Corporate Fraud in India: Auditor Duties and Board Oversight

Summary: Corporate fraud can involve fictitious revenue, overstated bank balances, diversion of funds, concealed liabilities or transactions with undisclosed related parties. Preventing and detecting such misconduct requires more than a documented control framework: management must operate effective controls, boards and audit committees must challenge unusual transactions, and auditors must obtain sufficient appropriate evidence while exercising professional scepticism. A statutory audit provides reasonable rather than absolute assurance and does not guarantee detection of every fraud. Nevertheless, an auditor cannot disregard inconsistencies or rely unquestioningly on management representations. Section 143 of the Companies Act, 2013 gives auditors access to company records and a right to seek necessary information and explanations; applicable auditing standards address fraud risks, audit evidence, external confirmations and reporting. Where the conditions of Section 143(12) and Rule 13 are met, the reporting route depends on the amount and other prescribed requirements. Independent directors and audit committees have oversight responsibilities, while applicable vigil mechanisms allow concerns to be raised with safeguards. Discovery of a material prior-period error also requires careful accounting: companies applying Ind AS 8 generally correct material errors retrospectively, subject to the standard’s impracticability provisions, whereas AS 5 follows a different approach for prior-period items. An effective response to suspected fraud includes preserving evidence, protecting reporting channels, assessing financial statement effects, considering reporting duties and documenting remedial action.

Corporate Fraud and Financial Reporting Risks

Corporate fraud can damage investors, lenders, employees, suppliers and the company itself. Its effects may be concealed for several reporting periods when false transactions are supported by manipulated records or when concerns are not escalated.

Common schemes include premature or fictitious revenue, inflated receivables or bank deposits, undisclosed borrowing, diversion of funds, fictitious suppliers and related-party transactions presented without sufficient disclosure. Some misconduct involves individual employees; other cases may involve management override or collusion among several parties.

Neither the size of an audit firm nor the presence of written procedures establishes that financial statements are free from fraud. The practical question is whether the people responsible for governance and assurance identified the risks, obtained reliable evidence and responded to warning signs.

Who Is Responsible for Preventing and Detecting Fraud?

Management and those charged with governance have primary responsibility for preventing and detecting fraud. Management designs and operates controls, maintains records and prepares financial statements. The board oversees management and, where applicable, an audit committee reviews financial reporting, internal controls and the audit process.

The statutory auditor has a separate responsibility to conduct an audit in accordance with the applicable Standards on Auditing and report under the Companies Act, 2013. Internal auditors, compliance teams, employees and whistleblowers also contribute information that can reveal control weaknesses.

Responsibilities overlap, but they are not interchangeable. An external audit does not relieve management of its duties, and management’s responsibilities do not remove the auditor’s obligation to evaluate evidence independently.

Auditor’s Powers and Responsibilities Under the Companies Act

Under Section 143 of the Companies Act, 2013, a company auditor has a right of access at all times to the company’s books of account and vouchers and may seek information and explanations from officers as considered necessary for audit duties. The section also requires inquiries into specified matters.

These rights allow the auditor to question management and examine company records. They are not unrestricted police powers to compel access to all third-party records. Bank and counterparty information is ordinarily obtained through appropriate confirmation procedures, authorisations or other lawful means.

The auditor must evaluate whether the evidence obtained is sufficient and appropriate for the relevant financial statement assertions. A management explanation can be useful, but it cannot automatically replace independent corroboration where the circumstances require it.

Professional Scepticism and Fraud Risk Assessment

A financial statement audit aims to provide reasonable assurance that the statements are free from material misstatement, whether caused by fraud or error. Reasonable assurance is a high level of assurance, but it is not a guarantee that every fraud will be found. Collusion, forged documentation and management override can make fraud difficult to detect.

SA 240 addresses the auditor’s responsibilities relating to fraud. The auditor assesses fraud risks and maintains professional scepticism, including when past experience suggests that management is honest. The audit response should change when new evidence calls the original risk assessment into question.

For example, the auditor’s response may involve testing unusual journal entries, examining estimates for management bias, reviewing significant transactions outside the ordinary course of business and increasing the extent of corroboration. The NFRA staff guidance on revenue risk assessment discusses the assessment of material misstatement and the response to revenue-related risks.

Bank Balances and External Confirmations

Large cash or fixed deposit balances may appear reassuring, but an auditor must evaluate their existence, ownership, restrictions and presentation. Relevant procedures may include reviewing bank reconciliations, testing transactions and seeking confirmations from banks.

Under SA 505, when external confirmation procedures are used, the auditor maintains control over the requests: selecting the confirming party, determining the information required, addressing and sending the request, and arranging for the reply to be sent directly to the auditor. The reliability of the response must also be assessed.

When Management Restricts a Confirmation

If management refuses to permit a confirmation, the auditor must inquire into the reasons, assess the implications for audit risks and perform appropriate alternative procedures. An unreasonable refusal or inability to obtain reliable alternative evidence must be communicated to those charged with governance, with the implications for the audit and opinion assessed under the applicable standards.

If a positive confirmation is necessary to obtain sufficient appropriate audit evidence, alternative procedures cannot necessarily replace it. An unresolved limitation may affect the audit opinion; it does not, by itself, prove fraud.

Warning Signs That Require Further Inquiry

A warning sign is not proof of wrongdoing. It is a reason to obtain explanations, evaluate contradictory evidence and determine whether further work or escalation is required. Financial market indicators can also inform risk assessment where relevant, but a falling share price alone does not establish fraud.

Fraud Reporting Under Section 143(12)

Section 143(12), read with Rule 13 of the Companies (Audit and Auditors) Rules, 2014, prescribes reporting obligations where an auditor, in performing duties, has reason to believe that an offence of fraud meeting the statutory conditions is being or has been committed by officers or employees.

For the first category, Rule 13 prescribes steps and timelines, including communication to the Board or Audit Committee, an opportunity for its reply and reporting to the Central Government in Form ADT-4. The statutory test is reason to believe; the auditor need not wait for a criminal conviction before assessing whether the reporting duty is triggered.

The facts, amount, persons involved and applicable requirements must be assessed carefully. Other reporting obligations may also arise under the audit standards or CARO where applicable. The NFRA circular on auditors’ fraud-reporting responsibilities discusses these obligations.

Independent Directors and Audit Committee Oversight

Independent directors can strengthen scrutiny by questioning assumptions, requesting additional information and recording concerns. Their effectiveness depends on access to timely information, adequate time for review, relevant expertise and a willingness to challenge management.

Where an audit committee is required, its work may include oversight of financial reporting, discussions with auditors, consideration of internal financial controls, and review of matters assigned under applicable law and regulations. A committee should meet auditors privately where appropriate and track unresolved audit observations to closure.

Not every company has the same committee or independent director requirements. Applicability depends on the Companies Act, the relevant rules and, for listed entities, applicable SEBI listing requirements. For background, see audit committee requirements under the Companies Act and SEBI regulations.

Whistleblower Channels and Protection Against Retaliation

Employees and directors may notice unusual instructions before they appear in final accounts. A credible reporting channel should allow concerns to reach the appropriate independent authority, protect confidentiality to the extent possible and prohibit retaliation.

Section 177 requires a vigil mechanism for listed companies and prescribed classes of companies, with statutory safeguards and access to the audit committee chairperson in appropriate or exceptional cases. A written policy alone is insufficient if complaints are not acknowledged, assessed, investigated and tracked to closure. A vigil mechanism or whistleblower policy should be supported by actual reporting and follow-up procedures.

Correcting Financial Statements After a Fraud or Error

Once a material misstatement is identified, management should evaluate the amount, affected periods, disclosures, tax consequences and implications for controls. The auditor must assess the evidence, reporting implications and whether other periods or balances may also be affected.

Companies Applying Ind AS 8

Under Ind AS 8, material prior-period errors are generally corrected retrospectively in the first financial statements approved for issue after discovery. This is done by restating comparative amounts for the affected prior period or, where the error predates the earliest period presented, by restating the relevant opening balances. The standard contains specific limits where determining the effects is impracticable.

Companies Applying AS 5

For entities applying the applicable Accounting Standards rather than Ind AS, AS 5 addresses prior-period items arising from errors or omissions. Their nature and amount must be separately disclosed so that the effect on current profit or loss can be understood. The applicable accounting framework and facts must be assessed; one treatment should not be assumed to apply to every company.

Retrospective correction of comparative information in later financial statements is distinct from reopening or revising previously approved financial statements under the Companies Act. Any such separate legal procedure must be assessed under the relevant provisions and circumstances.

Responding to a Suspected Corporate Fraud

1. Preserve evidence: Secure records, communications, system logs and relevant authorisations, with appropriate controls over access and preservation.
2. Escalate independently: Inform the appropriate governance body; where senior management may be involved, avoid relying solely on the persons implicated.
3. Assess immediate exposure: Consider financial loss, liquidity, contractual obligations, customer interests, data access and continuing transactions.
4. Investigate proportionately: Define the scope and consider independent legal, forensic accounting or technology specialists where the circumstances warrant.
5. Assess reporting duties: Evaluate statutory auditor reporting, company and listed-entity disclosure obligations, lender covenants and other applicable requirements without assuming one report satisfies all duties.
6. Correct and remediate: Evaluate accounting corrections, controls, accountability and monitoring, and document the basis for each decision.

An investigation should distinguish allegations from established facts and protect the integrity of evidence. A control failure should be remedied even where the investigation does not establish fraud.

Frequently Asked Questions

Does an unmodified audit opinion guarantee that no fraud exists?

No. An audit provides reasonable assurance about material misstatement, not an absolute guarantee that all fraud or error has been detected.

Can auditors question management and seek supporting records?

Yes. Section 143 provides access to company books and vouchers and permits the auditor to seek necessary information and explanations from officers.

Is every accounting discrepancy fraud?

No. A discrepancy may result from error, estimation, timing or misconduct. Its cause and significance must be examined using appropriate evidence.

Must every suspected fraud be reported to the Central Government?

No. The reporting route under Section 143(12) and Rule 13 depends on the statutory conditions and prescribed amount. Other reporting duties may also apply.

Can a company rely entirely on its statutory auditor to prevent fraud?

No. Management and those charged with governance have primary responsibilities for prevention and detection, supported by controls, oversight and reporting channels.

Must every company appoint an audit committee?

No. Applicability depends on the company’s classification and the relevant Companies Act rules and, where applicable, SEBI requirements.

Are material prior-period errors always adjusted only in the current year?

No. Under Ind AS 8, material prior-period errors are generally corrected retrospectively, subject to the standard’s impracticability provisions. AS 5 addresses prior-period items differently.

Key Takeaways

• Fraud prevention relies on management controls, board oversight, effective reporting channels and independent assurance.
• Auditors must assess fraud risks and obtain sufficient appropriate evidence while exercising professional scepticism.
• Independent confirmations and unexplained restrictions on evidence require careful evaluation.
• Section 143(12) and Rule 13 impose reporting duties when their specified conditions are met.
• Accounting correction depends on the applicable framework; Ind AS 8 and AS 5 should not be treated as interchangeable.