The Audit Committee's Fraud Agenda: Stop Receiving Reports and Start Testing Them

Ask an audit committee chair how the committee oversees fraud risk and the answer usually describes what the committee receives: an internal audit report, a summary of whistleblower complaints, a line in the risk register. Ask what the committee did with that information last year and the answer is often shorter.

The mandate is not the problem. Indian law gives audit committees ample authority. The problem is that fraud arrives on the agenda as a report to be noted, rather than a risk to be tested.

The mandate is already there

Under s. 177(4) of the Companies Act 2013, the audit committee's terms of reference include evaluating internal financial controls and risk management systems. Sections 177(9) and (10) put the vigil mechanism under its oversight, with direct access to the chair in appropriate cases.

For listed entities, SEBI LODR goes further. Part C of Schedule II asks the committee to review the findings of internal investigations into suspected fraud, irregularity or material failure of internal control, and report them to the board, and to review the functioning of the whistle-blower mechanism. The CEO and CFO certificate under Regulation 17(8) requires them to tell the auditors and the audit committee about significant fraud they have become aware of, including any involvement of management.

The statutory auditor has its own channel too. Under s. 143(12), suspected fraud against the company by officers or employees must be reported, and frauds below INR 1 crore go to the audit committee or board.

A fixed fraud agenda

We recommend that the committee adopts a fraud agenda with two rhythms.

Every meeting (15–20 minutes):

• new allegations received since the last meeting, by category and seniority of the person concerned;
• status of open investigations, with dates against the plan;
• significant analytics exceptions and control failures identified by internal audit;
• any matter that may trigger a disclosure, an auditor report or a regulator notification.

Once a year (a dedicated session):

• the fraud risk assessment and whether it changed the audit plan and budgets;
• speak-up data: volumes, sources, substantiation rate, time to close and treatment of reporters;
• outcomes of the year's investigations, and the control changes they produced;
• third-party and related-party risk, including the largest distributors, agents and promoter-linked counterparties;
• the investigation protocol: who investigates what, when external support is engaged, and how evidence is preserved.

Ask for data, not summaries

Summaries are written by the people being overseen. A committee that wants to test them should ask, at least occasionally, for the underlying material:

• the full complaint log rather than the dashboard;
• a sample of closed cases, with the investigation file, to check the reasoning;
• the list of policy exceptions approved by senior management;
• the exception report from journal-entry or vendor analytics, not just the conclusion that "nothing significant was found".

Reading one closed investigation file end to end tells a committee more about the quality of its investigation process than a year of status reports.

Build your own line to the truth

People closest to fraud risk often report to the people most likely to be involved in it. The committee should therefore hold a short private session, without executive management, at every meeting with the head of internal audit, and periodically with the statutory auditor and the person who runs the vigil mechanism.

These sessions should be routine. If they are only called when something is wrong, they become a signal in themselves.

What good looks like when an allegation reaches the top

When an allegation concerns the managing director, CFO, a promoter or a director, the committee should:

1. take ownership immediately and record the decision to do so;
2. appoint external counsel and independent forensic investigators who have no reporting line to the person concerned;
3. secure email, devices and finance system data before the person is told;
4. decide early whether the matter may trigger a disclosure under SEBI LODR or an auditor report;
5. receive findings directly, and decide on action as a committee, recording its reasons.

Common mistakes

• Noting rather than testing. "Noted" in the minutes is not evidence of oversight if a regulator or court later asks what the committee did.
• Letting management investigate itself. An allegation against a senior executive investigated by their own team will not be credible to anyone, including the committee.
• No forward plan. Without a fixed agenda, fraud only appears when there is a crisis, which is the worst time to design a process.
• Confusing compliance with assurance. A policy that exists is not a control that works. Ask how it was tested and what the test found.
• Leaving the auditor out. The statutory auditor will find out about serious matters. Better that it hears from the committee early than from a whistleblower later.

Where we can help

We work for audit committees in three ways: designing the fraud agenda and investigation protocol, reviewing a sample of past investigations for quality, and conducting independent investigations when allegations reach senior management. Speak to us in confidence.