Forensic Audit in Insolvency explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Forensic investigation is a transparency mechanism within the insolvency process: it establishes the actual economic position of a corporate debtor beyond what appears from its financial statements. A default shows the company cannot meet its obligations; it does not by itself establish where the money went, what happened to the assets, who benefited, who decided, or what can be proved.
Why insolvency needs investigation at all
The IBC is intended to facilitate timely resolution, maximise the value of assets and provide an effective process for stakeholders. Transparency and accountability matter within that framework for a specific reason: financial distress may arise not only from adverse business or economic circumstances but also from diversion of funds, dissipation of assets, related-party transactions, or decisions that adversely affect the value available to creditors.
Distress caused by a market downturn and distress caused by asset stripping look identical on a balance sheet. Only investigation separates them.
The distinction that frames the whole discipline
ICAI's formulation is worth reproducing in full because it defines the scope of the work. A default "may establish that a company is unable to meet its obligations but does not by itself establish where the money went, what happened to the assets and value, who benefited from particular transactions, who made or controlled the relevant decisions, or what can ultimately be proved through available evidence."
That sentence contains the five questions of a forensic investigation:
- Money — where did it go?
- Assets — what happened to them and to the value?
- Beneficiaries — who benefited?
- Decisions — who made or controlled them?
- Evidence — what can actually be proved?
The fifth is the one that distinguishes forensic work from analysis. A conclusion that cannot be evidenced is of no use to a resolution professional who has to file an application.
PUFE — the statutory targets
Significance attaches to the identification of preferential, undervalued, fraudulent and extortionate transactions (PUFE), and to the way findings are supported through documentary and other corroborative evidence.
| Category | Where it sits after the 2026 amendment |
|---|---|
| Preferential, undervalued and extortionate credit transactions | Sections 43 to 51 — avoidance transactions |
| Fraudulent and wrongful trading | Sections 66 and 67 |
The IBC (Amendment) Act, 2026 formally distinguishes the two and requires separate applications for each. The forensic classification therefore now drives the form of the application, not merely its content.
The division of roles
ICAI draws the line clearly:
- The forensic professional collects, analyses, traces, corroborates and quantifies the relevant information.
- The statutory and legal determinations remain within the domain of the Resolution Professional and the adjudicating authority.
A forensic report that concludes a transaction "is preferential under section 43" has crossed the line. The report should establish the facts, the evidence and the quantification; the characterisation is the RP's to make and the Adjudicating Authority's to decide.
Why section 47 changes the stakes
Under the amended section 47, if an RP, IRP or liquidator fails to identify and file applications for transactions that could have been discovered with proper professional effort, any stakeholder may approach the Adjudicating Authority, which can recommend disciplinary action to IBBI.
"Could have been discovered with proper professional effort" is a standard measured against what a competent forensic process would have found. An RP who commissioned no review has no answer to it. An RP who commissioned a documented, methodical review that found nothing has a complete one.
This is the practical reason forensic investigation has moved from optional to standard — not because more fraud is expected, but because the absence of a review is now itself the exposure.
What a forensic review delivers to the process
ICAI's summary is that a properly undertaken forensic review assists in:
- strengthening transparency within the insolvency process;
- supporting informed decision-making — the CoC deciding on a plan needs to know whether value left the company and can be recovered;
- identifying transactions requiring further action; and
- enabling relevant stakeholders to pursue appropriate remedies within the framework of the IBC.
The condition the work is done in
Forensic investigation in insolvency happens where the underlying records may be incomplete, conflicting or controlled. All three are different problems:
- Incomplete — gaps to be identified and worked around.
- Conflicting — versions to be reconciled, which is itself evidence.
- Controlled — records in the hands of the people whose conduct is under examination.
The third is why the work has to be structured and evidence-led rather than reliant on management explanation.
Compliance checklist
- Commission a forensic review as a standard workstream in every CIRP.
- Structure the enquiry around the five questions — money, assets, beneficiaries, decisions, evidence.
- Direct the work at PUFE categories and classify findings into the sections 43-51 and sections 66-67 buckets.
- Keep the forensic professional to facts and quantification; leave characterisation to the RP.
- Corroborate every finding with documentary or other evidence.
- Document negative findings and scope limitations — that is the section 47 defence.
- Note where records are incomplete, conflicting or controlled, and how that was addressed.
Common mistakes
- Treating default as sufficient explanation for the company's position.
- Skipping a forensic review in an apparently straightforward case.
- A forensic report that makes legal characterisations.
- Findings without corroborative evidence.
- Relying on management explanations for records they control.