously, the chronology of events is documented (when each transaction occurred, when the anomaly was identified, when each document was obtained) and the investigation’s working papers are maintained in a form that an independent reviewer (a court, a regulator, an auditor) can follow.
What decision-makers should do
Before acting, ensure the investigation has answered three questions: What happened (the factual finding, supported by evidence)? How much is involved (the quantified exposure, classified by certainty)? What can we prove (the evidence that would withstand scrutiny by a court, a regulator or an independent reviewer)?
The answers determine the response: internal remediation (fix the controls), recovery action (demand repayment from the individual or entity), legal proceedings (file a complaint, initiate arbitration, pursue civil recovery), regulatory reporting (inform the lender, the regulator, the board) or further investigation (expand the scope to test whether the identified pattern extends beyond the transactions already examined).
Northrop Management conducts forensic investigations for company boards, promoters, lenders, investors and legal advisers. The engagement covers transaction tracing, counterparty verification, exposure quantification and evidence-grade reporting.
[email protected] | +91 92899 25657 | northropindia.com