What is auditor fraud reporting under section 143(12) of the Companies Act 2013?

Section 143(12) of the Companies Act 2013 imposes a direct reporting duty on a company's statutory auditor. If, in the course of performing audit duties, the auditor has reason to believe that a fraud is being or has been committed against the company by its officers or employees, the auditor must report it, either to the Central Government or to the company's audit committee or board, depending on the amount involved.

It is one of the few provisions that requires an auditor to report outside the company. It sits alongside the auditor's responsibilities under SA 240 on fraud in an audit of financial statements, and the separate reporting requirements of CARO 2020.

How does the reporting procedure work?

The procedure is set out in Rule 13 of the Companies (Audit and Auditors) Rules 2014, as amended in December 2015.

Fraud of INR 1 crore or more (involved or expected to be involved, individually):

1. The auditor reports to the board or audit committee immediately, and in any case within 2 days of gaining knowledge, seeking a reply or observations within 45 days.
2. Within 15 days of receiving the reply, the auditor forwards the report, the reply and the auditor's comments to the Central Government.
3. If no reply arrives within 45 days, the auditor forwards the report anyway, with a note to that effect.
4. The report is filed on Form ADT-4, addressed to the Secretary, Ministry of Corporate Affairs.

Fraud below INR 1 crore: the auditor reports to the audit committee or board within 2 days, stating the nature of the fraud, the approximate amount and the parties involved. No ADT-4 is filed. The company must disclose these frauds in its board's report under s. 134(3)(ca).

Section 143(14) extends the same duty to cost auditors and secretarial auditors.

What does CARO 2020 add?

The Companies (Auditor's Report) Order 2020, applicable from financial years beginning on or after 1 April 2021, requires the auditor to report in clause 3(xi):

• (a) whether any fraud by the company, or on the company, was noticed or reported during the year, with its nature and amount;
• (b) whether a report under s. 143(12) has been filed on Form ADT-4 with the Central Government; and
• (c) whether the auditor has considered whistle-blower complaints received by the company during the year.

Clause 3(xi)(a) is wider than s. 143(12), because it covers fraud by the company as well as against it. Clause 3(xi)(c) links the audit directly to the company's vigil mechanism.

What are the penalties and regulatory expectations?

Section 143(15), as substituted by the Companies (Amendment) Act 2020, imposes a penalty of INR 5 lakh for a listed company and INR 1 lakh for any other company where an auditor fails to comply with s. 143(12).

NFRA's circular of 26 June 2023 takes the view that auditors must file ADT-4 even if the suspected fraud was first detected by management or others, and that resigning does not end the duty. Some industry bodies contest the first point. ICAI's Revised Guidance Note of February 2016 gives practical direction to members.

How does this affect companies?

An auditor's report under s. 143(12) has immediate consequences. The board or audit committee has 45 days to respond with its observations, which in practice means establishing facts quickly. Companies commonly commission an independent forensic audit to investigate the matter, quantify any loss and identify control failures. For listed companies, initiation of a forensic audit is itself a deemed-material event under SEBI LODR.

Typical matters that trigger reporting include financial statement fraud, fictitious vendors, misappropriation of cash or inventory, and override of internal controls by senior management.

How does it differ from related terms?

Section 143(12) concerns fraud against the company by its officers or employees, reported by the auditor. CARO 3(xi) is a broader disclosure in the audit report. SEBI LODR disclosures are obligations of the listed company itself, not the auditor. A forensic audit is the investigation that often follows. For the difference between the two kinds of audit, see forensic audit vs statutory audit.

Spectra Forensics' forensic accounting and data analytics service covers investigations commissioned by boards and audit committees in response to auditor fraud reports.