Forensic Audit vs Statutory Audit: What Is the Difference and When Do You Need One?

A statutory audit is a legally required annual examination that gives an opinion on whether a company's financial statements present a true and fair view. A forensic audit is a targeted investigation of specific suspicions, transactions or people, designed to establish facts and gather evidence that can be used in disciplinary, civil, regulatory or criminal proceedings. You need a statutory audit every year; you need a forensic audit when there is a specific concern, such as a whistleblower complaint, unexplained losses, a lender's demand or a dispute.

The two are often confused because both involve accountants examining records. Their purpose, scope, standards and outputs are very different, and treating one as a substitute for the other is a common and expensive mistake.

What is a statutory audit designed to do?

Under s. 143 of the Companies Act 2013, the statutory auditor reports to shareholders on whether the financial statements give a true and fair view. The audit is conducted under ICAI's Standards on Auditing and provides reasonable assurance that the statements are free from material misstatement, whether caused by fraud or error.

Three features define its limits:

• Materiality. The auditor focuses on misstatements that could influence users of the financial statements. A fraud that is small relative to the accounts may be missed by design.
• Sampling. Most testing is on samples, not every transaction.
• Reasonable, not absolute, assurance. Even a well-planned audit may not detect fraud that involves collusion, forgery or deliberate concealment.

What does SA 240 require?

SA 240, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements, sets out how auditors address fraud risk. Auditors must maintain professional scepticism, discuss fraud risks within the engagement team, and respond to assessed risks. SA 240 treats the risk of management override of controls as present in every entity and requires specific responses, including testing the appropriateness of journal entries, reviewing accounting estimates for bias and evaluating the business rationale of significant unusual transactions. It also requires the auditor to presume a risk of fraud in revenue recognition, unless rebutted with documented reasons.

Our post on data analytics for fraud detection explains how journal-entry testing works in practice.

What happens when a statutory auditor suspects fraud?

Under s. 143(12) of the Companies Act, if an auditor has reason to believe that a fraud is being or has been committed against the company by its officers or employees, the auditor must report it. Under Rule 13 of the Companies (Audit and Auditors) Rules 2014, frauds of INR 1 crore or more are reported to the Central Government in Form ADT-4, after first going to the Board or Audit Committee for a reply. Smaller frauds are reported to the Audit Committee or Board and disclosed in the Board's report under s. 134(3)(ca). Under s. 143(15), failure to report attracts a penalty of INR 5 lakh for a listed company and INR 1 lakh for other companies.

Under CARO 2020, para 3(xi), the auditor also reports whether any fraud by or on the company was noticed, whether an ADT-4 was filed, and whether whistleblower complaints were considered.

The key point: the auditor reports a suspicion, but the statutory audit does not investigate it to conclusion. That is the job of a forensic audit or internal investigation.

What is a forensic audit?

A forensic audit applies accounting, data analysis and investigative techniques to answer specific questions: did this happen, how, who was involved, how much was lost, and where did the money go? It is a core application of forensic accounting.

Typical features:

• Defined scope set by terms of reference, often triggered by an allegation or red flag.
• Full-population testing where possible, using data analytics rather than samples.
• Evidence-led work: source documents, emails, device data, third-party confirmations, public records and interviews.
• No materiality filter. An INR 10 lakh kickback matters if it shows a pattern or a breach of trust.
• Evidential discipline, including chain of custody for documents and electronic records, so findings can withstand challenge.

Which standards apply?

ICAI's Digital Accounting and Assurance Board issued the Forensic Accounting and Investigation Standards (FAIS). ICAI announced on 27 July 2023 that they are mandatory for engagements conducted on or after 1 July 2023 by its members. They cover engagement acceptance, planning, evidence gathering, interviews, use of experts and reporting.

How does Indian regulation define it?

SEBI LODR gives a useful working definition. Schedule III, Part A, Para A, item 17 treats the initiation of a forensic audit as a deemed-material event for listed entities. The Explanation describes a forensic audit as one aimed at detecting misstatement in financial statements, misappropriation, or siphoning or diversion of funds, and excludes audits of processes such as quality, manufacturing, recruitment or procurement that would not require the financial statements to be revised. The entity must disclose the initiation and later the final report with management comments, except for audits initiated by regulators or enforcement agencies.

In banking, lenders commission forensic audits when examining red-flagged accounts. The Supreme Court held in SBI v. Amit Iron Pvt Ltd (7 April 2026) that the borrower must be given the complete forensic audit report, though no personal hearing is required before fraud classification.

Forensic audit vs statutory audit: side by side

When do you need a forensic audit?

Common triggers in India include:

1. A whistleblower complaint with specific allegations. See our guide on investigating a whistleblower complaint.
2. An auditor's s. 143(12) report or qualification that the Board must answer.
3. Unexplained variances: margins falling, inventory shrinkage, debtors that do not clear, or cash that does not reconcile.
4. Suspected financial statement fraud, such as fictitious revenue or concealed liabilities.
5. Lender requirements when an account is red-flagged, or for stressed borrowers.
6. Insolvency: resolution professionals commonly appoint transaction auditors to identify avoidance transactions, although no regulation mandates a forensic audit. See forensic audits in CIRP.
7. Disputes between shareholders, partners or joint venture parties, or arbitration involving damages.
8. Acquisitions where pre-deal red flags suggest manipulation.

The ACFE's Occupational Fraud 2026: A Report to the Nations shows why the distinction matters. Financial statement fraud appeared in only 6% of cases but had a median loss of USD 1,000,000, while asset misappropriation appeared in 90% of cases with a median of USD 100,000. Many of these losses are not material to the accounts, which is why a clean audit opinion offers limited comfort.

How should a Board commission a forensic audit?

• Decide who owns it. Usually the Audit Committee, especially if management may be implicated.
• Write terms of reference: questions to answer, period, entities, data sources and reporting line.
• Check disclosure obligations under SEBI LODR before appointment.
• Preserve data first, including ERP, email and devices.
• Consider legal counsel where litigation or regulatory action is likely.
• Check independence of the forensic firm from the people and transactions under review, and from the statutory audit.
• Agree interim reporting so urgent findings, such as continuing losses, reach the Board quickly.

Findings may also lead to action under s. 447 of the Companies Act 2013 (fraud) or the Bharatiya Nyaya Sanhita 2023. Strengthening internal controls afterwards closes the loop. For more on financial reporting manipulation, see financial statement fraud in our knowledge base.

How Spectra Forensics can help

Our forensic accounting and data analytics service covers forensic audits commissioned by Boards, Audit Committees, lenders and resolution professionals, from scoping and data analysis to reporting. For matters heading to dispute, our litigation support team works with counsel on evidence and expert reports. We have completed 1,250+ investigations with INR 2,000+ crore in financial impact over 19+ years. To discuss whether you need a forensic audit, contact us.