Last reviewed: 15 August 2026. Most fraud inside an MSME is not dramatic — it is a vendor invoice that is slightly inflated every month, a stock count that never quite matches the books, or an expense claim nobody looks at closely because the amounts are individually small. By the time it is noticed, the pattern has usually been running for months or years. Forensic accounting is the discipline of tracing exactly what happened, when, and how much it cost — in a form that holds up if the matter goes to an insurer, a lender, HR, or the police. This guide covers when MSMEs typically need it, the red flags that usually trigger an engagement, and how one runs in practice.
Forensic accounting vs a statutory or tax audit
| Statutory / tax audit | Forensic accounting engagement | |
|---|---|---|
| Purpose | Opinion on whether financial statements are true and fair, or tax computation is correct | Establish whether a specific suspected irregularity occurred, and quantify it |
| Scope | The whole year, on a materiality and sample basis | Narrow and deep — the flagged vendor, employee, location or transaction type, examined exhaustively |
| Trigger | Statutory requirement, annual cycle | Suspicion, a tip-off, an anomaly noticed in MIS, or a lender/insurer requirement |
| Output | Audit opinion / tax return | A findings report with a documented evidence trail, usable in HR, insurance or legal proceedings |
Red flags that typically trigger an engagement
| Red flag | What it often points to |
|---|---|
| Recurring round-number invoices from one vendor | Invoices manufactured to hit a number, rather than reflecting an actual bill |
| A "vendor's" bank details or registered mobile number match an employee | A ghost vendor set up to route payments to an insider |
| Inventory shrinkage beyond what normal wastage explains | Unrecorded sales, theft, or stock diverted outside the books |
| Duplicate payments against the same invoice number or PO | Either a control gap or a deliberate double-billing pattern |
| Expense claims without original bills, or bills that look reused | Inflated or fabricated reimbursement claims |
| Cash sales that don't track with footfall, production or raw-material consumption | Revenue skimming before it reaches the books |
Two situations we see repeatedly
Worked example 1 — the ghost vendor. A trading company's MIS shows a steady rise in "freight and handling" charges from one transport vendor over eight months. On closer review, the vendor's registered mobile number on the GST portal traces back to a number saved in the company's own HR system against a warehouse supervisor. The invoices were real documents with a real GSTIN, but the entity behind them was effectively controlled by an employee who had no authority to approve his own vendor's payments. A forensic review reconstructs the full payment history, cross-checks it against actual freight movement records, and quantifies the overbilled amount for recovery and HR action.
Worked example 2 — the stock mismatch. A manufacturing company's year-end physical stock count comes in materially below the book quantity. Management initially attributes it to process wastage, but the gap is larger than historical norms. A forensic review traces production consumption ratios month by month, cross-references them against sales invoices and scrap-sale records, and finds a pattern of scrap sales that were never recorded as income — the "missing" stock was, in fact, sold outside the books. The finding reshapes both the current year's numbers and the internal control fix going forward.
How a typical engagement runs
| Step | What happens |
|---|---|
| 1. Scoping call | Define exactly what is suspected and which period, vendor, employee or transaction type is in scope |
| 2. Document preservation | Identify and secure the records needed — bank statements, GST returns, vendor masters, payroll, physical stock records — before anything can be altered or lost |
| 3. Data pull & reconciliation | Trace transactions across systems — accounting software, bank, GST portal, payroll — looking for the pattern the scoping call identified |
| 4. Tracing & quantification | Build the evidence trail and quantify the financial impact with supporting documentation |
| 5. Findings report | A written report suitable to support an insurance claim, HR proceeding, or a police complaint if the company decides to pursue one |
What forensic accounting cannot do
It is worth being direct about the limits. A forensic accounting engagement cannot guarantee that lost funds will be recovered — recovery depends on the counterparty's assets, willingness to settle, or a court process that runs on its own timeline. It is not a substitute for a police investigation where criminal prosecution is the goal; the findings report is evidence that supports such a process, not a verdict in itself. And timing matters — the longer suspected fraud runs before it is investigated, the harder (and more expensive) it typically is to reconstruct.
Frequently asked questions
How is forensic accounting different from our regular statutory audit?
A statutory audit is a sample-based annual check that gives an opinion on whether the financial statements as a whole are true and fair. Forensic accounting is narrow and deep — it investigates one specific suspected irregularity exhaustively, rather than the whole year on a sample basis. A clean statutory audit does not rule out fraud that a forensic review would catch, because sampling is not designed to find a single small, deliberately hidden pattern.
Do we need to involve the police before starting a forensic review?
No — in most cases the forensic review happens first, to establish what actually occurred and quantify it. Whether to file a police complaint, pursue civil recovery, or handle the matter internally through HR action is a decision the company makes after seeing the findings, not before.
Can forensic accounting findings be used in court or with an insurer?
That is the point of documenting an engagement properly — the evidence trail, chain of custody for documents, and the findings report are prepared with that use in mind. Whether a specific finding is sufficient for a particular court proceeding or insurance claim depends on the facts and the requirements of that forum, which is worth discussing upfront when scoping the engagement.
How long does a typical engagement take?
It depends entirely on scope — a focused review of one vendor over a defined period can run a few weeks; a company-wide review across multiple locations and years takes considerably longer. Scoping the engagement tightly to the actual suspicion, rather than reviewing everything, is usually both faster and more effective.
What should we do first if we suspect fraud but aren't sure?
Preserve the records before doing anything else — do not confront the suspected individual, and do not let routine document-retention cycles (bank statement downloads, backup rotations) run their course before the relevant period is secured. A brief scoping call before any internal confrontation usually produces a much cleaner outcome than an internal investigation that tips off the person involved too early.
Is forensic accounting only for large companies?
No — proportionally, the impact of vendor or cash fraud is often more severe for an MSME than for a large company, because the amounts involved are a bigger share of overall profitability and the internal controls are typically thinner. Engagements are scoped to the size of the suspected issue, not the size of the company.
We run forensic accounting engagements scoped tightly to the suspected issue — vendor, employee, location or transaction type — with documentation built to support whatever action you decide to take next. The earlier a suspected irregularity is looked into, the cleaner the trail usually is.
Forensic Accounting Bookkeeping & Accounting Talk to usThis article explains when and how forensic accounting engagements typically work and is general guidance, not advice on any specific suspected matter — consult us before taking any action on a live situation.