Forensic Investigation Process explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
A forensic investigation in insolvency requires a systematic examination — beginning with mapping and screening of transactions and extending to obtaining and authenticating records, tracing beneficiaries, testing value, reconstructing decisions and establishing patterns. Transactions are prioritised for detailed examination on relevance, availability of evidence, value, potential remedies and urgency.
The six stages
| # | Stage | What it produces |
|---|---|---|
| 1 | Mapping and screening of transactions | The population to be examined, and a first filter over it |
| 2 | Obtaining and authenticating records | Source material whose provenance can be relied on |
| 3 | Tracing beneficiaries | Who actually received the value |
| 4 | Testing value | Whether consideration was adequate — the core of an undervalue finding |
| 5 | Reconstructing decisions | Who made or controlled the decision, and on what basis |
| 6 | Establishing patterns | A course of conduct rather than a set of isolated events |
Stage 2 deserves its own emphasis
In an ordinary audit, records come from the client and their authenticity is assumed. In an insolvency forensic review, the records may be incomplete, conflicting or controlled — and controlled means held by the people whose conduct is being examined.
That is why ICAI lists obtaining and authenticating as a stage. A ledger produced on request, an agreement dated before the transaction, a board minute recording a decision — each has to be tested for provenance before it can support a finding. And identifying gaps in records is itself part of the process: a missing period is a finding.
What the process examines alongside the six stages
- Gaps in records — what is absent, and whether the absence is explicable.
- Related-party relationships — the structural map that makes a transaction meaningful.
- Unusual transactions — by size, timing, counterparty or pattern.
- Fund flows — the movement of money, which is where tracing actually happens.
Prioritisation — the five criteria
No investigation can examine everything. ICAI identifies the basis on which transactions are prioritised for detailed examination:
- Relevance — does it bear on the questions the investigation is asking?
- Availability of evidence — can it be proved with what exists?
- Value — is the amount material to the estate?
- Potential remedies — is there something the RP could actually apply for?
- Urgency — is a limitation period or an asset at risk?
A large, obviously suspicious transaction with no surviving documentation may be a worse use of investigation budget than a smaller one that can be proved end to end. The purpose of the work is to support an application, and an application needs evidence. Availability of evidence is not a practical compromise — it is a selection criterion in its own right.
Why "establishing patterns" is the stage that decides cases
An individual transaction can almost always be explained. A pattern is harder to explain away, and it is often what converts a set of individually defensible transactions into a provable course of conduct — repeated transfers to connected parties, a sequence of write-offs in the months before default, consistent pricing anomalies with one counterparty.
This is also where the distinction between the two statutory categories tends to resolve. An isolated transaction at an undervalue points to sections 43 to 51. A sustained pattern of conduct pointing to intent points toward sections 66 and 67.
Scoping the look-back correctly
Under the 2026 amendment the look-back period runs from two years preceding the initiation date and ends on the insolvency commencement date, and where there are multiple applications the initiation date is the first filing date.
That has a direct effect on stage 1. The transaction population must be mapped from the correct start date — and an investigation scoped from the admitted application's date, where an earlier filing exists, will map an incomplete population and miss the earliest part of the window.
The standard the process must meet
ICAI's summary: effective forensic investigation requires an evidence-based and structured approach to reconstructing transactions and assessing the conduct underlying them.
Both words matter. Evidence-based — findings tied to source material. Structured — a documented method that can be described and defended, which is what answers a section 47 challenge about what proper professional effort would have found.
Compliance checklist
- Establish the correct initiation date before mapping the transaction population.
- Run all six stages and record the method for each.
- Treat authentication as a distinct step from obtaining records.
- Record gaps in records as findings, not as limitations.
- Build the related-party map before screening transactions.
- Prioritise on all five criteria, weighting availability of evidence properly.
- Look for patterns, not only individual items.
- Keep working papers that evidence the structure of the approach.
Common mistakes
- Mapping the transaction population from the wrong date.
- Accepting records without testing provenance.
- Pursuing high-value transactions with no surviving evidence at the cost of provable ones.
- Reporting isolated transactions without testing for a pattern.
- Treating record gaps as a scope limitation rather than a finding.
- Leaving the method undocumented, so the effort cannot be evidenced later.