Audit and Investigations: formula sheet

Key formulas

Meaning in one line

Forensic audit = audit skills + investigative skills + legal-evidence standard

Use this to open any definition answer.

Core objectives

Detect → Quantify → Identify persons and method → Preserve evidence → Recommend action and controls

A handy sequence to list objectives in order.

Statutory vs forensic: purpose

Statutory audit: true and fair view | Forensic audit: establish fraud and its proof

The purpose is the main point of difference.

Statutory vs forensic: approach

Statutory: routine, sample-based, materiality | Forensic: suspicion-based, targeted, often 100% checking of relevant items

Forensic work does not rely on materiality in the same way, since even small items can matter.

Statutory vs forensic: output

Statutory: audit opinion on financial statements | Forensic: detailed report with findings, evidence and loss quantification

The forensic report is meant to support legal or disciplinary action.

Definition of fraud

Fraud = intentional act + deception + unfair or illegal gain

Intent is the test. If there is no intent, it is an error.

Fraud triangle

Fraud risk = Pressure + Opportunity + Rationalisation

A conceptual model, not a numeric formula. Fraud is more likely when all three are present.

Three main types of occupational fraud

Asset misappropriation | Fraudulent financial reporting | Corruption

Use these as headings in any answer on types.

Fraud vs error

Fraud = intentional misstatement; Error = unintentional misstatement

Both cause misstatement. Only the act behind it differs.

Red flag rule

Red flag = indicator, not proof

State this whenever you list warning signs.

Stages of a forensic audit

Acceptance → Planning → Evidence gathering → Analysis → Reporting → Court support and follow-up

Use this order as your answer skeleton. Some books merge or split stages, so keep the logic and name each stage clearly.

Fraud triangle (link for planning)

Pressure + Opportunity + Rationalisation

Helps you form a hypothesis about who might commit fraud and where. Use it in the planning stage.

Chain of custody

Identify → Collect → Label → Store securely → Record every transfer

Needed so that evidence, especially digital evidence, is accepted as reliable.

Main data analytics tests

Duplicate test, gap test, outlier test, Benford's law test, trend and ratio analysis, matching of records

Benford's law is a screening tool for the frequency of leading digits. A deviation is a red flag, not proof of fraud.

Audit versus investigation: core contrast

Audit = routine + general + sampling + opinion; Investigation = specific suspicion + detailed + facts and proof + findings

Use these pairs as the skeleton of any difference answer. Add scope, timing and reporting.

Investigation procedure sequence

Terms of reference → Planning → Securing records → Evidence gathering and analysis → Interviews → Documentation → Report → Follow-up

Present the steps in this order. Interviews usually come after documents are secured and analysed, so the investigator is well prepared.

Classification of investigations

By ordering party (management, audit committee, external party, government) | By subject (fraud, acquisition, specific account, compliance) | By setting (internal or external)

Pick the classification the question asks for. If it is open, give two and explain briefly.

Inspection and inquiry (sections 206 to 209)

206 call for information, inspect, inquire | 207 conduct | 208 report | 209 search and seizure

Led by the Registrar or an inspector. Search and seizure under section 209 needs a Special Court order.

Grounds for Central Government investigation (section 210)

Report under 208 | Special resolution of company | Public interest | Order of court or Tribunal

The first three give the Central Government a power to order. For a court or Tribunal order, the Government must order the investigation.

SFIO assignment (section 212)

Report under 208 | Special resolution | Public interest | Request from a Central or State Government department

The Central Government must first form the opinion that the SFIO should investigate. The SFIO cannot start on its own.

Tribunal route (section 213)

Company with share capital: 100 members or members holding ≥ 1/10 of total voting power. Company without share capital: ≥ 1/5 of persons on the register of members

The application must be backed by evidence of good reason. The Tribunal can also act on other applications if the circumstances suggest fraud or unlawful conduct.

Priority once SFIO takes a case (section 212)

SFIO case taken up → no other agency proceeds; records transferred to SFIO

Avoids parallel investigations into the same affairs.

Fraud and prosecution

Fraud punishable under section 447; trial before the Special Court

Offences under section 447 carry stricter arrest and bail conditions in section 212.

Admissibility test

Admissible = Relevant + Lawfully obtained + Authentic + Properly proved

Use as a checklist in any case-based question on whether evidence can be used.

Chain of custody record

Item → Who → When → Where → How → Hand-over → Storage

Every transfer must be logged. A gap weakens authenticity.

Digital integrity check

Hash(original) = Hash(forensic copy)

Matching hash values show the copy is identical to the source.

Report structure

Mandate → Scope → Procedures → Findings → Evidence → Loss quantified → Conclusion

A safe order for any report-writing answer.

Reliability ranking (general rule of thumb)

Independent external, original documents > internal, copies > oral statements

A guide, not an absolute rule. Reliability depends on source and controls.

Quick revision

• Forensic audit starts from an allegation or suspicion and aims at evidence usable in legal proceedings.
• A statutory audit gives an opinion on true and fair view; a forensic audit establishes facts about specific matters.
• Fraud involves intentional deception for gain; an error is unintentional.
• Red flags are warning signs, not proof of fraud.
• Fraud is easier when pressure, opportunity and rationalisation are present together.
• The forensic audit process runs from acceptance and planning to evidence gathering, analysis and reporting.
• Investigation of a company is ordered only under the powers given by the Companies Act, 2013 and related law.
• Always match the authority to the route: who orders, on what ground, with what powers.
• Evidence must be relevant, reliable and preserved with a clear chain of custody.
• Electronic evidence needs careful handling so it is not altered.
• A report states facts, method and findings clearly, and keeps opinion separate from evidence.
• In case answers, write provision, analysis of facts and conclusion in that order.

Common mistakes

• Saying forensic audit is a replacement for statutory audit. Fix: State clearly that they serve different purposes. Statutory audit is mandatory and opines on financial statements. Forensic audit is engagement-based and targets suspected fraud.
• Writing that statutory auditors have no duty on fraud. Fix: Say that the auditor must plan and perform the audit with fraud risk in mind and report fraud as required by the Companies Act, 2013, but is not an investigator.
• Defining fraud without mentioning intent. Fix: Always write 'intentional' and 'deception' in the first line. Then contrast with error.
• Treating a red flag as proof of fraud. Fix: Write that red flags are indicators that call for further inquiry. Conclusion should be to investigate, not to accuse.
• Treating a forensic audit like a statutory audit and giving an audit opinion. Fix: State that a forensic audit examines a specific allegation and reports facts and findings that can support legal action.
• Skipping the acceptance and scope stage. Fix: Begin with engagement terms, scope, authority, confidentiality and conflict checks before any fieldwork.
• Treating investigation as just a more detailed audit. Fix: Stress the trigger and objective. An investigation starts from a specific suspicion and aims to establish facts and proof.
• Saying an investigation always gives an opinion on true and fair view. Fix: State that the output is findings and conclusions on the matter investigated, based on terms of reference.
• Treating inspection and investigation as the same thing. Fix: Inspection is by the Registrar under sections 206 to 209 and is a fact-finding check. Investigation under sections 210 to 213 is ordered by the Central Government or the Tribunal and is deeper.
• Saying the SFIO can start an investigation on its own. Fix: Section 212 needs a Central Government order. The Government must first form the opinion that the SFIO should investigate, on one of the stated grounds.

Exam tips

• Always start with a definition that includes the legal evidence element. This is where many answers lose marks.
• For a differences question, use clear heads and write at least six points. Marks are given point-wise.
• Link your answer to a short practical illustration, such as fund diversion, to show application.
• Mention the statutory auditor's fraud-reporting duty under the Companies Act, 2013, so your answer is balanced, but do not quote section numbers unless you are sure.
• Keep the objectives list in a logical order: detect, quantify, identify, preserve evidence, act, prevent.
• Write 'intentional' in your definition. Examiners look for it and it is the core of the fraud vs error answer.
• In case-based questions, map facts to the triangle in a short list. Say clearly when a side is not shown in the facts.
• Group red flags under headings such as behavioural, financial and control. This makes long answers easy to mark.