Forensic Reviews & Debt Monitoring

It is an independent investigation into a company's financial records and transactions, commissioned by a party other than the company — typically a lender, a consortium of lenders, or an investor — to establish facts and quantify irregularities where fraud, fund diversion, or misrepresentation is suspected. Unlike a statutory audit, which expresses an opinion on whether financial statements are true and fair based on sampling, a forensic review sets out to trace what actually happened to specific funds, transactions, or representations, with a level of evidentiary detail that can withstand scrutiny before a lender's committee, an investigating authority, or in arbitration.

Debt monitoring is an ongoing, periodic independent assessment of a borrower's financial health, fund utilisation, and covenant compliance over the life of a credit facility or structured investment — it is recurring and generally not adversarial in nature. A forensic review is typically one-time and investigative, triggered by a specific red flag, complaint, or suspected irregularity. In practice, a debt monitoring mandate can escalate into a forensic review if the periodic monitoring itself surfaces a red flag that warrants deeper investigation.

Most commonly, the lender's Fraud Monitoring Committee, a lending consortium acting under an Inter-Creditor Agreement (where multiple banks have exposure), a private equity or venture debt investor, or the Board/Audit Committee of the company itself (often following a whistleblower complaint or an auditor's observation). It is rare for a company's operating management to voluntarily commission a forensic review of its own conduct — the review is, by design, independent of the party whose conduct is under scrutiny.

Typically, an account showing Early Warning Signals (EWS) under the bank's internal EWS framework — patterns such as frequent overdrawing beyond sanctioned limits, deviation from the stated end-use of funds, non-submission or delayed submission of stock statements, disproportionate related-party transactions, or significant deterioration in financial ratios without adequate explanation. Once EWS criteria are met, RBI's Master Directions on Fraud Risk Management generally require the account to be examined, and for exposures above the thresholds prescribed in RBI's framework, an independent Forensic Audit is commissioned before a fraud classification decision is made.

RBI's Master Directions on Fraud Risk Management require banks and NBFCs to have a Board-approved fraud risk management policy, to classify EWS-flagged accounts, and to follow a defined process — including, above prescribed exposure thresholds, an independent forensic audit — before an account can be classified as fraud. Fraud-classified accounts must be reported to RBI's Central Repository of Information on Large Credits (CRILC) and, depending on the amount involved, may require reporting to investigative agencies. The precise thresholds and procedural steps are set out in RBI's current framework and are periodically updated — PNPC works from the version in force at the time of each engagement rather than a fixed historical figure.

Where a borrower has credit exposure across multiple banks or NBFCs, the lenders today coordinate through an Inter-Creditor Agreement (ICA) under RBI's Prudential Framework for Resolution of Stressed Assets, to take collective decisions on a stressed account — including whether to commission a forensic audit, how to structure a resolution plan, or whether to pursue recovery action. This ICA-based framework replaced the older Joint Lenders' Forum (JLF) mechanism, which RBI discontinued as part of its June 2019 revised framework for resolving stressed assets; borrowers and lenders who dealt with an older-generation restructuring will still recognise the JLF terminology, but current mandates are structured under the ICA. A forensic auditor appointed for a consortium-mandated review reports findings to the lenders as a whole, and the scope typically covers exposure and security across all participating lenders, not just the mandating bank's own facility.

A stock and receivables audit is a physical and documentary verification of the inventory and book debts a borrower has pledged as security for a working capital facility (cash credit, overdraft, or similar). It confirms that the stock and receivables actually exist, are correctly valued, are not obsolete or slow-moving beyond what has been disclosed, and — critically — have not been pledged as security to more than one lender simultaneously. Most banks and NBFCs require this on a periodic basis (commonly annual or half-yearly) as a standing condition of the working capital sanction, with additional ad-hoc audits triggered if the drawing power calculation looks anomalous.

Double financing occurs when the same stock or the same book debts are offered as security to more than one lender simultaneously — each lender believes it holds a first or exclusive charge over the same asset, when in fact the borrower has pledged it more than once. It is typically detected by cross-referencing hypothecation agreements and charge registrations across all lenders the borrower has facilities with (including charges registered with the Registrar of Companies and, where applicable, with CERSAI — the Central Registry of Securitisation Asset Reconstruction and Security Interest), combined with physical stock verification and a reconciliation of quantities claimed to each lender against actual on-ground inventory.

We reconstruct the actual flow of funds by tracing bank statements across all accounts the borrower operates — not just the account with the mandating lender — following specific drawdowns and receipts to their ultimate destination. Round-tripping typically shows up as funds moving to a related or connected entity and returning to the borrower (or a group company) through a different transaction shortly afterward, often disguised as a trade transaction, loan, or advance. This requires access to bank statements of the counterparties involved wherever legally obtainable, and a careful mapping of the group and related-party structure before the fund-flow analysis can be meaningfully interpreted.

The Forensic Audit Report is submitted to the mandating Fraud Monitoring Committee or lending consortium, which then decides — based on the report and any response from the borrower — whether to formally classify the account as fraud under RBI's framework, and separately, whether the promoters/directors meet the criteria for classification as Wilful Defaulters under RBI's Master Direction on Treatment of Wilful Defaulters and Large Defaulters. A fraud classification triggers reporting to RBI's CRILC database and can trigger a report to investigative agencies for amounts above the prescribed threshold. Recovery action, whether through the NCLT under the Insolvency and Bankruptcy Code or through the DRT/SARFAESI route, typically proceeds in parallel with, but independently of, the fraud classification process.

Yes, and it should be built into the process from the outset rather than treated as an afterthought. RBI's fraud classification framework, following judicial guidance, requires the borrower to be given an opportunity to respond to the forensic auditor's findings before the lender takes a final fraud classification decision. PNPC structures its forensic engagements to put material findings to management or promoters for explanation before the report is finalised — this is both procedurally sound and produces a more defensible final report, since unexplained anomalies are distinguished from ones with a legitimate business explanation.

It depends heavily on scope — the number of bank accounts and group entities involved, the volume of transactions under review, and whether physical verification (stock counts, site visits) and digital forensics are part of the mandate. A focused review on a single-entity account with a defined trigger typically takes 6–8 weeks. A full consortium-mandated review spanning multiple group entities, related-party transactions, and physical verification across locations commonly runs 8–12 weeks or longer.

Pricing depends on the number of locations to be physically verified, the volume and complexity of the inventory (raw material versus finished goods versus work-in-progress), and the size of the debtor base being sample-tested. It is typically quoted as a fixed fee per audit cycle, agreed upfront in the engagement letter, rather than a percentage of the facility amount. PNPC provides a written fee quote before any fieldwork begins, based on a short scoping call to understand the specific facility and locations involved.

End-use verification confirms that funds drawn down under a sanctioned loan facility, or a specific investment tranche, were actually applied to the purpose stated in the sanction letter or investment agreement — for example, capital expenditure, working capital, or a specific project — rather than diverted to an unrelated purpose, a related party, or a different group entity. It is commonly required at each drawdown milestone for project finance and structured debt facilities, and can also be commissioned by an investor after a funding round to confirm that capital was deployed as represented in the business plan.

A statutory audit under the Companies Act is designed to express an opinion on whether the financial statements, taken as a whole, are true and fair — it uses sampling and materiality thresholds, and Standards on Auditing (SA 240) require the auditor to consider fraud risk, but the audit is not designed or scoped to investigate a specific suspected fraud in depth. A forensic review is scoped specifically to investigate a defined concern, uses a much lower materiality threshold (often testing 100% of transactions in a specific area rather than a sample), and is documented to an evidentiary standard suitable for a committee decision, arbitration, or regulatory reporting — which a statutory audit file is not designed to be.

CRILC — the Central Repository of Information on Large Credits — is RBI's database to which banks and NBFCs report information on borrowers with aggregate credit exposure above the prescribed threshold, including classification of accounts as Special Mention Accounts (SMA) or as fraud. A fraud classification arising from a forensic audit typically results in the account being flagged in CRILC, which is visible to other lenders with exposure to the same borrower or group — meaning the consequences of a forensic finding are not confined to the mandating lender alone.

No. Independence is fundamental to a credible forensic review — a forensic auditor investigating a company's conduct cannot simultaneously be that company's statutory auditor, as this creates a direct conflict of interest and would undermine the credibility of the findings before any mandating lender, investor, or committee. PNPC conducts an independence and conflict check before accepting any forensic mandate, and we decline (or refer to an unconflicted colleague firm) any engagement where we hold an existing statutory audit, tax advisory, or other relationship with the entity under review that would compromise independence.

A Wilful Defaulter, under RBI's Master Direction on Treatment of Wilful Defaulters and Large Defaulters, is a borrower (or a promoter/director in a position of control) who has defaulted on repayment despite having the capacity to pay, has diverted or siphoned off funds for purposes other than those for which the finance was availed, has disposed of assets financed by the lender without the lender's knowledge, or has misrepresented facts to avail the credit facility. A forensic audit that establishes diversion of funds or misrepresentation is often the evidentiary basis on which a lender's internal committee evaluates whether the Wilful Defaulter criteria are met — but the classification itself follows a separate procedural process, including a show-cause opportunity for the borrower, distinct from the forensic report itself.

We agree the monitoring frequency (typically monthly or quarterly, aligned to the facility's reporting cycle), the specific covenants and financial ratios to be tracked against the sanction/investment terms, the fund-flow and end-use checks to be performed at each cycle, and an explicit escalation protocol — what threshold or anomaly triggers an immediate flag to the lender or investor rather than waiting for the next scheduled report. This is documented in the engagement letter so both the mandating party and the borrower/investee understand the monitoring scope from Day 1.

A management letter arising from a statutory audit typically flags control weaknesses or minor irregularities observed incidentally during the audit, addressed to management for correction — it is not designed to establish culpability or quantify loss. A Forensic Audit Report is a standalone, purpose-built document that sets out the specific allegation or trigger investigated, the evidence gathered, the methodology applied, the findings (including quantification where diversion or loss is established), and — where the mandate requires it — management's response to those findings. It is written to be relied upon directly by a Fraud Monitoring Committee, a lending consortium, an Audit Committee, or in subsequent legal or regulatory proceedings.

No — and this is an important point often misunderstood by companies anxious about being reviewed. A significant proportion of forensic reviews conclude that the red flags which triggered the mandate had a legitimate business explanation — a genuine cash-flow crunch caused by a customer default, a documentation lapse rather than actual diversion, or a covenant breach caused by a one-off event rather than a pattern of misconduct. The purpose of the review is to establish facts objectively; an outcome that clears the company (or specific individuals) is as valid and useful a finding as one that confirms wrongdoing.

GST returns (GSTR-1 for outward supplies, GSTR-3B for summary returns) and e-way bill data provide an independent, government-held record of a company's reported sales and goods movement — one that is much harder to manipulate after the fact than internally maintained sales registers, because it has already been filed with the tax authority. We routinely cross-verify a company's internal sales, stock, and dispatch records against its own GST filings; a material and unexplained mismatch between the two is one of the clearest indicators of either understated sales for tax purposes or overstated sales/stock in lender-facing documents — either of which is a significant finding.

In the early, preliminary phase — particularly document collection from third parties such as banks, GST records where legally accessible, and public registries — a degree of confidentiality is often maintained. However, a full forensic review invariably requires access to the company's own internal records and, in most cases, requires putting specific findings to management for their response (a step that is both procedurally required under RBI's framework in fraud-classification cases and good investigative practice generally). Complete confidentiality throughout the entire engagement is rarely achievable or even advisable — an investigation the subject is entirely unaware of also cannot benefit from the subject's explanation of anomalies that may have a legitimate cause.

PNPC's core deliverable is the Forensic Audit Report and the underlying evidence file — we are not a law firm and do not represent parties in NCLT, arbitration, or criminal proceedings. Where our findings feed into such proceedings, we typically work alongside the mandating party's legal counsel, providing clarification on our methodology and findings, and — where engaged separately for this purpose — can provide expert testimony or a supporting affidavit on the forensic evidence, coordinated closely with counsel throughout.

A bank's forensic mandate is typically reactive — triggered by an EWS flag or a stressed account — and is oriented toward the RBI fraud-classification and recovery framework. A private equity or venture investor more often commissions a forensic review proactively — as part of deeper diligence ahead of a follow-on round, before exercising a contractual right (such as a put option or an information right), or when quarterly MIS numbers diverge unexpectedly from what was represented at the time of investment. The investigative techniques are similar, but the investor's review is typically more focused on verifying financial statement integrity, related-party leakage, and whether the business plan projections shared at investment were reasonable and made in good faith.

Related-party transaction leakage refers to value moving out of a company to its promoters, their family members, or affiliated entities through transactions that are not on arm's-length terms — inflated purchase prices from a related-party vendor, understated sale prices to a related-party customer, unsecured or interest-free loans to group entities that are never realistically expected to be repaid, or management fees and consultancy charges that do not correspond to genuine services rendered. It is one of the most frequently identified issues in our forensic reviews of both stressed lending accounts and PE portfolio companies, precisely because it can persist for years without being caught by a standard statutory audit sampling approach.

A forensic review that finds no irregularity is a valid and complete outcome, and it should be documented and delivered with the same rigour as one that finds a problem. If the mandating lender has residual concerns beyond what the review's scope covered, the appropriate next step is to revisit and potentially widen the scope — additional accounts, a longer period, or a different transaction class — rather than treating the clean finding as inadequate. PNPC discusses scope adequacy openly with the mandating party at the conclusion of every engagement.

PNPC undertakes forensic review, stock audit, and debt monitoring mandates directly for banks, NBFCs, and investor groups that engage us, and works within each institution's own empanelment and engagement processes where such panels exist. Specific empanelment status varies by institution and is confirmed directly with the lender or investor at the time of engagement — prospective clients should discuss their institution's specific panel requirements with our engagement team.

Where a stressed or investigated group has both Indian and UAE operating entities — a common structure for trading and manufacturing groups with Gulf operations — PNPC coordinates the review across both jurisdictions from our Chennai/Bangalore/Hyderabad and Dubai offices under a single engagement, rather than requiring the mandating lender or investor to separately brief two unconnected firms. This matters because fund flows, related-party transactions, and even stock movement frequently cross the India-UAE boundary in exactly these cases, and a review confined to only the Indian entity will miss exactly the transactions most likely to reveal diversion.

PNPC is a practising Chartered Accountancy firm operating since 1986, with senior CAs experienced in forensic accounting, fund-flow analysis, stock and receivables verification, and structured debt monitoring across manufacturing, trading, services, and financial-sector clients. Our forensic engagements are led by senior practitioners — not delegated wholesale to junior staff — and every material finding is reviewed and signed off by a senior CA before it goes into a report relied upon by a Fraud Monitoring Committee, an investor, or, potentially, a regulator.

Forensic reviews are typically quoted on a time-and-scope basis, with the engagement letter defining the boundaries of the investigation, the deliverables, and a fee estimate based on the anticipated volume of accounts, entities, and transactions to be reviewed — with a mechanism for revising scope (and fee) if the investigation reveals a need to expand beyond the original boundaries. Stock and receivables audits, being more standardised and recurring, are typically quoted as a fixed fee per cycle. Debt monitoring is structured as a periodic retainer aligned to the agreed monitoring frequency. A written fee estimate is always provided before fieldwork begins.

An internal audit function (whether in-house or outsourced under Section 138 of the Companies Act) provides continuous, cyclical assurance over operations, compliance, and risk across the business as a whole — it is not typically designed to investigate a specific suspected fraud in depth, though it may be the source that first identifies an anomaly warranting a forensic review. A forensic review is narrower in scope but far deeper — it investigates one specific concern with an evidentiary rigour and an adversarial-ready documentation standard that routine internal audit cycles are not resourced or scoped to provide.

Yes, in principle. A well-documented Forensic Audit Report that quantifies the loss, traces the mechanism of the fraud, and identifies the responsible party can serve as supporting evidence for a fidelity guarantee or crime insurance claim, subject to the specific policy's own claim documentation requirements. We recommend involving the insurer (or the client's insurance broker/advisor) early if a claim is contemplated, so the forensic report's format and evidentiary detail align with what the specific policy requires.

Large forensic-only firms bring scale and brand recognition, but often deploy junior teams with limited direct senior-partner engagement, and can be significantly more expensive for a mid-sized mandate. PNPC brings senior-CA-led forensic work, deep familiarity with Indian regulatory frameworks (RBI fraud framework, Companies Act, GST, FEMA) and — for groups with Gulf exposure — genuine India-UAE cross-border capability from our own Dubai office, at a scope and fee structure suited to mid-market lenders, NBFCs, and investor groups rather than only the largest institutional mandates.