"It's just an internal review": what actually triggers a forensic audit and how the findings end up in an NCLT petition or an FIR

A founder gets an email from an investor's counsel: "We are appointing an independent professional to review certain transactions. This is a routine exercise." Six weeks later the same document set is an annexure to a Section 213 petition before the NCLT, and two directors are named in a police complaint under Section 447 of the Companies Act 2013. Nothing in the original email said "forensic audit" — but that is exactly what it was, and the report was never going to stay internal.

Forensic audit is the least understood engagement in Indian corporate compliance. Founders treat it as a heavier version of the statutory audit. It is not. A statutory audit under Section 143 asks whether the financial statements show a true and fair view. A forensic audit asks a narrower and far more dangerous question: did a specific person do a specific thing, and can it be proved to an evidentiary standard? Those two engagements have different scopes, different reporting standards, and — critically — different downstream consequences.

What the law actually requires

There is no single section of the Companies Act 2013 titled "forensic audit." The power sits in several places, and knowing which one you are facing tells you how much trouble you are in.

Section 143(12) — the auditor's own fraud reporting duty. If a statutory auditor, in the course of performing the audit, has reason to believe an offence of fraud involving an amount of ₹1 crore or more is being or has been committed against the company by its officers or employees, the auditor must report it to the Central Government in Form ADT-4 within 62 days, following the two-stage process in Rule 13 of the Companies (Audit and Auditors) Rules 2014 — first a report to the Board or Audit Committee seeking a reply within 45 days, then the ADT-4 to the Secretary, MCA within 15 days of receiving that reply. Where the amount involved is below ₹1 crore, the auditor reports to the Audit Committee or Board instead, and the matter is disclosed in the Board's Report. This is not discretionary. An auditor who fails to comply attracts a penalty under Section 143(15) of ₹5 lakh for a listed company and ₹1 lakh for any other company.

Section 210 — investigation ordered by the Central Government. The Central Government may order an investigation into the affairs of a company where a report from the Registrar or an inspector suggests it, where the company passes a special resolution requesting it, or where it is in the public interest.

Section 213 — investigation on application to the NCLT. Members holding not less than one-tenth of the total voting power (or, for a company without share capital, not less than one-fifth of the persons on the register of members) may apply to the Tribunal. The Tribunal may also act on an application from any other person where it is shown that the business is being conducted with intent to defraud creditors or members, or that persons concerned in the formation or management have been guilty of fraud or misfeasance. Critically, the Tribunal must give the company and all concerned parties a reasonable opportunity of being heard before ordering an investigation.

Section 212 — SFIO investigation. The Serious Fraud Investigation Office is a multi-disciplinary body under the MCA staffed with experts in forensic audit, accountancy, capital markets, taxation, law and IT. An SFIO investigation is assigned by the Central Government, not by the Tribunal directly.

That last point stopped being academic in May 2026. In a ruling that founders and their counsel should read carefully, the NCLAT held that the NCLT cannot itself direct an SFIO investigation — the power to assign an investigation to SFIO rests exclusively with the Central Government under Section 212. The Appellate Tribunal modified an NCLT order directing an SFIO probe and instead referred the matter to the Secretary, Ministry of Corporate Affairs, for investigation through an inspector or inspectors in accordance with law. The practical effect is not that the company escaped scrutiny — it did not. The effect is procedural: an investigation must travel through the statutory channel, and an order that skips that channel is vulnerable on appeal.

Separately, the RBI's Master Directions on Frauds require banks to classify an account as fraud following a forensic audit and to report it in the Central Repository of Information on Large Credits, after giving the borrower a hearing — the position settled by the Supreme Court in State Bank of India v. Rajesh Agarwal (2023), which held that the audi alteram partem rule applies before a borrower account is classified as fraudulent. If your company has a bank facility and the lender commissions a forensic audit, you have a right to see the report and respond before classification.

Practical implications

The consequence chain is what founders underestimate.

Section 447 is the destination. Fraud, as defined in the Explanation to Section 447, means any act, omission, concealment of any fact or abuse of position committed with intent to deceive, gain undue advantage from, or injure the interests of the company, its shareholders, creditors or any other person — whether or not there is wrongful gain or wrongful loss. Punishment is imprisonment for not less than six months, extending to ten years, and a fine of not less than the amount involved, extending to three times that amount. Where the fraud involves public interest, the minimum imprisonment is three years. Where the amount involved is less than ₹10 lakh or one per cent of turnover, whichever is lower, and does not involve public interest, the offence is punishable under the proviso with imprisonment up to five years or a fine up to ₹50 lakh or both.

Section 447 offences are non-compoundable. Section 212(6) makes offences under Section 447 cognizable, and no person accused shall be released on bail unless the Public Prosecutor has been given an opportunity to oppose and the court is satisfied of the twin conditions. This is the single most important line in this article. A GST default can be regularised. A late AOC-4 attracts a per-day penalty. A Section 447 charge cannot be settled by writing a cheque.

Directors get disqualified. Section 164(2) triggers on non-filing of financial statements or annual returns for three continuous years, but Section 164(1)(d) disqualifies a person convicted of an offence involving moral turpitude sentenced to imprisonment of not less than six months, for five years from conviction. A Section 447 conviction is squarely in that territory. MCA21 v3 carries the disqualification forward automatically — once a DIN is flagged, every company on whose board that person sits inherits a filing problem, because the DSC associated with a disqualified DIN will not authenticate an e-form.

MCA21 v3 makes the paper trail permanent. The v3 architecture links DIN, PAN, company CIN and filing history in a way the old portal did not. An ADT-4 filed against your company, an inspector's report under Section 210, or a strike-off notice sits in the same entity view a future acquirer's diligence team will pull. Forensic findings do not quietly expire.

Related-party transactions are where most forensic audits land. In practice, the transactions that generate findings are: payments to entities in which a director has an interest without Section 188 approval or AOC-2 disclosure; loans to directors or their connected persons in breach of Section 185; advances written off without board resolution; round-tripping through a group entity; and expense reimbursements without documentation. None of these are exotic. All of them are discoverable from a ledger and a bank statement.

Step-by-step: what to do

• Establish which power is being invoked, in writing. Ask the appointing party to state whether the review is contractual (under an SHA information right), lender-driven (RBI Master Directions), auditor-driven (Section 143(12)), or Tribunal-ordered (Section 213). Your rights differ in each case. Do not let it stay "an internal review."
• Do not obstruct — and record that you did not. Section 217 obliges officers and employees to preserve documents and give the inspector all assistance. Destroying or falsifying records after an investigation is ordered attracts Section 229, punishable under Section 447. Issue a written litigation-hold instruction to your team the same day you learn of the audit, and keep it.
• Convene the Board and record the appointment. If the company is commissioning the audit itself, pass a board resolution defining scope, period covered, the professional appointed, and the reporting line. A forensic audit commissioned without a resolution invites an argument later that the directors were conducting a private exercise.
• Engage separate counsel for the company and for individual directors. The company's interest and a named director's interest diverge the moment a finding is drafted. One lawyer cannot represent both once that happens.
• Reconstruct the Section 188 and Section 185 file before the auditor asks. Pull every related-party transaction for the period under review. For each, locate: the board or shareholder approval, the AOC-2 entry, the arm's-length justification, and the underlying contract. Gaps you find yourself can be explained. Gaps the forensic auditor finds are findings.
• Insist on a right of reply to the draft report. Under the Rajesh Agarwal principle, and as a matter of ordinary fairness in a contractual engagement, you are entitled to respond before the report is finalised. Ask for the draft, respond in writing with documents, and ensure your response is annexed to the final report.
• Assess the ADT-4 exposure early. If the amount in issue approaches ₹1 crore and your statutory auditor is aware of it, the 45-day Board reply clock under Rule 13 may already be running. Your reply to the auditor is a document that will be read by the MCA. Draft it accordingly.
• Do not file a defensive FIR without advice. Founders sometimes lodge a police complaint against a departed CFO or co-founder to get ahead of the narrative. If the underlying conduct implicates the board's own oversight, you have just created a record that a Section 213 applicant will use against you.

FAQ

Is a forensic audit report admissible in court?
It is opinion evidence, not conclusive proof. Its weight depends on the auditor's independence, the scope letter, whether you were given a hearing, and whether the underlying documents are produced. A report prepared without giving the affected person an opportunity to respond is materially weaker.

Can the NCLT order an SFIO investigation on my company?
Not directly. The NCLAT held in May 2026 that the power to assign an investigation to SFIO under Section 212 vests in the Central Government, and referred such a matter to the Secretary, MCA, for investigation through an inspector instead. The NCLT can order an investigation under Section 213; the routing to SFIO is the Central Government's call.

What shareholding do I need to force an investigation?
Not less than one-tenth of the total voting power for a company having a share capital, under Section 213(a). A person outside that threshold can still apply under Section 213(b), but must satisfy the Tribunal that the circumstances suggest fraud, misfeasance, or conduct intended to defraud creditors or members.

Can a Section 447 charge be compounded or settled?
No. Section 447 offences are excluded from compounding under Section 441, and Section 212(6) makes them cognizable with restrictive bail conditions. Settling with the complainant does not extinguish the offence.

---

For a compliance audit of your company, visit pvtltd.co

---

See Also

• "The CA handles the tax audit": What Form 3CD actually reports about your company
• "We already have a statutory auditor": why Section 138 may still require you to appoint an internal auditor
• "We're too small for an audit": What Section 139 actually requires of every Pvt Ltd