Summary: Questions about whether auditors can independently verify a company’s funds gained prominence after the Satyam episode. An older report on the matter stated that the Institute of Chartered Accountants of India (ICAI) had sought greater powers for auditors to trace sources of funds. The present legal framework, however, already gives company auditors access to books and vouchers and allows them to seek necessary information and explanations from company officers. Auditors must also obtain sufficient appropriate audit evidence and exercise professional scepticism; they cannot simply accept management-provided documents when the circumstances call for further verification. External confirmation procedures under SA 505 can help verify bank balances, deposits, borrowings and other assertions. Where management restricts confirmation requests or reliable evidence is unavailable, the auditor must assess the effect on the audit and the opinion. Section 143(12) of the Companies Act, 2013 and Rule 13 of the Companies (Audit and Auditors) Rules, 2014 also prescribe reporting requirements when the specified conditions concerning fraud are met. The reporting route depends, among other things, on the amount involved. These responsibilities do not give an auditor unrestricted investigative powers or guarantee detection of every fraud. The response must reflect the facts, assessed risks, applicable standards and reporting requirements.
- Company Auditors’ Powers to Verify Funds and Report Suspected Fraud
- What Powers Does a Company Auditor Have Under Section 143?
- Can Auditors Trace the Source and Use of Company Funds?
- Bank Confirmations: Why Management-Provided Documents May Not Be Enough
- What If Management Refuses a Confirmation Request?
- Professional Scepticism and the Risk of Fraud
- When Must an Auditor Report Fraud?
- Reporting on Borrowings and Use of Funds Under CARO 2020
- What Happens If Sufficient Audit Evidence Is Unavailable?
- Practical Steps for Audit Committees and Company Management
- Frequently Asked Questions
- Can a company auditor question management about the source of funds?
- Can an auditor directly confirm a company’s bank balance?
- Does every company receipt require a forensic investigation?
- Is an auditor responsible for preventing all fraud?
- Must every suspected fraud be reported to the Central Government?
- What happens if management refuses to provide required evidence?
- Does an unmodified audit opinion guarantee that no fraud exists?
- Key Takeaways
Company Auditors’ Powers to Verify Funds and Report Suspected Fraud
The Satyam episode brought attention to a question that remains relevant for shareholders, boards and audit committees: how far must an auditor go to verify funds, bank balances and transactions reported by a company?
An older report stated that ICAI had sought greater powers for auditors to trace the source of funds after allegations concerning Satyam’s accounts. That report also referred to statements attributed to Satyam’s former finance chief about the role of the auditors. Such statements should be understood as historical claims attributed to their source; they do not, by themselves, establish the legal responsibility or innocence of any individual.
The current question is better examined under the Companies Act, 2013, the applicable auditing standards and the facts of each audit.
What Powers Does a Company Auditor Have Under Section 143?
Under Section 143 of the Companies Act, 2013, a company auditor has a right of access at all times to the company’s books of account and vouchers. The auditor is also entitled to require from company officers the information and explanations considered necessary for performing audit duties.
The provision requires inquiries into specified matters, including whether loans and advances made on security are properly secured and whether their terms are prejudicial to the company or its members. The precise inquiries and audit procedures depend on the company’s circumstances.
These rights enable auditors to question management and seek supporting records. They do not make auditors law-enforcement officers or give them an unrestricted statutory right to inspect every third party’s records. Access to information held by a bank or another external party generally requires an appropriate confirmation process, authorisation or another lawful means of obtaining evidence.
Can Auditors Trace the Source and Use of Company Funds?
Auditors examine transactions and balances to obtain sufficient appropriate evidence for their audit opinion. Depending on the risk and the assertions being tested, this can involve tracing funds through company records and seeking independent corroboration.
For example, when examining a significant borrowing or capital receipt, the auditor may review:
- Bank statements and relevant account reconciliations;
- Loan agreements, sanction letters and repayment terms;
- Board approvals and statutory records;
- Identification of the lender or investor and relevant related-party records;
- Receipt and subsequent use of funds;
- Supporting explanations for unusual transfers or transactions; and
- Confirmations from banks, lenders or other counterparties, where appropriate.
The depth of work depends on materiality, the assessed risks, the applicable reporting framework and the evidence available. A routine financial statement audit is not automatically a forensic investigation into the ultimate source of every rupee received.
However, unusual features—such as unexplained circular transfers, inconsistent documents, transactions without commercial substance or evidence suggesting management override—may require additional procedures and escalation.
Bank Confirmations: Why Management-Provided Documents May Not Be Enough
A company’s bank statement or fixed deposit receipt is relevant audit evidence. Its reliability, however, must be evaluated in the circumstances. If there are reasons to doubt its authenticity or completeness, the auditor should consider what further evidence is required.
SA 505, External Confirmations, deals with the auditor’s use of external confirmations. When applying confirmation procedures, the auditor maintains control over the requests, including selecting the confirming party, deciding what information to seek, addressing and sending requests, and arranging for responses to come directly to the auditor.
For a bank balance or fixed deposit, a properly designed confirmation may seek relevant details such as the balance, deposit terms, lien or charge, and other information appropriate to the audit. The auditor should also consider the authenticity of the response and investigate discrepancies.
What If Management Refuses a Confirmation Request?
Under SA 505, if management refuses to allow a confirmation request, the auditor must inquire into the reasons, assess whether they are valid and reasonable, consider the effect on risk—including fraud risk—and perform alternative procedures designed to obtain relevant and reliable evidence.
If the refusal is unreasonable, or alternative procedures do not provide the required evidence, the auditor communicates with those charged with governance and considers the implications for the audit opinion. Where the auditor determines that a positive confirmation response is necessary, other procedures may not be a substitute for that particular evidence. live.icai.org
Professional Scepticism and the Risk of Fraud
A financial statement audit is designed to provide reasonable assurance, not absolute assurance, that the financial statements are free from material misstatement, whether caused by fraud or error.
Under SA 240, the auditor considers fraud risks and maintains professional scepticism throughout the audit. This includes recognising that management may override controls and that fraud can involve concealment, collusion or falsified documents.
Auditors should investigate inconsistencies and assess whether identified misstatements indicate fraud. Nevertheless, an audit conducted in accordance with applicable standards cannot guarantee that every fraud will be detected.
The company’s management and those charged with governance retain primary responsibility for preventing and detecting fraud through appropriate controls, oversight and an ethical culture. The auditor’s independent responsibilities operate alongside those responsibilities.
When Must an Auditor Report Fraud?
Section 143(12) and Rule 13 prescribe reporting obligations where an auditor, during the performance of audit duties, has reason to believe that an offence of fraud is being or has been committed by officers or employees of the company, subject to the statutory wording and the prescribed procedure.
| Amount involved in an individual fraud | Reporting route under Rule 13 |
|---|---|
| ₹1 crore or more | Report to the Central Government in the prescribed manner, after following the prescribed process involving the Board or Audit Committee. |
| Less than ₹1 crore | Report to the Audit Committee, or to the Board where there is no Audit Committee, in the prescribed manner. |
For a fraud involving or expected to involve ₹1 crore or more, the prescribed process includes communicating the matter to the Board or Audit Committee within the specified time and seeking its reply or observations within 45 days. The auditor then submits the prescribed report to the Central Government, including where no reply is received within that period. Form ADT-4 is prescribed for this purpose.
For fraud below the threshold, the rules also prescribe disclosures in the Board’s report. Auditors should examine the current rule text and the particular facts carefully, including the applicable timelines and reporting format. A mere discrepancy does not automatically establish that the statutory reporting threshold and other conditions have been met; equally, the auditor should not wait for a final court finding before evaluating a matter that meets the “reason to believe” test.
Reporting on Borrowings and Use of Funds Under CARO 2020
Where applicable, the Companies (Auditor’s Report) Order, 2020 requires reporting on specified matters involving borrowings and funds.
Depending on the relevant clause, these include matters such as defaults in repayment, whether term loans were applied for their intended purpose, and whether funds raised on a short-term basis were used for long-term purposes. Certain reporting requirements also address funds raised through public offers or specified allotments.
CARO does not apply uniformly to every company or every audit report. Its applicability and any exceptions must be checked for the company and reporting period concerned.
What Happens If Sufficient Audit Evidence Is Unavailable?
If management does not provide necessary records, restricts access or refuses a confirmation request, the auditor should assess the reason and perform appropriate alternative procedures.
If sufficient appropriate audit evidence still cannot be obtained, the effect on the audit report depends on the circumstances, including whether the possible effects are material and pervasive. Under the applicable reporting standards, the outcome may include a qualified opinion or a disclaimer of opinion.
Where the auditor has obtained sufficient evidence and concludes that the financial statements are materially misstated, the relevant response may instead be a qualified or adverse opinion, depending on the nature and pervasiveness of the misstatement.
The reporting decision requires professional judgment and documentation; a missing document or disagreement should not automatically be described as fraud.
Practical Steps for Audit Committees and Company Management
A company can make audit verification more effective by maintaining a clear record of significant transactions and responding promptly to audit requests.
Useful practices include:
- Maintaining a complete list of bank accounts, deposits, borrowings and charges.
- Providing agreements, approvals, bank statements and reconciliations for material transactions.
- Facilitating direct confirmation requests and responses where required.
- Explaining unusual transactions with supporting evidence rather than relying only on oral explanations.
- Escalating suspected fraud, unresolved discrepancies and restrictions on audit evidence to the appropriate governance body.
- Documenting corrective action and the basis for accounting and disclosure decisions.
For audit committees, the key question is not merely whether a document exists, but whether the auditor has obtained reliable evidence that addresses the relevant risk.
Frequently Asked Questions
Can a company auditor question management about the source of funds?
Yes. The auditor may seek information and explanations from company officers where necessary for audit duties and perform procedures appropriate to the assessed risks.
Can an auditor directly confirm a company’s bank balance?
The auditor can use external confirmation procedures, including requests to banks, where appropriate. The process generally depends on the company’s authorisation and the bank’s procedures. The auditor should maintain control over the confirmation process and assess the reliability of responses.
Does every company receipt require a forensic investigation?
No. Audit procedures are risk-based and designed to obtain sufficient appropriate evidence. Unusual transactions or suspected fraud may require more extensive work or specialist assistance.
Is an auditor responsible for preventing all fraud?
Management and those charged with governance have primary responsibility for fraud prevention and detection. The auditor must fulfil the applicable auditing and statutory responsibilities, including assessing fraud risks and reporting when legal conditions are met.
Must every suspected fraud be reported to the Central Government?
No. The route depends on the conditions in Section 143(12) and Rule 13, including the amount involved. Fraud below the prescribed ₹1 crore threshold is reported to the Audit Committee or Board under the prescribed procedure.
What happens if management refuses to provide required evidence?
The auditor must assess the reasons, consider alternative procedures and communicate appropriately with those charged with governance. If sufficient appropriate evidence remains unavailable, the auditor must assess the effect on the audit opinion.
Does an unmodified audit opinion guarantee that no fraud exists?
No. An audit provides reasonable, not absolute, assurance. An unmodified opinion does not guarantee that every error or fraud has been detected.
Key Takeaways
- Company auditors have statutory access to books and vouchers and may seek necessary information and explanations from officers.
- Auditors can question management and use independent confirmations where appropriate.
- Significant or unusual fund movements may require additional risk-based procedures.
- Management representations and documents must be evaluated alongside other available audit evidence.
- Fraud reporting under Section 143(12) depends on the statutory conditions and prescribed amount-based route.
- An audit provides reasonable assurance; it does not confer unlimited investigative powers or guarantee
