When the Auditor Asks: Handling Section 143(12) and Regulators Without Losing Control of the Facts

For many Indian boards, the moment a fraud matter becomes serious is not when the allegation arrives but when the statutory auditor writes to say it has reason to believe that a fraud is being or has been committed. From that point the company is working to someone else's clock.

How the board handles that moment, and the parallel questions about stock exchanges, lenders and regulators, often shapes the outcome more than the underlying facts.

The auditor's duty and timetable

Section 143(12) of the Companies Act 2013 requires the auditor, if in the course of its duties it has reason to believe that an offence of fraud is being or has been committed against the company by its officers or employees, to report it. Rule 13 of the Companies (Audit and Auditors) Rules 2014 sets the process. For suspected fraud of INR 1 crore or more:

1. the auditor reports to the board or audit committee immediately, and within 2 days of knowledge, seeking its reply or observations within 45 days;
2. within 15 days of receiving the reply, it forwards its report, the reply and its comments to the Central Government on Form ADT-4;
3. if no reply arrives within 45 days, it forwards the report anyway, with a note to that effect.

Frauds below INR 1 crore are reported to the audit committee or board, and the company discloses them in the board's report under s. 134(3)(ca). Auditors who fail to comply face penalties under s. 143(15). Our knowledge base entry on s. 143(12) reporting covers CARO 2020 and NFRA's position in more detail.

Forty-five days is not long to establish facts in a complex matter. A reply that says only "we are investigating" will be forwarded as it stands.

Our view: engage, do not manage

Boards sometimes see the auditor's query as something to contain. That instinct is understandable and almost always counterproductive. The auditor has a statutory duty, professional standards to meet under SA 240, and its own regulators watching. It cannot be talked out of reporting, and attempts to do so will be remembered.

The better approach is to make the auditor's job easier by giving it reliable facts quickly:

• acknowledge promptly, and confirm that the audit committee, not management, owns the response;
• share the investigation plan: who is investigating, their independence, the scope and the timetable;
• give access to the evidence the auditor reasonably needs, structured with counsel to protect legal advice;
• reply substantively within the 45 days, stating what has been established, what has not and what is still being examined;
• update as the investigation progresses, especially if the picture changes materially.

A reply that is specific, evidence-based and candid about uncertainty is the company's best opportunity to shape what goes to the Central Government.

The other audiences

Stock exchanges

For listed entities, SEBI LODR treats certain events as deemed material, including fraud or defaults by the listed entity, its promoters, directors or key managerial personnel, and the initiation of a forensic audit aimed at detecting misstatement, misappropriation or siphoning of funds. The final forensic audit report must later be disclosed with management's comments, unless a regulator or enforcement agency initiated the audit. Decide early, with counsel and the company secretary, whether and when disclosure is required, and draft it narrowly and accurately.

Lenders

Loan agreements often require notice of material events, frauds or investigations. Under the RBI's fraud risk management directions, banks run their own early-warning and red-flagging processes, and a borrower that is open with its lenders is better placed than one whose lenders learn of a problem elsewhere. See our article on the RBI fraud risk management directions.

Insurers, sector regulators and the police

Check policy notification periods, sector-specific reporting duties and the case for a criminal complaint. Each is a deliberate decision, best taken with counsel and recorded.

Decision points for the audit committee

1. Who owns external communication, and who speaks to the auditor?
2. What can be said now, and what must wait for facts?
3. Is a forensic audit being initiated within the LODR meaning, and if so, what must be disclosed?
4. How will facts be shared without waiving privilege over legal advice?
5. What is the timetable to a substantive reply within 45 days?

Common mistakes

• Reassurance instead of facts. "Management has confirmed there is no issue" will not satisfy an auditor or a regulator.
• Letting the subject brief the auditor. If a senior executive is implicated, they must not be the auditor's point of contact.
• Over-disclosing early. Announcing conclusions before the facts are established creates corrections later.
• Under-disclosing. Treating a deemed-material event as immaterial invites regulatory action.
• Missing the 45 days. Silence is forwarded as silence.

Where we can help

We run independent forensic audits and investigations on the timetable that s. 143(12) creates, and help audit committees prepare substantive, evidence-based replies to auditors and regulators. Speak to us in confidence.