Skip to content
Spectra Forensics, Investigation Specialist

Regulatory framework · Detecting and reporting fraud

Fraud reporting and auditor obligations

An auditor suspects fraud: who must report what, to whom, and by when?

Spectra Forensics7 laws and regulators

Short answer

Once an auditor has reason to believe that officers or employees are committing fraud in the company, section 143(12) of the Companies Act 2013 starts a clock. For fraud of ₹1 crore or more, the auditor reports to the board or audit committee within two days, the company has 45 days to reply, and the auditor then files Form ADT-4 with the Central Government. Smaller frauds go to the audit committee and the board’s report. A listed company may separately have to tell the stock exchanges within hours.

The landscape

Laws and regulators in play

Companies Act 2013 (s.143(12) to (15))
Requires statutory, cost and secretarial auditors to report suspected fraud in the company by its officers or employees, protects good-faith reporting, and penalises failure to report.
Companies (Audit and Auditors) Rules 2014 (rule 13), as amended in 2025
Sets the ₹1 crore threshold, the 2-day, 45-day and 15-day steps, and, since 14 July 2025, electronic filing of Form ADT-4.
Companies Act 2013 (s.177) and the board’s report
Gives the audit committee the role of receiving below-threshold reports and overseeing the vigil mechanism; the board’s report discloses those frauds.
Companies (Auditor’s Report) Order 2020, clause 3(xi)
Requires the auditor to report on frauds noticed or reported in the year, whether ADT-4 was filed, and whether whistle-blower complaints were considered. Applies from financial years beginning on or after 1 April 2021.
SEBI LODR Regulations 2015 (Reg 30 and Schedule III, Part A)
Treat fraud by the listed entity, its promoters, directors, key managerial personnel, senior management or subsidiary, and the initiation and outcome of a forensic audit, as disclosures made without any materiality test.
Companies Act 2013 (ss.140(5), 447) and NFRA (s.132(4))
Allow the Tribunal to order a change of an auditor who colluded in fraud, set the punishment for fraud, and let NFRA discipline auditors of listed and large companies.
Chartered Accountants Act 1949 (Second Schedule)
Treats failure to report a known material misstatement, and gross negligence, as professional misconduct for ICAI members.

Step by step

Decision framework

  1. 01

    Is there ‘reason to believe’?

    Suspicion grounded in audit evidence, not proof. The trigger is fraud being or having been committed in the company by officers or employees. Fraud by outsiders alone does not trigger s.143(12), though it may need reporting elsewhere.

  2. 02

    Size it: at or above ₹1 crore?

    The threshold applies to each fraud, measured by the amount involved or expected to be involved. Above it, the Central Government route applies; below it, the audit committee route.

  3. 03

    Report to the board or audit committee within two days

    For the larger frauds, the auditor sends the matter immediately, and in any case within two days of knowledge, asking for a reply within 45 days. For smaller frauds, the report to the audit committee or board within two days sets out the nature, approximate amount and parties involved.

  4. 04

    Company investigates and replies

    The 45 days is the company’s window to establish facts, often through a forensic review, and give the auditor a considered response. A reply that is defensive or vague usually prolongs the matter.

  5. 05

    Auditor files Form ADT-4

    Within 15 days of the reply, or of the 45 days expiring without one, the auditor forwards the report, the reply and observations to the Central Government, now electronically in Form ADT-4.

  6. 06

    Run the listed-company disclosure in parallel

    Fraud by the entity or its senior people, and the start of a forensic audit aimed at misstatement or diversion of funds, are Reg 30 events. These clocks run in hours and do not wait for the s.143(12) process.

  7. 07

    Close the loop in the annual report

    The board’s report discloses below-threshold frauds, and the auditor’s CARO report covers frauds noticed, ADT-4 filings and whistle-blower complaints considered.

Duties and deadlines

Who must do what, and by when

  • Statutory auditor (and cost or secretarial auditor)

    Report suspected fraud of ₹1 crore or more to the board or audit committee, seeking a reply.

    By whenImmediately, and within 2 days of knowledge

    Companies Act s.143(12), (14); Rule 13(2)

  • Board or audit committee

    Reply to the auditor with its observations.

    By whenWithin 45 days

    Rule 13(2)

  • Auditor

    Forward the report, the company’s reply and the auditor’s comments to the Central Government in Form ADT-4.

    By whenWithin 15 days of the reply, or of the 45 days lapsing

    Rule 13(2), as amended 2025

  • Auditor

    Report fraud below ₹1 crore to the audit committee, or the board where there is none.

    By whenWithin 2 days of knowledge

    Rule 13(3)

  • Board

    Disclose below-threshold frauds reported by the auditor: nature, approximate amount, parties if no remedial action taken, and remedial action.

    By whenIn the next board’s report

    s.143(12) second proviso; Rule 13(4)

  • Listed entity

    Disclose fraud by the entity, its promoter, director, KMP, senior management or subsidiary, with nature, estimated impact, persons involved, amount and whether reported to authorities.

    By whenWithin 12 hours if it arises within the entity, 24 hours otherwise; 30 minutes for board decisions

    SEBI LODR Reg 30(6); Schedule III Part A item 6

  • Listed entity

    Disclose the initiation of a forensic audit (who initiated it and why) and later the final report with management’s comments, unless initiated by a regulator or enforcement agency.

    By whenOn initiation, and on receipt of the final report

    SEBI LODR Schedule III Part A item 17

  • Auditor

    Report on frauds noticed or reported, ADT-4 filings and whistle-blower complaints considered.

    By whenIn the audit report for the year

    CARO 2020 clause 3(xi)

Analysis

How the regimes interact

Why this question matters

Section 143(12) turns the statutory auditor into a reporting channel to the government. That changes the dynamics inside a company the moment an auditor voices a concern. Boards that treat the auditor's letter as a negotiation lose the 45 days they have to understand what happened; boards that commission an independent review straight away usually reply with facts, and the report that goes to the Central Government reflects that. For listed companies, the same facts may already have triggered a stock-exchange disclosure measured in hours.

How the regimes interact

Two clocks that do not wait for each other. The Companies Act clock runs from the auditor's knowledge; the SEBI clock runs from when the listed entity becomes aware of a disclosable event. A board can be inside its 45-day reply window under rule 13 and already late on Reg 30. Treat them as separate workstreams with a single fact base.

The auditor's duty and the company's investigation are distinct. The auditor reports suspicion; the company establishes facts. An investigation run or controlled by the people under suspicion will weaken both the reply to the auditor and any later defence. The audit committee is the natural owner, because rule 13 already routes below-threshold reports to it and section 177 gives it oversight of the vigil mechanism.

Forensic audit is both a tool and a disclosure trigger. For a listed company, initiating a forensic audit aimed at misstatement or diversion of funds is itself a Schedule III event, and the final report must later be disclosed with management's comments. Scope and terms of reference should be written with that disclosure in mind.

Professional exposure follows the public one. An auditor who stays silent faces the section 143(15) penalty and may face NFRA or ICAI proceedings: NFRA can impose monetary penalties and debar auditors of listed and large companies for six months to ten years. That is why auditors increasingly report early, and why companies should expect them to.

How Spectra Forensics can help

We run independent forensic accounting reviews inside the 45-day window and support audit committees through fraud investigations. Speak to us in confidence.

Warning signs

Red flags

  • Management asks the auditor to ‘hold off’ until an internal review is finished.
  • The audit committee learns of a suspected fraud from the auditor rather than from management.
  • A forensic review is commissioned without a written scope or with the suspected people overseeing it.
  • The company’s 45-day reply restates management’s position without new evidence.
  • Whistle-blower complaints on the same subject were closed without investigation.
  • An auditor resigns mid-year citing lack of information.

Checklist

What good looks like

  • A written protocol, approved by the audit committee, for handling an auditor’s s.143(12) report.
  • An audit committee member or independent director named to receive auditor fraud reports out of hours.
  • A pre-agreed panel or process for appointing an independent forensic reviewer within days, not weeks.
  • A disclosure decision log for Reg 30, with timestamps, kept alongside the investigation file.
  • Reconciliation each year between ADT-4 filings, board’s report disclosures, CARO 3(xi) and the whistle-blower register.
  • Evidence preserved from the day of the report: email, ERP logs and devices of the people involved.

Myths and corrections

Common misreadings

Misreading

The auditor must be sure there is fraud before reporting.

Better reading

The test is reason to believe, not proof. Waiting for certainty is itself a risk for the auditor, who faces a penalty for failing to report.

Misreading

Reporting to the Central Government is the company’s job.

Better reading

The duty under s.143(12) sits with the auditor. The company’s role is to reply within 45 days.

Misreading

Frauds below ₹1 crore are not reportable.

Better reading

They go to the audit committee or board within two days and must be disclosed in the board’s report.

Misreading

The listed entity can wait for the auditor’s process before disclosing.

Better reading

SEBI’s disclosure clocks run separately and in hours. The s.143(12) timeline does not postpone a Reg 30 disclosure.

For the board pack

Takeaways

  • 01Section 143(12) runs on a fixed clock of 2, 45 and 15 days, and the company controls only the middle part.
  • 02Use the 45 days to establish facts independently; that reply goes to the Central Government.
  • 03Listed companies run two processes at once: the auditor’s report and SEBI disclosure.
  • 04Reconcile ADT-4, the board’s report, CARO and the whistle-blower register every year.

Questions we are asked

What is the penalty if an auditor fails to report fraud under section 143(12)?

Since the Companies (Amendment) Act 2020, section 143(15) imposes a penalty of ₹5 lakh where the company is listed and ₹1 lakh in other cases, on the auditor, cost accountant or company secretary who fails to comply. Professional consequences under the Chartered Accountants Act or NFRA may follow separately.

What counts as fraud for these purposes?

Section 447 of the Companies Act defines fraud broadly to include any act, omission, concealment of facts or abuse of position with intent to deceive, gain undue advantage or injure the interests of the company, its shareholders or creditors. Punishment ranges from six months to ten years’ imprisonment, with a fine of at least the amount involved.

Can the Tribunal remove an auditor for fraud?

Yes. Under section 140(5), the Tribunal can order a company to change its auditor if satisfied that the auditor acted fraudulently or abetted or colluded in fraud. The Supreme Court upheld the provision in 2023, and an auditor removed this way cannot be appointed as auditor of any company for five years.

Does every forensic audit have to be disclosed by a listed company?

No. Since December 2024, the Schedule III item covers forensic audits aimed at detecting misstatement in financial statements or misappropriation, siphoning or diversion of funds. Audits of product quality, manufacturing, recruitment or supply chain are excluded.

Sources

  1. Companies Act 2013, ss.140, 143, 177 and 447 link
  2. Companies (Audit and Auditors) Rules 2014, rule 13, and Companies (Audit and Auditors) Amendment Rules 2025, G.S.R. 359(E), 30 May 2025 link
  3. Companies (Auditor’s Report) Order 2020, S.O. 849(E), 25 February 2020 link
  4. SEBI (Listing Obligations and Disclosure Requirements) Regulations 2015, consolidated text link
  5. SEBI circular SEBI/HO/CFD/CFD-PoD-1/P/CIR/2023/123, 13 July 2023, and LODR Master Circular updated 30 January 2026 link
  6. Chartered Accountants Act 1949, Second Schedule link

This guide is general information on the law as stated above, not legal advice. Facts change outcomes; take advice on your own matter.

Go deeper

Further reading

Forensic accounting9 Aug 2026

Forensic Audit vs Statutory Audit: What Is the Difference and When Do You Need One?

A statutory audit gives an opinion on the accounts; a forensic audit tests specific suspicions to an evidential standard. Here is how they differ in India.

Governance & controls11 Oct 2026

How to Build a Fraud Risk Management Framework: A Board-Level Guide

A board-level guide to fraud risk management: the COSO/ACFE five principles, roles of the board, audit committee and CFO, and Indian legal hooks.

Whistleblowing6 Aug 2026

Vigil Mechanism under the Companies Act and SEBI LODR: What Boards and Audit Committees Must Get Right

Who must have a vigil mechanism in India, what s. 177 and SEBI LODR require, and how Boards and Audit Committees can make whistleblowing work in practice.

Confidential consultation

Facing this question on a live matter? Talk to us.

Tell us what has happened. A senior member of our team will help you work out who must do what, and in what order, in strict confidence.

Speak to an expertAll regulatory frameworks
Confidential enquiry