Table of Contents
Story of Shruthi – How a Forensic Team Gets Deployed
In most companies, forensic accounting teams are not part of daily operations—they are specialists called in when something feels “off.” The trigger could be an anonymous whistleblower complaint, unexplained financial discrepancies, or regulatory pressure after an audit.
For Shruthi, the trigger came on a Monday morning. The board had received a short, anonymous email:
“Check the vendor payments—numbers don’t match deliveries.”
This was enough to set the wheels in motion. The CEO called the company’s external forensic accounting firm. Within 48 hours, Shruthi and her team were inside the premises, laptops open, data access granted, and a clear mandate:
“Find out if there’s fraud—and how deep it goes. Uncover the truth – fast”.
Forensic accountants aren’t there to speculate—they investigate with precision.
Red Flags in Forensic Accounting
Forensic accounting team investigation showed many red flags, indicating possible fraud or financial manipulation:
1. Unusual or Unexplained Transactions
- Large round-figure payments
- Multiple payments just below approval thresholds
Example: Vendor invoices consistently at ₹4,99,000 when manager approval was required at ₹5,00,000.
While scanning vendor payments, Shruthi saw multiple invoices at ₹4,99,000 — suspiciously just below the ₹5,00,000 limit requiring CFO approval. This pattern repeated across 4 months.
2. Sudden Spikes or Drops in Expenses/Revenue
- Seasonal patterns disrupted without clear business reason.
In April, the company’s travel expenses tripled despite no major client events or new projects. A deep dive revealed fake travel bills routed through a friendly agency.
3. Suspicious Vendor or Customer Activity
- Same address for multiple vendors
- Vendors with no online presence
- Newly created vendors getting large contracts
Shruthi found three “different” vendors all registered at the same small residential flat. None had a website. All received large maintenance contracts.
4. Frequent Journal Entry Adjustments
- Backdated entries
- Adjustments near quarter/year-end
- Entries made by unauthorized personnel
End-of-quarter entries were being backdated by a junior accountant—approved remotely by a manager on leave. Many adjustments lacked supporting documentation.
5. Employee Lifestyle Mismatches
- Sudden luxury purchases not in line with salary
A mid-level procurement officer arrived to work in a new imported SUV, posted luxury holiday pictures abroad, and was spotted wearing a ₹6 lakh watch—on a ₹14 lakh annual salary.
6. Poor Documentation
- Missing invoices
- Altered purchase orders
- Signatures that don’t match authorized signatories
Several high-value purchase orders had scanned signatures that forensic handwriting comparison proved did not match the actual approving manager’s handwriting
7. Overly Complex Transactions
- Layered payments through multiple accounts
- Offshore shell entities
Example: A single payment for equipment was routed through four intermediary companies, adding layers of “service fees” that inflated costs by 30%.
8. Reconciliation Gaps
- Bank statements not matching general ledger
- Long-pending reconciling items
Example: Bank reconciliation showed ₹18 lakh in unaccounted credits sitting unreconciled for over 60 days—money traced back to overpayment to a vendor, which was never refunded.
How Shruthi Used Tools to Catch Each Red Flag
| Red Flag | Tool Used | Finding |
|---|---|---|
| Unusual Transactions | Payment threshold analysis | Multiple invoices at ₹4,99,000 |
| Expense Spikes | Trend analysis | Travel expense tripled in April |
| Suspicious Vendors | Vendor database search | Same address for three vendors |
| Journal Adjustments | Journal entry testing | Backdated entries without proof |
| Lifestyle Mismatch | Lifestyle audit | SUV, foreign trip, luxury watch |
| Poor Documentation | Document verification tools | Forged scanned signatures |
| Complex Transactions | Transaction mapping software | 4 intermediary companies |
| Reconciliation Gaps | Bank statement vs. GL check | ₹18 lakh overpayment unreconciled |
Red Flags in Forensic Accounting by Category
Here’s a comprehensive list of red flags in forensic accounting, grouped by category so it’s easy to scan and use in investigations, reports, or training material.
1. Financial Statement Red Flags
These show up in reported results, ratios, and trends.
- Unusual revenue growth without matching increase in cash flows.
- Sudden spikes/drops in revenue or expenses at quarter/year-end.
- Negative cash flows despite positive reported profits.
- Large, unexplained adjustments to prior periods.
- Inconsistent trends between related accounts (e.g., sales up but receivables down).
- Significant related-party transactions without clear business purpose.
- Frequent restatements of financial results.
- Gross margin fluctuations not explained by business changes.
Example (Shruthi): Shruthi notices a 35% jump in revenue in the last quarter of the year, but cash receipts remained flat — triggering her deeper look.
2. Transaction-Level Red Flags
Suspicious entries or payment activity.
- Round-dollar amounts in large payments.
- Multiple payments to same vendor on the same day with similar amounts.
- Payments just below approval thresholds to avoid review.
- Backdated journal entries.
- Manual journal entries posted outside normal accounting cycles.
- Split transactions to bypass limits.
- Frequent write-offs or credit memos for specific customers.
- Unusual vendor invoice numbering or format inconsistencies.
Example (Shruthi): She finds multiple ₹9,95,000 vendor payments (limit ₹10,00,000 for approval) — suggesting someone was avoiding higher-level sign-off.
3. Vendor & Customer Red Flags
Indications of fictitious, related-party, or shell entities.
- Vendors/customers with incomplete or false addresses.
- PO box or residential addresses instead of commercial ones.
- Same contact number or email for multiple vendors.
- Recently created vendors with high transaction volumes.
- Vendors without tax registrations or licenses.
- Multiple vendors with similar names.
- Payments to vendors in unrelated geographies to business operations.
Example (Shruthi): She discovers that three “different” suppliers share the same GST number — classic sign of a shell network.
4. Payroll & HR Red Flags
Fake employees, inflated pay, or ghost workers.
- Employees with no physical presence but receiving salaries.
- Multiple bank accounts for salary credit for the same person.
- Unusually high overtime for select employees.
- Salaries above market rate without clear justification.
- Frequent manual changes to payroll master data.
Example (Shruthi): She spots payroll for an employee ID that was terminated six months earlier — the salary still being credited to the same bank account.
5. Expense & Asset Red Flags
Misappropriation or overstatement of assets.
- High travel/entertainment expenses without receipts.
- Capital assets purchased but never received/used.
- Frequent repairs on new assets.
- Unexplained scrap/disposals of assets.
- Inventory shrinkage without proper investigation.
Example (Shruthi): She sees repeated repair invoices for a machine supposedly brand new — turns out the machine never existed.
6. Banking & Fund Flow Red Flags
Indicating possible diversion of funds.
- Transfers to personal accounts from company funds.
- Use of multiple intermediary bank accounts before final beneficiary.
- Frequent cash withdrawals by the same person.
- Payments to offshore accounts without business rationale.
- Unusual SWIFT/wire transfers near reporting dates.
Example (Shruthi): She tracks a ₹50 lakh vendor payment that ends up in the personal account of a procurement manager’s relative.
7. Behavioral Red Flags
Signs from people rather than data.
- Employees living well beyond their means.
- Reluctance to share information or bypassing standard processes.
- Aggressive resistance to audits or questioning.
- Frequent override of controls by senior management.
- Unusual secrecy around certain transactions or projects.
Example (Shruthi): The purchase manager refuses to share supplier contracts, claiming “confidentiality,” which pushes her to dig deeper.
8. Compliance & Legal Red Flags
Risk of regulatory breaches.
- Non-compliance with KYC/AML requirements for vendors/customers.
- Missing statutory filings or inconsistent reporting to regulators.
- Transactions with sanctioned countries/entities.
- Unexplained legal settlements or penalties.
Example (Shruthi): She finds payments to an overseas entity later revealed to be on an international sanctions list.
9. IT & Systems Red Flags
Tampering or exploitation of ERP systems.
- Unauthorized access to financial systems.
- Changes to master data without logs.
- User accounts active after employee termination.
- Deletion of audit logs or missing transaction history.
Example (Shruthi): An ex-employee’s login was used to make entries a month after leaving — indicating compromised credentials.
Tools and Techniques to Catch Red Flags in Forensic Accounting
Forensic accountants use a range of techniques:
- Ratio Analysis (e.g., debt-to-equity, quick ratio)
- Trend Analysis
- Benford’s Law (to spot anomalies in numerical data)
- Cash Flow Testing
- Related Party Transaction Review
- Shell Company Detection
- KYC & UBO Mapping
- Email and Digital Forensics
These tools help spot discrepancies between reported data and actual performance or behavior.
Forensic accounting isn’t just about looking at numbers—it’s about investigating the story behind the numbers. Professionals in this field rely on a mix of analytical tools, digital technologies, and investigative techniques to uncover fraud or misconduct early.
🔍 A. Analytical & Financial Techniques
- Ratio Analysis
- Compare ratios like debt-to-equity, quick ratio, inventory turnover, and return on equity over time or against industry benchmarks.
- Sudden or unexplained changes often signal misreporting or manipulation.
- Compare ratios like debt-to-equity, quick ratio, inventory turnover, and return on equity over time or against industry benchmarks.
- Trend Analysis
- Observing patterns in revenue, expenses, profit margins, or loan performance.
- Flat or falling cash flow while profits surge can be a red flag.
- Observing patterns in revenue, expenses, profit margins, or loan performance.
- Benford’s Law
- This statistical principle helps detect fraud in large datasets.
- Abnormal distributions of digits (e.g., too many numbers starting with 9) may suggest data manipulation.
- This statistical principle helps detect fraud in large datasets.
- Cash Flow Testing
- True health lies in cash from operations, not profits on paper.
- Discrepancies between cash flow and net income raise suspicions.
- True health lies in cash from operations, not profits on paper.
- Journal Entry Testing
- Random or manual entries made late in the period or without documentation are reviewed.
- This is where most “adjustments” happen to meet earnings targets.
- Random or manual entries made late in the period or without documentation are reviewed.
🔗 B. Investigative Techniques
- Related Party Transaction Review
- Forensic teams scrutinize deals involving promoters, family-owned vendors, or “friendly” companies.
- These often mask diversion of funds, overstated revenue, or kickbacks.
- Forensic teams scrutinize deals involving promoters, family-owned vendors, or “friendly” companies.
- Shell Company Detection
- Identifying fake or inactive companies created to route money.
- They may exist only on paper with common addresses or directors.
- Identifying fake or inactive companies created to route money.
- KYC & Ultimate Beneficial Ownership (UBO) Mapping
- Tracing hidden ownerships through corporate layering.
- Helps discover undisclosed control, especially in money laundering or fake loan cases.
- Tracing hidden ownerships through corporate layering.
💻 C. Digital Forensics & Technology Aids
- Email & Communication Forensics
- Analyzing metadata and content in emails, chats, and internal communication.
- Useful in tracing intent or collusion between employees or executives.
- Analyzing metadata and content in emails, chats, and internal communication.
- Data Mining & Visualization
- Use of tools like Tableau, Power BI, or ACL Analytics to extract patterns from financial data.
- Helps in visual spotting of trends, anomalies, and concentrations.
- Artificial Intelligence & Machine Learning
- Advanced forensic setups use AI to learn patterns of legitimate vs. fraudulent behavior.
- Can flag suspicious transactions in real time.
- ERP and Transaction Log Review
- Forensic accountants dive into enterprise systems (SAP, Oracle, Tally) to audit digital trails.
- They examine audit logs, time stamps, and deleted entries.
🧾 D. Legal and Documentary Review
- Contract Review
- Examining terms in loan agreements, vendor contracts, and MoUs for unusual clauses.
- For instance, backdated agreements or missing payment terms.
- Board Minutes and Resolutions Audit
- Cross-checking what was officially approved vs. what was executed.
- Red flags include missing minutes, vague resolutions, or frequent director absences.
- Audit Trail Verification
- Following the full trail of financial entries, approvals, and documentation.
- A broken or missing trail usually indicates fabrication or concealment.
📚 Tools Commonly Used
| Category | Tools |
| Data Analysis | Excel, ACL, IDEA, Tableau |
| Accounting Systems | SAP, Oracle, Tally |
| Document Review | Adobe Acrobat Pro, Concord |
| Email Analysis | EnCase, FTK, X1 Social Discovery |
| Digital Forensics | Autopsy, Sleuth Kit, Cellebrite |
| Visualization | Power BI, Visallo, i2 Analyst’s Notebook |
Red Flags & Tools Mapping — Shruthi’s Investigation
| Red Flag | Tool / Technique Used | Shruthi’s Story |
|---|---|---|
| Unusual revenue growth with flat cash flows | Financial Ratio Analysis in Excel/Power BI + Cash Flow Matching | Shruthi plotted monthly revenue vs. cash receipts and saw the spike with no matching inflow — triggering deeper contract reviews. |
| Negative cash flows despite profit | Trend & Variance Analysis in IDEA | IDEA’s automated variance report showed operating cash flow plunging while net income rose — a mismatch worth probing. |
| Round-dollar payments | SQL Query to filter transactions ending in “000” | Her SQL extract showed multiple ₹5,00,000 payments to the same vendor — a perfect laundering sign. |
| Multiple payments just below approval threshold | ACL / IDEA filters by “amount < limit” | She caught 18 payments of ₹9,95,000 split over 3 days — exactly ₹5k below approval level. |
| Backdated entries | ERP Audit Log Review | The ERP’s metadata showed journal entries “posted” in January but actually created in March — indicating concealment. |
| Vendors with same GST or address | Master Data Match in Excel/Power BI + Fuzzy Matching | Shruthi’s fuzzy match report found 3 vendors with slightly different names but the same GST — a shell vendor ring. |
| New vendor with huge transactions | Vendor Aging Analysis in IDEA | She flagged a vendor created just 2 weeks earlier but already billing ₹2 crores — no legitimate onboarding trail. |
| Ghost employees | Payroll-to-HR Cross-Match in SQL | By matching HR active list vs payroll bank credits, she found an ex-employee still “getting paid” six months after leaving. |
| High repair costs for new asset | Asset Register Audit + Physical Verification | The machine supposedly “repaired” didn’t exist in the plant — invoices were entirely fabricated. |
| Fund diversion to personal account | Bank Statement Scrutiny + Beneficial Ownership Lookup | A vendor payment was traced to the personal account of a procurement manager’s cousin. |
| Frequent offshore transfers | SWIFT/MT103 Transaction Review + AML Software | SWIFT records revealed layered transfers via two offshore banks — classic layering stage of laundering. |
| Lavish lifestyle beyond means | Lifestyle Audit + Open-Source Intelligence (OSINT) | Shruthi matched Instagram posts of exotic trips with bank withdrawals — lifestyle not matching salary. |
| Aggressive resistance to audits | Control Environment Assessment | When a manager stalled audit requests, Shruthi pushed for surprise checks — uncovering forged vendor files. |
| Payments to sanctioned countries | OFAC/UN Sanctions List Screening Tool | A small ₹15 lakh “consulting” payment matched a sanctioned entity — creating legal exposure. |
| Unauthorized ERP access | User Access Review & Segregation of Duties (SoD) Analysis | She found an ex-employee’s login used to post entries — access hadn’t been revoked after resignation. |
| Deletion of audit logs | System Backup Review | Archived backups revealed the original logs, proving intentional deletion. |
Real World Example – Satyam Computer Services
One strong real-world example is Satyam Computer Services (India, 2009) — often called “India’s Enron.”
Red Flag Detected:
Unusually high cash balances reported in financial statements, inconsistent with interest income actually earned.
Tool Used:
- Bank Confirmation & Cash Flow Testing – Forensic accountants cross-verified bank statements directly with banks (instead of relying on documents provided by management).
- Ratio Analysis – They compared reported cash balances with returns from interest income and saw the mismatch.
Outcome:
The forensic investigation revealed that ₹7,136 crore in cash was fictitious. Because the fraud was caught before Satyam’s stock fully collapsed, the government was able to intervene, replace the board, and arrange a takeover by Tech Mahindra — saving thousands of jobs and protecting a portion of investor wealth.
5 Real World Forensic Accounting Cases
Here’s a table of 5 real-world forensic accounting cases showing the red flag, tool used, and outcome:
| Company & Year | Red Flag Detected | Forensic Tool Used | Outcome |
|---|---|---|---|
| Satyam Computer Services (India, 2009) | Reported huge cash balances inconsistent with interest income. | Bank Confirmation & Cash Flow Testing; Ratio Analysis. | ₹7,136 crore fictitious cash uncovered; board replaced; Tech Mahindra takeover saved jobs and limited investor loss. |
| Wirecard (Germany, 2020) | Claimed €1.9 billion in escrow accounts that didn’t exist. | Third-Party Bank Verification; Audit Trail Analysis. | Fraud exposed; CEO arrested; company filed insolvency, saving further investor loss by halting new inflows. |
| DHFL (India, 2019) | Large unexplained related-party transactions; high NPAs hidden. | Transaction Mapping; Journal Entry Testing. | ₹31,000 crore loan fraud detected; assets frozen; prevented further lending and bigger loss to banks. |
| Enron (USA, 2001) | Complex off-balance-sheet entities hiding debt. | Special Purpose Entity (SPE) Analysis; Cash Flow Testing. | Bankruptcy declared; triggered major corporate governance reforms (SOX Act). |
| Yes Bank (India, 2020) | Sudden spike in advances to risky borrowers; interest income mismatch. | Trend Analysis; Related Party Transaction Review. | RBI intervention; takeover by SBI-led consortium avoided total collapse. |
🔍 Call to Action — Don’t Wait for a Scandal to Strike
Fraud doesn’t happen overnight — it brews in silence, hidden behind numbers, fake invoices, and forged approvals. By the time it comes to light, the damage is often irreversible — money lost, reputation shattered, trust destroyed.
If you’re an employee, speak up — whistleblowing is the first defense.
If you’re a leader or investor, act now — build or engage a strong, independent forensic accounting team that can see what others miss. Equip them with the right tools, authority, and freedom to investigate without fear or favor.
In today’s corporate world, fraud is inevitable — but being blindsided is not. The question is: Will you discover it in time, or read about it in the headlines?
Read more blogs on Corporate Governance here.
Here’s a high-quality Indian reference link that offers valuable insights on forensic accounting tools and fraud detection from a recognized authority:
Institute of Chartered Accountants of India (ICAI) — Certificate Course in Forensic Accounting and Fraud Detection, covering tools such as CAATs, data mining, investigative auditing skills, and more ICAI.
This resource outlines practical methods and tools used in forensic investigations, making it a great reference for your readers.
