Quick Answer
The three engagements answer three different questions. A statutory audit (section 139 and 143, Companies Act) answers whether the financial statements give a true and fair view; it is mandatory for every company from year one and the auditor's duty on fraud is to report under section 143(12) when it comes across fraud — it is not designed to find it. Financial due diligence answers whether an investor should pay the proposed price on the proposed terms: quality of revenue and earnings, net debt and working capital, the cap table, contingent liabilities, and the compliance exposures (FEMA, GST, TDS, ESOP, related-party) that become the investor's problem after closing; it is scoped by the investor and reported to the investor. A forensic audit answers whether a specific suspicion is true, who did it, how much, and whether the evidence will stand in court or before the SFIO/NCLT; it is commissioned by the board (or an investor under its SHA rights) when there is a trigger — a whistle-blower, an unexplained variance, a vendor that does not exist, a section 143(12) report — and its method is evidence preservation first, interviews last. Choose DD before you invest; a forensic review when something specific has gone wrong; and never ask the statutory auditor to do either in the same engagement.
Reviewed: 4 November 2026 | Law: Companies Act, 2013 (ss. 139, 143(12), 177(9), 447); Companies (Auditor's Report) Order, 2020; Companies (Audit and Auditors) Rules, 2014 (rule 13); Bharatiya Sakshya Adhiniyam, 2023 (s. 63); Prevention of Money-laundering Act, 2002; SEBI (Alternative Investment Funds) Regulations, 2012 | Author: CA V. Viswanathan, FCA, ACS, Certified Fraud Examiner (CFE), IBBI Registered Valuer (IBBI/RV/03/2019/12333)
Answer: The scope follows what the investor is buying — a percentage of the fully diluted equity and the right to be paid out of future value — so the diligence tests whether that percentage and that value are what the term sheet says:
Findings of the following kinds are the ones that change price or terms (illustrative categories, not a frequency ranking): an ESOP pool that is larger in the deck than in the resolution; a prior round's FC-GPR filed late or not at all; GST ITC that will have to be reversed; revenue booked on contracts that are terminable at will; founder loans and salaries not approved under section 188/197; and a prior valuation report that does not support the price at which the earlier round was done. Each becomes a condition precedent, an indemnity, a price adjustment or an escrow — which one depends on whether it can be fixed before closing.
Answer: Commission one when there is a specific trigger that the statutory audit is not built to resolve: a whistle-blower complaint under the vigil mechanism (section 177(9) for companies that must have one); a reconciliation gap the finance team cannot explain; vendor or customer master data with duplicate bank accounts; an auditor's communication under section 143(12); a lender's or investor's request under its agreement; or a resignation of the CFO or auditor with a stated reason. The law once fraud is suspected: the auditor who has reason to believe an offence of fraud involving ₹1 crore or more is being or has been committed against the company by officers or employees must report to the Central Government within the time in rule 13 (report to the board or audit committee first, then to the Government within the prescribed period if the response is not received or is unsatisfactory); below ₹1 crore, to the audit committee or board, with disclosure in the board's report. CARO 2020 requires the auditor to report fraud noticed or reported and whistle-blower complaints received. Section 447 makes fraud (as defined) punishable with imprisonment and fine, and section 447 offences are the basis of SFIO investigation under section 212. The forensic engagement is scoped to the suspicion, led by the audit committee or an independent director (not the executive whose area is under review), and sequenced: preserve evidence (Q54), analyse data, examine documents, interview last. Its report is a privileged document if it is commissioned through counsel for the purpose of litigation — decide that at engagement, not after.
Answer: Under section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (which replaced section 65B of the Evidence Act from 1 July 2024), an electronic record is admissible as a document when it is accompanied by a certificate in the form in the Schedule, signed by the person in charge of the computer or communication device and by an expert, identifying the record, describing how it was produced and confirming the conditions in section 63(2) — that the device was regularly used, the information was regularly fed, the device was operating properly, and the record reproduces the information. The practical steps that make the certificate true: image the accounting server and relevant devices forensically (write-blocked, hash-verified) before anyone is told; export the ERP audit trail — which the Companies (Accounts) Rules, rule 3, require every company to maintain with an edit log that cannot be disabled, and which the auditor must report on; obtain bank statements from the bank, not from the company's downloads; preserve email from the server with headers; and for WhatsApp, export from the device with the device identified and the hash recorded. Chain-of-custody records from the first collection to the report are what the opposing side attacks first. A forensic report whose underlying records cannot be certified under section 63 is an internal document, not evidence.
Answer: The board must appoint the first auditor within 30 days of incorporation (section 139(6)); if it does not, the members appoint within 90 days at an EGM, and the first auditor holds office until the first AGM. ADT-1 is not required for a first auditor appointed by the board (the 15-day ADT-1 obligation in section 139(1) applies to appointments at the AGM), but the board resolution and the auditor's consent and eligibility certificate under section 141 are kept on file. The audit covers the first financial year (which may run up to 15 months if incorporated after 1 January); the auditor reports under section 143, including CARO 2020 where applicable (small companies and OPCs are exempt from CARO), the audit-trail report under rule 11(g), and internal financial controls for companies not exempt. On independence: section 141(3) disqualifies as auditor a person who, directly or through a partner, provides the services listed in section 144 to the company — accounting and book-keeping, internal audit, management services, actuarial, investment advisory — so the CA who keeps your books cannot audit them; incorporation filings alone are not a section 144 service, but a CA who also does the company's accounting or acts as its company secretary is disqualified. The ICAI's guidelines are stricter in spirit than the section, and an investor's diligence will treat a founder's family CA as the auditor as a finding. Appoint an auditor who does nothing else for the company.
For an investment: send the term sheet, the data-room index and the closing date; we return a scope and fee by workstream. For a suspected irregularity: tell us the trigger and the systems involved, and do not alert the people concerned — the first step is preservation, and we will say what to image before anything else is done.
Request a scope for diligence or a forensic review
Sources: Companies Act, 2013 — sections 139(1), 139(6), 141, 143(12), 144, 177(9), 185, 188, 197, 212, 447; Companies (Audit and Auditors) Rules, 2014 — rules 11(g) and 13; Companies (Accounts) Rules, 2014 — rule 3(1) proviso (audit trail); Companies (Auditor's Report) Order, 2020; Bharatiya Sakshya Adhiniyam, 2023 — section 63 and the Schedule; Insolvency and Bankruptcy Code, 2016 — sections 43–51, 66; Ind AS 115; AS 9. Fraud and diligence findings described are categories observed in practice, not statistics.
A statutory audit opines on whether the financial statements are true and fair and reports fraud it comes across under section 143(12); due diligence is scoped by an investor to test price and terms before closing; a forensic audit investigates a specific suspicion with evidence preserved for court or the SFIO. They are different engagements and should not be combined with the statutory auditor's.
Typically: ESOP pools larger in the deck than in the resolution, late or missing FC-GPR on earlier rounds, GST ITC from non-filing suppliers, revenue on terminable-at-will contracts, founder loans and salaries without section 188/197 approvals, and earlier valuation reports that do not support the earlier price.
Under section 143(12) and rule 13, when the auditor has reason to believe fraud of ₹1 crore or more by officers or employees against the company; below ₹1 crore it is reported to the audit committee or board and disclosed in the board's report.
With a certificate under section 63 of the Bharatiya Sakshya Adhiniyam, 2023 signed by the person in charge of the device and an expert, confirming the conditions in section 63(2), backed by forensic imaging, hash values, server-side exports and a chain-of-custody record.
Incorporation filings alone do not disqualify, but a CA who keeps the books, acts as company secretary or provides any section 144 service to the company is disqualified under section 141(3). Investors treat a founder's own CA as auditor as a diligence finding.
By the board within 30 days of incorporation (section 139(6)); failing that, by the members within 90 days at an EGM. The first auditor holds office until the first AGM; ADT-1 within 15 days applies to appointments at the AGM under section 139(1).