Next due
7 NOVTDS / TCS deposit · Deducted in Oct 2026in 7 days 11 NOVGSTR-1 · Outward supplies · Oct 2026in 11 days 15 NOVPF & ESI · Contributions · Oct 2026in 15 days 20 NOVGSTR-3B · Summary return · Oct 2026in 20 days 21 NOVITR filing · Audit cases · AY 2026-27 · extended from 31 Octin 21 days 29 NOVMGT-7 / 7A · Annual return · FY 2025-26in 29 days 15 DECAdvance Tax · 3rd (75%) instalment · FY 2026-27in 45 days 31 DECGSTR-9 / 9C · Annual return · FY 2025-26in 61 days
All due dates

The Six-Phase Protocol in a Forensic Investigation

Map and screen, obtain and authenticate, trace the beneficiary, test the value, reconstruct the decision, establish the pattern. Six phases give a forensic investigation a...

Published
Updated
Reading time
4 min
Questions
6 answered
  • High Complexity
Topic
IBC Insolvency
Published
September 7, 2026
Last updated
Sep 7, 2026
Reading time
4 min
0:00
Last updated: September 2026Verified against: Government sources

The six phases

PhaseWhat it does
1. Map and screenMap and screen the relevant transactions and information, then obtain and authenticate the documents — ensuring the records relied on are correct, proper and sufficiently reliable
2. Identify and preserve evidenceIdentify relevant documents, financial records, digital data, emails and other sources; collect and preserve evidence systematically while maintaining proper chain of custody
3. Trace the beneficiaryIdentify who received the money or benefit arising from a transaction
4. Test the valueExamine whether the value disclosed or attributed to a transaction is accurate
5. Reconstruct the decisionExamine whether the decision was appropriate, correct and fair at the relevant point in time, and whether any preferential element was involved
6. Establish the patternConnect individual transactions to a broader pattern of conduct
Chain of custody is the phase most often skipped

The second phase requires evidence to be collected and preserved systematically while maintaining proper chain of custody. In an insolvency that is not a formality.

Digital data, emails and server images are the material most likely to be challenged, and a respondent who can show that records passed through uncontrolled hands does not need to answer what they contain. The six-phase protocol places authentication and preservation before tracing and analysis for exactly that reason — analysis of material that cannot be authenticated produces findings that cannot be used.

Why the order matters

Each phase depends on the one before it, and skipping ahead produces work that has to be redone:

  • Tracing a beneficiary through records that were never authenticated establishes nothing.
  • Testing value without knowing who benefited misses the related-party dimension that determines the look-back.
  • Reconstructing a decision before testing the value leaves the central question — whether the price was right — unanswered.
  • Alleging a pattern before the individual transactions are established is assertion, not evidence.

Reconstructing the decision — the hardest phase

Phase five asks whether the decision was appropriate, correct and fair at the relevant point in time. Two words in that formulation carry the weight.

"At the relevant point in time" requires the investigation to resist hindsight. A sale that looks underpriced today may have been reasonable in the market conditions of three years ago, and section 45 requires consideration significantly less than what was given — not merely less than what could have been obtained with better timing.

"Preferential element" connects the phase directly to section 43, where the test is not whether the payment was justified but whether it put the recipient in a better position than the section 53 waterfall would have.

Establishing the pattern

The final phase exists because individual transactions may not establish the complete factual position unless connected to a broader pattern of conduct or transaction activity.

A single payment to a related entity is explicable. Forty such payments, each below an approval threshold, each followed within days by an onward transfer, each to entities sharing a registered address, are not — and the pattern is frequently the only thing that converts a set of individually defensible transactions into a section 66 case.

What the protocol produces

Applied end to end, the six-phase protocol yields the elements an avoidance application actually needs: the transaction with its look-back period, the identity and relationship of the beneficiary, the basis of market value, the RP's determination, and the documents — statements of account, bank statements, balance sheets, the list of creditors — attached in support.

Common mistakes

  • Analysing data before authenticating it.
  • Handling digital evidence without a chain of custody record.
  • Judging a past decision by present-day values.
  • Reporting individual transactions without connecting them into a pattern.
Quick recapKey facts & short answers

Key Facts About Six-Phase Protocol

  • Applies in: All states across India, under the relevant central law.
  • Mode: Mostly online via the official government portal.
  • Typical timeline: Ranges from a few days to a few weeks depending on the case.
  • Non-compliance: May attract penalties, interest or late fees.
  • Expert help: TaxClue completes the entire process end to end for you.

What is the first phase?

Mapping and screening the relevant transactions and information, followed by obtaining and authenticating the relevant documents to ensure the records relied upon are correct, proper and sufficiently reliable.

What does the second phase involve?

Identifying relevant documents, financial records, digital data, emails and other sources of evidence, and collecting and preserving evidence systematically while maintaining proper chain of custody.

A penalty is the visible cost of a delay; the lost time and credibility are the larger part.

— TaxClue Compliance Desk

Six-Phase Protocol: a key compliance topic in Indian tax and corporate law that businesses and individuals must understand to remain compliant.

Related Services & Guides

Was this article helpful?
About the author
Vikas Sharma Tax & Compliance Expert at TaxClue

Experienced in company registration, GST, trademark, and compliance. Helping Indian businesses stay compliant.

Updated:

Disclaimer: This article is for general informational purposes only and does not constitute professional tax, legal or financial advice. Laws, rates and due dates change and can vary by individual case — always verify with the relevant government source (e.g. mca.gov.in, incometax.gov.in) or consult a qualified professional before acting. TaxClue accepts no liability for decisions taken based on this content.

People also ask

Questions, answered

Short, direct answers to the 6 questions readers ask most on this topic.

Mapping and screening the relevant transactions and information, followed by obtaining and authenticating the relevant documents to ensure the records relied upon are correct, proper and sufficiently reliable.

Identifying relevant documents, financial records, digital data, emails and other sources of evidence, and collecting and preserving evidence systematically while maintaining proper chain of custody.

The third phase, whose objective is identifying who received the money or benefit arising from a transaction.

The fourth phase, which examines whether the value disclosed or attributed to a transaction is accurate.

The fifth phase, examining whether the decision was appropriate, correct and fair at the relevant point in time and whether any preferential element was involved.

Because individual transactions may not establish the complete factual position unless they can be connected to a broader pattern of conduct or transaction activity.