Internal Audit, Due Diligence, Investigation and Forensic Accounting — Practice

Question 1

A company's internal auditor examines whether the procurement department's approval workflow is efficient, whether the company's strategic risk register is being updated regularly by the risk committee, and whether a specific operational process complies with the company's own internal policy manual, none of which relates directly to the fairness of the financial statements. Explain why this scope is entirely appropriate for internal audit despite falling outside an external statutory auditor's own mandate.

Accepted Answer

Internal audit's mandate, as established under both the Companies Act, 2013 provisions requiring internal audit for specified companies and ICAI's own Standards on Internal Audit, extends well beyond financial statement assurance to encompass operational efficiency, risk management effectiveness, and governance and compliance processes generally, serving management and those charged with governance directly in their own oversight of the organisation's operations, risks, and controls; examining procurement workflow efficiency, strategic risk register maintenance, and internal policy compliance are all squarely within this broader mandate, since each addresses a genuine aspect of how well the organisation is managing its own operations, risks and governance, information management and the board genuinely need regardless of whether any of it directly affects financial statement fairness. This is precisely why internal audit's scope is, and should be, broader than an external statutory auditor's own mandate, which is specifically and narrowly focused on whether the financial statements present a fair view in accordance with the applicable financial reporting framework; the external auditor has no professional mandate, and generally no engagement scope, to examine procurement workflow efficiency or risk register maintenance practices at all, since these matters, however genuinely important to the organisation's own management, fall outside what a financial statement audit is specifically designed to address.

Question 2

A company appoints one of its own long-serving senior finance managers as its internal auditor, reporting directly to the CFO, who also happens to be the manager's own direct superior in their prior role. Explain the specific independence concern this arrangement raises, distinct from the independence concerns an external statutory auditor faces.

Accepted Answer

This arrangement raises a specific organisational independence concern distinct from the independence concerns an external statutory auditor faces, since the internal auditor here is an employee of the very organisation being audited, reporting to the CFO, who is also a member of management whose own department's activities and decisions the internal audit function may need to examine and potentially criticise; this creates a structural conflict where the internal auditor's own career progression, performance evaluation, and reporting relationship depend on the goodwill of the very management the internal audit function is meant to provide independent oversight of, a fundamentally different kind of independence threat than the market-based, engagement-specific independence concerns (financial interest, undue familiarity from a long client relationship) an external statutory auditor, who is not an employee of the audited entity at all, typically faces. Best practice, reflected in ICAI's own Standards on Internal Audit and broader corporate governance norms, generally recommends that the internal audit function report functionally to the audit committee or board, rather than solely and directly to an executive such as the CFO whose own department's activities internal audit may need to examine, precisely to mitigate this specific organisational independence concern; reporting solely to the CFO in this scenario risks the internal auditor's findings and recommendations being filtered, softened, or suppressed specifically where they touch on matters the CFO would prefer not to have surfaced to the board or audit committee directly.

Question 3

A company being acquired has financial statements carrying an unmodified audit opinion, correctly reflecting all recognised transactions in accordance with the applicable financial reporting framework, but a due diligence review reveals that 35% of the company's reported revenue comes from a single customer relationship governed by a contract expiring in six months with no indication of renewal, a fact not required to be disclosed under the applicable accounting standards. Explain why this is exactly the kind of risk a due diligence review is specifically designed to surface, distinct from what the financial statement audit addressed.

Accepted Answer

The financial statement audit's objective was to assess whether the historical financial statements, as presented, fairly reflect the company's financial position and performance for the periods covered, in accordance with the applicable financial reporting framework's specific recognition, measurement and disclosure requirements; since customer concentration and contract expiry risk of this specific kind is not necessarily a required disclosure item under the applicable accounting standards, the audit correctly and appropriately did not flag it, and the resulting unmodified opinion is entirely accurate regarding what it was actually designed to assess, the fair presentation of historical financial information. A due diligence review, by contrast, is specifically designed to inform a prospective acquirer's forward-looking decision about whether to proceed with the transaction, at what price, and on what terms, and this requires examining precisely the kind of forward-looking, qualitative business risk a backward-looking financial statement audit is not designed to address at all: a 35% revenue concentration in a single customer relationship, governed by a contract expiring in six months with no indication of renewal, represents a potentially severe risk to the company's future sustainability and earning power, information an acquirer absolutely needs before committing to a purchase price based on the company's historical earnings, but information a financial statement audit, focused on the fair presentation of the past rather than the sustainability of the future, was never designed or intended to surface; this is precisely the gap due diligence exists to fill, examining the target's genuine commercial sustainability and risk profile beyond what historical financial statement fairness alone can reveal.

Question 4

A company's shareholders suspect a specific director has been diverting company funds to a personal account through a pattern of unusual payments over the past two years, and commission a specific inquiry into this suspicion. Explain how the scope and depth of this specific inquiry would differ from an ordinary annual statutory audit covering the same two-year period.

Accepted Answer

An ordinary annual statutory audit covering this two-year period would have applied a standardised, general-purpose audit scope across the company's entire set of financial statements and transactions, using materiality thresholds and risk-based sampling designed to provide reasonable assurance about the fairness of the financial statements as a whole, meaning the specific payments in question, if individually below the materiality threshold applied and not otherwise flagged by the audit's general risk assessment procedures, could plausibly have been tested only as part of a broader sample, or possibly not specifically examined at all if they did not happen to fall within whatever sample or specific procedures the audit's overall risk-based approach directed attention toward. The specific inquiry commissioned here, by contrast, has a narrow, specifically defined scope, focused entirely and intensively on this one specific suspected pattern, allowing the investigator to examine every relevant payment in complete detail regardless of individual materiality, trace the full pattern and destination of funds across the entire two-year period specifically and exhaustively, and pursue lines of inquiry (bank account ownership verification, correspondence review, interviews) an ordinary financial statement audit, constrained by its own broader scope and overall time and cost budget across the entire audit, would never have had reason or resources to pursue for this one specific matter; this illustrates precisely why an investigation, though narrower in overall scope than a full audit, can be, and typically is, considerably more intensive and probing within that specific, narrower scope than an ordinary audit's general-purpose procedures would ever be for any single, specific matter.

Question 5

One investigator is appointed by a company's own board under its internal authority to look into a specific matter; a second investigator is appointed under a specific statutory provision empowering a government authority to investigate the affairs of the same company. Explain why these two investigators are likely to have materially different powers to compel cooperation and production of documents.

Accepted Answer

The first investigator, appointed by the company's own board acting under its internal, private authority to commission an inquiry, derives their authority entirely from the company's own internal governance decision to commission the investigation, and their actual power to compel cooperation and document production is limited to whatever internal cooperation the board's own authority can secure from the company's own employees and records, with no independent legal power to compel production from unwilling third parties or to override an employee's own refusal to cooperate beyond what internal disciplinary consequences the board might itself choose to impose. The second investigator, appointed under a specific statutory provision empowering a government authority to investigate a company's affairs, typically carries specific legal powers granted directly by that statute, potentially including the power to compel production of documents, to require individuals to appear and answer questions under a legal obligation to do so, and to access records the company or its officers might otherwise be reluctant to voluntarily provide, backed by legal sanctions for non-compliance that a purely privately-commissioned investigation, appointed under the company's own internal authority alone, simply does not carry; this difference in the source and legal backing of the appointment is precisely why an investigator's actual powers and standing must be assessed individually, based on the specific terms and legal source of that particular appointment, rather than assumed to be uniform across every investigation engagement regardless of how it was commissioned.

Question 6

A forensic accountant is engaged to examine suspected financial statement fraud at a company, in anticipation that the findings may need to be presented as evidence in a criminal prosecution. Explain why the forensic accountant's approach to documenting and preserving evidence must be materially more rigorous than an ordinary statutory auditor's approach to working papers, and give one specific example of this heightened rigour in practice.

Accepted Answer

An ordinary statutory auditor's working papers are prepared to support the auditor's own conclusion and to withstand professional peer review or regulatory inspection, a context where the working papers' preparer and the reviewer generally share a common professional framework and are not typically engaged in an adversarial process specifically designed to challenge and undermine the reliability of the evidence itself. A forensic accountant's work, anticipating that findings may be presented as evidence in a criminal prosecution, must be prepared to withstand adversarial cross-examination by opposing legal counsel specifically motivated to attack the reliability, completeness, and integrity of the evidence and the process by which it was gathered, a materially more demanding evidentiary context requiring correspondingly more rigorous documentation and preservation practices to ensure the evidence remains legally admissible and persuasive despite this adversarial challenge. One specific example of this heightened rigour is maintaining a documented, unbroken chain of custody for every piece of physical or digital evidence gathered, recording precisely who handled the evidence, when, and under what conditions, from the moment it was first obtained through to its ultimate presentation, specifically to be able to demonstrate, if challenged in court, that the evidence was not tampered with, altered, or compromised at any point during the engagement; an ordinary statutory audit's working papers, while carefully maintained for professional purposes, are not typically built around this same formal, legally-oriented chain-of-custody discipline, since they are not generally anticipated to be subjected to the same adversarial legal challenge forensic evidence must specifically be prepared to withstand.

Question 7

During a routine audit, the auditor notices that a mid-level procurement manager, whose salary is publicly known to be modest, has recently purchased a very expensive car and taken multiple international holidays, and separately notices this same manager has consistently resisted proposals to introduce a second-level approval requirement for purchase orders above a certain value, insisting it would slow down operations unnecessarily. Explain why these observations, taken together, could reasonably prompt a referral for a specific investigation, connecting them to recognised fraud indicators.

Accepted Answer

These two observations, taken together, align with recognised indicators of fraud risk: an employee appearing to live conspicuously beyond what their known, modest salary could reasonably support is a classic and well-documented behavioural red flag associated with possible undisclosed illicit income, since a legitimate salary alone would not typically explain this pattern of spending, and while there could be innocent explanations (inherited wealth, a spouse's independent income), the pattern alone reasonably warrants further inquiry rather than being dismissed without any consideration. The manager's consistent, specific resistance to introducing a second-level approval requirement for purchase orders is itself a further, distinct red flag, since resistance to the introduction of a segregation-of-duties or additional-oversight control, particularly from an individual whose own role and authority that specific control would directly constrain, can indicate a deliberate desire to preserve unchecked personal authority over transactions this individual may be exploiting for personal gain, rather than a genuine, good-faith operational efficiency concern. Neither observation alone might necessarily justify a full investigation, but the two together, an unexplained pattern of conspicuous spending inconsistent with known income, combined with active resistance to precisely the kind of additional control that would constrain this individual's own unchecked authority over the specific process (procurement) where such spending could plausibly originate, together constitute exactly the kind of combined behavioural and control-related indicator pattern that reasonably warrants escalation to a specific, targeted investigation into this manager's procurement-related activities and transactions.

Question 8

Explain why an investigation report, unlike a statutory audit opinion, does not follow a standardised format governed by a single reporting standard applicable to every investigation, and what instead determines its structure and content.

Accepted Answer

A statutory audit opinion follows a standardised format, governed by SA 700 and related standards, precisely because every statutory audit shares the same fundamental, standardised objective, expressing an opinion on whether general purpose financial statements are fairly presented in accordance with a common applicable financial reporting framework, and this shared, common objective across every audit engagement is what makes a single, standardised reporting format both appropriate and genuinely comparable across different audits and different entities. An investigation, by contrast, is a specific-purpose examination undertaken in response to a particular suspicion, allegation, or need, and its scope and objective are defined individually, case by case, by the specific terms of reference agreed for that particular engagement, meaning what one investigation is asked to examine and report on can differ enormously from what another, entirely separate investigation is asked to address; since investigations do not share a single, common underlying objective the way every statutory audit does, no single standardised reporting format could sensibly apply across all of them, and instead, the specific terms of reference for each individual investigation, together with the specific findings that particular inquiry actually uncovers, determine the structure and content of that investigation's own report, tailored to directly and specifically answer the particular questions that specific engagement was commissioned to address.

Question 9

Explain the general criteria used under the Companies Act, 2013 to determine which classes of companies are required to appoint an internal auditor, and why size-based, rather than universal, criteria are used for this requirement.

Accepted Answer

The Companies Act, 2013 mandates internal audit for specified classes of companies based on thresholds such as paid-up capital, turnover, outstanding loans or borrowings, and outstanding deposits, meaning only companies crossing certain specified size or scale thresholds are legally required to maintain an internal audit function, rather than every company regardless of size being subject to this requirement. Size-based criteria, rather than a universal requirement applying to every company, are used because the cost and administrative burden of maintaining a dedicated internal audit function is more easily justified, and more clearly proportionate to the benefit obtained, for larger, more complex organisations where the scale of operations, the volume of transactions, and the corresponding risk of undetected operational or control failures is genuinely significant, whereas imposing the same mandatory internal audit requirement on every small company regardless of size would impose a disproportionate compliance cost relative to the modest scale of risk such smaller entities typically present, reflecting a deliberate regulatory balancing of governance benefit against compliance cost calibrated to company size.

Question 10

Explain what an 'audit trail' (edit log) feature in accounting software is specifically meant to capture, and why an internal auditor should specifically verify that this feature has not been disabled, rather than merely confirming the software has the capability.

Accepted Answer

An audit trail, or edit log, feature in accounting software is meant to capture a complete, chronological record of every change made to accounting records, including who made the change, what specifically was changed, and when the change was made, creating a genuine, tamper-evident history of how each transaction or entry has been modified over time rather than only showing the final, current state of the records with no visibility into their prior history or how they came to be modified. An internal auditor should specifically verify that this feature has not been disabled, rather than merely confirming the software technically has the capability to maintain such a log, because the mere existence of the capability provides no assurance at all if the feature has, in practice, been switched off, whether inadvertently or, more concerningly, deliberately by someone specifically wishing to make unauthorised or improper changes to accounting records without leaving any traceable record of having done so; verifying the feature is genuinely active and cannot be disabled by ordinary users without detection is precisely the kind of control-operation verification internal audit exists to perform, since a control that exists in theory but has been disabled in practice provides no genuine protection whatsoever, and a disabled audit trail specifically removes exactly the kind of evidence that would otherwise reveal improper post-entry manipulation of the accounting records.

Question 11

A prospective new partner considering joining an existing partnership firm commissions an investigation into the firm's financial position before committing capital and joining. Explain what such an investigation would specifically focus on, distinct from what an ordinary audit of the firm's financial statements would address.

Accepted Answer

An investigation on behalf of an incoming partner would specifically focus on matters directly relevant to the prospective partner's decision to join and commit capital, going beyond the ordinary audit's focus on whether the firm's historical financial statements are fairly presented; this typically includes verifying the genuine, realisable value of the firm's assets (rather than merely their book value, which may not reflect true current worth), assessing the reliability and sustainability of the firm's reported profit trend and its underlying sources (distinguishing recurring, sustainable earnings from one-off or unusual gains that inflated a particular period's reported profit), examining the firm's existing liabilities, including any contingent liabilities or undisclosed commitments not fully apparent from the financial statements alone, evaluating the capital and current accounts of existing partners to understand exactly what stake and terms the incoming partner would actually be joining on, and assessing the reputation, capability and stability of the existing partners and client relationships the incoming partner would be entering into a shared, joint responsibility with. This differs from an ordinary audit's narrower focus on historical financial statement fairness because the incoming partner's decision depends on a forward-looking assessment of what they are genuinely joining, its true value, sustainability, and risks, precisely the same forward-looking, decision-support orientation that distinguishes due diligence generally from an ordinary backward-looking financial statement audit.

Question 12

An investigation confirms that a company's finance manager misappropriated ₹15 lakh over two years through falsified expense claims. Explain the range of possible follow-up actions the company might pursue, and the factors that would influence which specific action, or combination of actions, is chosen.

Accepted Answer

Possible follow-up actions range from internal disciplinary action, such as termination of employment, which addresses the company's own internal employment relationship with the individual but does not itself recover any misappropriated funds or impose any broader legal consequence; civil recovery proceedings, pursuing a civil lawsuit against the individual to recover the misappropriated ₹15 lakh, which addresses the company's financial loss directly but requires the individual to actually have recoverable assets and involves its own cost and time to pursue through the civil courts; and criminal referral, reporting the matter to law enforcement authorities for criminal prosecution, which can result in criminal penalties against the individual but does not itself guarantee recovery of the misappropriated funds and depends on the criminal justice system's own separate process and timeline. The factors influencing which specific action or combination is chosen include the strength and quality of the evidence gathered during the investigation (criminal prosecution typically requires evidence meeting a higher standard of proof than civil recovery or internal disciplinary action), the individual's apparent ability to actually satisfy a civil judgment (pursuing expensive civil litigation against someone with no recoverable assets may not be commercially worthwhile even if the underlying claim is strong), the company's own risk appetite and reputational considerations regarding pursuing public criminal or civil proceedings, and whether the company genuinely prioritises recovery of funds, deterrence of future misconduct, or both, in deciding how to proceed; in practice, companies often pursue a combination, such as immediate termination alongside civil recovery efforts, with criminal referral considered separately based on the severity and the company's own broader policy toward reporting such matters to law enforcement.

Question 13

Explain why ICAI has issued a separate body of Forensic Accounting and Investigation Standards, distinct from the Standards on Auditing, rather than simply extending the existing Standards on Auditing to cover forensic and investigation engagements as well.

Accepted Answer

The Standards on Auditing are built around the specific objective and context of a statutory audit, expressing reasonable assurance on general purpose financial statements prepared under an applicable financial reporting framework, addressed to a broad range of financial statement users, and following a standardised methodology (planning, risk assessment, evidence gathering, reporting) calibrated to that specific objective and context; forensic accounting and investigation engagements have a fundamentally different objective and context, addressing a specific, often narrowly defined suspicion or dispute, frequently oriented toward evidence that must withstand adversarial legal scrutiny in litigation or a formal disciplinary or regulatory proceeding, a context the Standards on Auditing were never designed to address and do not adequately cover, particularly regarding matters specific to this different context such as evidence chain-of-custody preservation, engagement acceptance considerations specific to potential litigation involvement, and reporting standards appropriate to findings that may be directly relied upon as legal evidence rather than as a professional opinion addressed to ordinary financial statement users. Issuing a separate, purpose-built body of standards specifically addressing forensic accounting and investigation's own distinct objectives, evidentiary requirements, and professional considerations, rather than attempting to stretch the existing Standards on Auditing, built around and calibrated to an entirely different engagement type and purpose, to also cover this materially different context, ensures practitioners performing forensic and investigation work have guidance genuinely tailored to the actual demands and risks of that specific type of engagement.

Question 14

A bank considering extending a large term loan to a company commissions an investigation into the company's financial position before approving the loan. Explain what specific aspects such an investigation would focus on that are particularly relevant to a lender's perspective, distinct from what an equity investor's due diligence might emphasise.

Accepted Answer

An investigation commissioned for a lender considering a term loan would particularly focus on the company's genuine debt servicing capacity, examining the reliability and sustainability of cash flow generation specifically available to service interest and principal repayment obligations over the loan's tenure, the company's existing debt levels and any covenants or security already granted to other lenders that could affect the new lender's own priority and recovery position, the quality and realisable value of any assets the company proposes to offer as security for this specific loan, and the company's overall financial stability and resilience to adverse scenarios that could impair its ability to service the proposed debt over the loan's full term. This differs somewhat in emphasis from what an equity investor's due diligence might prioritise, since an equity investor is primarily concerned with the company's overall growth potential, competitive positioning, and total enterprise value creation prospects over a potentially open-ended holding period, sharing fully in both the upside and downside of the company's performance, whereas a lender's own economic interest is fundamentally different and more asymmetric: a lender does not participate in any upside beyond the fixed interest agreed, but bears the downside risk of non-repayment directly, meaning a lender-focused investigation appropriately emphasises debt servicing capacity, security and recovery position, and downside resilience considerably more heavily than an equity investor's own due diligence, which places comparatively greater weight on long-term growth and value-creation potential.

Question 15

Explain why an investigation report's confidentiality and distribution are typically far more restricted than a statutory audit report's, connecting this to the different purposes the two types of report serve.

Accepted Answer

A statutory audit report is specifically prepared to be addressed to, and relied upon by, a broad class of financial statement users, typically the company's shareholders and, in practice, various other external stakeholders who may reasonably rely on audited financial statements, reflecting the audit's own broad, general-purpose objective of providing assurance on the fair presentation of financial statements to this wide range of intended users. An investigation report, by contrast, is prepared specifically for whoever commissioned the inquiry, addressing the specific, often sensitive questions that party wanted answered, frequently involving allegations against specific named individuals, confidential commercial information, or matters that could have serious reputational, legal, or personal consequences for those involved if disclosed more broadly than strictly necessary; given this specific, narrow, often sensitive purpose, investigation reports are typically treated with considerably more restricted confidentiality and distribution than a statutory audit report, shared only with the commissioning party and any other parties specifically entitled to receive it under the terms of the engagement, precisely because the investigation's findings, unlike an audit opinion's broad, standardised assurance conclusion meant for wide distribution, are tailored to a specific purpose and could cause disproportionate harm, or breach confidentiality obligations to the individuals investigated, if distributed more widely than the specific purpose for which the investigation was commissioned genuinely requires.

Practice — Internal Audit, Due Diligence, Investigation and Forensic Accounting

Sign in to save attempts to your dashboard and track your accuracy over time

Find a verified tutor

Join a live course

Browse coaching centres

About

Categories

Support

Documentation

Get Study Tips & Updates

Download Our App

Download for iOS

Download for Android

Popular Cities