A forensic investigator entering a company with a suspicion of financial irregularity faces a volume problem. The general ledger may contain 10 million entries. The bank statements may record 500,000 transactions. The vendor master may list 5,000 counterparties. The question is not where to start looking. It is how to identify, within the first 48 hours, the transactions most likely to contain the signature of manipulation.
Speed matters. Evidence can be altered. Documents can disappear. Personnel can be coached. Systems can be modified. The forensic triage must identify the highest-probability targets before the subjects of the investigation have time to respond.
The First 100 Transactions methodology is a prioritisation framework that concentrates investigative attention where the probability of finding manipulation is highest.
The Ten Categories
1. Largest transactions by value. Material fraud requires material transactions. Extract the top 50 transactions by value in revenue, procurement, journal entries and intercompany transfers for each reporting period. Examine the counterparty, the documentation, the approval trail and the business rationale.
2. Unusual journal entries. Manual entries that bypass the ERP's standard posting logic are the most common vehicle for manipulation. Revenue through a manual journal rather than the billing module. Cost reclassified from expense to asset. Provisions reversed through manual entries. Extract all manual journals above threshold, particularly those posted by senior users.
3. Related-party transactions. Every transaction with a connected party is higher-risk because independence cannot be assumed. Examine pricing, commercial substance, documentation and cash trail.
4. Round-number transactions. Genuine commerce produces irregular amounts (Rs 47,83,219). Fabricated transactions produce round numbers (Rs 50,00,000). Statistical analysis of round-number frequency identifies datasets with anomalous patterns.
5. Weekend and holiday entries. Transactions posted outside normal business hours warrant explanation. Filter the GL for entries posted on weekends, holidays and outside standard hours. Cross-reference with the posting user and the accounts affected.
6. Manual postings in an automated environment. In a company where the ERP generates most transactions automatically, a manual posting stands out. Why was the automated process bypassed? Legitimate corrections exist. So do illegitimate circumventions of system controls.
7. Last-day-of-period entries. Transactions on the last three days of each reporting period are disproportionately likely to contain period-end adjustments designed to improve reported results. Revenue pulled forward. Expenses deferred. Provisions reversed.
8. Reversals. An entry posted and reversed within a short period raises questions. Reversals crossing period boundaries (posted March, reversed April) may be designed to inflate one period's results while correcting in the next.
9. Unusual vendors. Vendors incorporated shortly before their first transaction, with no other customers, no visible premises, shared characteristics with the promoter group, or supplying services inconsistent with the company's operations. These are the most common mechanism for cash extraction.
10. Transactions inconsistent with operations. A manufacturer purchasing consulting services from an unrelated entity. A domestic company making large international payments. Transactions that do not fit the company's business model require a specific operational explanation.
The Escalation Protocol
Each category generates flags, not conclusions. The forensic methodology requires escalation:
Flag → supporting documentation → counterparty verification → cash trail → operational corroboration → conclusion.
A transaction that is flagged but supported by genuine documentation, confirmed by an independent counterparty and corroborated by operational evidence is probably legitimate. A transaction that cannot be supported at one or more levels requires investigation.
In Northrop Management Private Limited's forensic engagements, the First 100 Transactions methodology has, in the majority of cases, either confirmed or eliminated the fraud hypothesis within the first week of fieldwork.
Ashish Chaudhary, Founder and Managing Director of Northrop Management Private Limited, frames the forensic discipline directly: "Fraud hides in volume. The investigator's job is to reduce 10 million transactions to the 100 that matter most, fast enough that the evidence is still intact when they find them."
Questions for the Boardroom
- Has our internal audit function ever conducted a forensic-style triage across these ten categories?
- Do we have the analytical capability to identify manual journals, round-number concentrations and period-end spikes in our own data?
- How many of our vendors have been subjected to a substance test within the last 24 months?
- If a forensic investigator applied this triage to our last three years of data, are we confident none of the ten categories would produce findings the board is not aware of?
Closing Implication
Forensic efficiency comes from intelligent triage. The ten categories are not a checklist. They are a prioritisation framework that concentrates attention where the probability of finding manipulation is highest. The company whose transactions survive scrutiny across all ten categories has a control environment that is working. The company whose transactions produce findings in multiple categories has a control environment that requires immediate attention.
