Internal and Forensic Audit · Audit and Investigations

Investigation: Meaning, Types and Procedure in Forensic Audit

Updated 11 October 2026 · Fact-checked

An **investigation** is a focused, evidence-driven inquiry into a specific suspected issue, such as fraud, misuse of funds or non-compliance. Unlike an audit, it starts with a suspicion and seeks facts and proof. To answer exam questions, state the purpose, type, planning, evidence gathering, reporting and follow-up.

Understand Investigation: Meaning, Types and Procedure

An audit checks whether financial statements or controls give a true and fair view, broadly and on a periodic basis. An investigation is different. It starts because someone suspects something specific: a fraud, a diversion of funds, a breach of law or a doubtful transaction. It asks what happened, who did it, how, when and how much.

The purpose of an investigation is to find facts and collect proof. Typical purposes are detecting and proving fraud, tracing misappropriated assets, assessing the value of a business before a deal, finding the cause of a loss, and supporting legal or disciplinary action. The result is a report that others can act on, so the evidence must be reliable and properly preserved.

Investigations can be grouped in several ways. By who orders them: management or board, the audit committee, an outside party such as a lender or insurer, or a government authority under law. By subject: fraud investigation, investigation of profits or financial position for a purchase, investigation of a specific account or transaction, and compliance investigation. By setting: internal (done by the entity's own team) or external (done by an independent professional or a statutory agency). Companies Act, 2013 also allows the Central Government to order investigation into a company's affairs, and the Serious Fraud Investigation Office can be assigned such cases.

The difference from audit is the key exam point. Audit is routine, broad, uses sampling and gives an opinion. Investigation is specific, suspicion-driven, often examines items in full and gives findings. An audit has a set scope under law or engagement terms, while an investigation's scope comes from the terms of reference given by whoever orders it.

The procedure follows a logical path. Clarify the terms of reference, plan the work, secure records, gather and analyse evidence, interview people, document everything, and report the findings. Throughout, confidentiality, objectivity and care with evidence matter more than speed.

Key rules to remember

Audit versus investigation: core contrast: Audit = routine + general + sampling + opinion; Investigation = specific suspicion + detailed + facts and proof + findings; Use these pairs as the skeleton of any difference answer. Add scope, timing and reporting.
Investigation procedure sequence: Terms of reference → Planning → Securing records → Evidence gathering and analysis → Interviews → Documentation → Report → Follow-up; Present the steps in this order. Interviews usually come after documents are secured and analysed, so the investigator is well prepared.
Classification of investigations: By ordering party (management, audit committee, external party, government) | By subject (fraud, acquisition, specific account, compliance) | By setting (internal or external); Pick the classification the question asks for. If it is open, give two and explain briefly.

How to solve Investigation: Meaning, Types and Procedure questions

Use one structure for definition, difference, type and procedure questions. It shows the examiner a clear provision-analysis-conclusion pattern.

1Read the question and mark what is asked: meaning, difference, types, procedure or a case to advise on.
2Define investigation in one or two lines, stressing that it is specific and starts from suspicion.
3If the question is a comparison, give 5 to 6 points: objective, scope, trigger, approach, evidence depth and report.
4If types are asked, state the basis of classification first, then list and explain each type briefly.
5For procedure or planning, walk through the sequence: terms of reference, planning, securing records, evidence, interviews, documentation and reporting.
6In a case question, apply each step to the given facts, such as the amounts, persons and records mentioned.
7Close with a conclusion: findings, recommendations and legal or disciplinary follow-up.

Quickest way: Purpose-Trigger-Scope-Report (PTSR) check

When to use it: Use when time is short, especially for 5 to 6 mark questions on audit versus investigation or on what an investigation covers.

P: write the purpose (verify accounts versus prove or disprove a suspicion).
T: write the trigger (routine cycle versus a specific suspicion or order).
S: write the scope (broad, sampled versus narrow, detailed).
R: write the report (opinion versus findings with evidence).
Add one line on who orders it and one practical example, such as suspected diversion of ₹40 lakh of funds.

Common mistakes in Investigation: Meaning, Types and Procedure

Treating investigation as just a more detailed audit.
Both examine records, so they look alike.
Fix: Stress the trigger and objective. An investigation starts from a specific suspicion and aims to establish facts and proof.
Saying an investigation always gives an opinion on true and fair view.
Students carry over the audit report format.
Fix: State that the output is findings and conclusions on the matter investigated, based on terms of reference.
Starting the answer with interviews or evidence and skipping terms of reference.
Students focus on the exciting fieldwork.
Fix: Always begin with terms of reference and planning, since scope, authority and access depend on them.
Ignoring evidence preservation and confidentiality.
Procedure is memorised as a list without the reasons.
Fix: Mention securing originals, maintaining a chain of custody, limiting access and keeping the matter confidential.
Confusing who can order an investigation under the Companies Act, 2013 with internal investigations.
Both are called investigation.
Fix: Separate management or audit committee investigations from government-ordered ones, and name SFIO only where the facts suggest serious fraud.
Giving types without any basis of classification.
Students list whatever comes to mind.
Fix: Name the basis (ordering party, subject or setting) and then list types under it.

Worked examples

Example 1

Distinguish between audit and investigation. (6 marks)

Show the solution

State the idea: audit is a routine check of accounts and controls, investigation is a focused inquiry into a specific matter.
Objective: audit forms an opinion on the financial statements; investigation establishes facts and evidence, such as fraud or loss.
Trigger: audit is periodic and required by law or engagement; investigation arises from a suspicion, complaint or order.
Scope: audit is broad and relies on sampling; investigation is narrow and detailed, examining items fully where needed.
Report: audit gives an opinion; investigation gives findings and recommendations to whoever ordered it.
Conclude: the two complement each other, as audit findings may lead to an investigation.

Answer: An audit is a routine, broad, sample-based examination that results in an opinion. An investigation is a specific, suspicion-driven, detailed inquiry that results in findings and proof, on the terms of reference given.

Example 2

The audit committee of Sundaram Textiles Ltd learns that ₹18 lakh of cash collections from dealers may have been diverted by an accounts executive. It appoints you to investigate. Outline how you would plan and carry out the work.

Show the solution

Terms of reference: get a written mandate from the audit committee covering the suspected matter, period, powers of access and reporting line.
Planning: list the cash collection process, receipts, bank deposits and dealer ledgers. Identify the people involved and decide the team, tools and timeline.
Secure records: take copies or originals of receipt books, bank statements, dealer ledgers and system logs, and restrict access to prevent tampering.
Gather and analyse evidence: reconcile receipts with bank deposits, compare dealer confirmations with ledger balances and look for delays in banking or unrecorded receipts.
Interviews: speak to cashiers, sales staff and dealers first, and the accounts executive last, with a witness present and notes kept.
Quantify: work out the total amount diverted, the method used and the periods affected, and note control gaps.
Report: present facts, evidence, amount, persons involved and recommendations to the audit committee, who decide on disciplinary or legal action.

Answer: Begin with written terms of reference, plan and secure records, reconcile collections with deposits, confirm with dealers, interview staff with the executive last, quantify the diversion, and report evidence and recommendations to the audit committee.

Exam tips

For 'difference' questions, write at least five points and cover objective, trigger, scope, approach and report.
In procedure answers, show the order of steps and add a short reason for each, as examiners reward logic.
In case questions, use the numbers and names from the facts, such as the amount and the department involved.
Mention practical points like terms of reference, confidentiality, evidence preservation and reporting line.
Only cite a section of the Companies Act, 2013 when you are sure of it; otherwise describe the rule in words.

Practice questions from Audit and Investigations

Investigation: Meaning, Types and Procedure in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

CA FinalInvestigation: Meaning, Scope and Procedure

Investigation: Meaning, Types and Procedure: frequently asked questions

What is the main difference between audit and investigation?

An audit is a routine, broad check that ends in an opinion. An investigation is a specific inquiry triggered by suspicion that ends in findings backed by evidence. Their scope and depth also differ.

What are the types of investigation in forensic audit?

You can classify them by who orders them, by subject and by setting. Common types are fraud investigation, investigation for acquisition, specific account or transaction investigation, compliance investigation, and internal or external investigation.

How do I plan an investigation?

Start with written terms of reference, then understand the process and people involved. Decide the team, tools, timeline and evidence needed, and secure records early. Keep the matter confidential.

Can the government order an investigation into a company?

Yes. The Companies Act, 2013 allows the Central Government to order an investigation into a company's affairs, and serious fraud cases can be assigned to the Serious Fraud Investigation Office. Study the related SFIO topic for details.