Forensic Audit & Financial Fraud Investigation: Detecting Fund Diversion & Siphoning in Bank Borrowers

Commercial bank lending in India operates on trust, backed by rigorous financial reporting, working capital monitoring, and asset hypothecation. However, when corporate borrowers face financial stress, operational bottlenecks, or promoter-level distress, the boundary between business failure and financial fraud can become blurred. In our forensic accounting and tax advisory practice at Rabi Agrawal & Associates, serving commercial clients across Raipur, Durg-Bhilai, Korba, and Rayagada/Kalahandi, we frequently encounter situations where bank cash credit (CC) lines or term loans are quietly diverted away from primary business operations.

When a borrower account defaults or displays continuous Early Warning Signals (EWS), commercial banks and consortium lenders no longer rely solely on routine statutory audits. They trigger a Forensic Financial Audit.

Unlike standard statutory or internal audits—which test compliance and sample transactions assuming management integrity—a forensic audit is an investigative, evidence-driven examination designed specifically to reconstruct fund flows, unearth concealed transactions, establish legal intent (mens rea), and identify whether non-performing assets (NPAs) stem from genuine commercial loss or deliberate fund diversion and siphoning.

This article provides an operational handbook for bank lenders, corporate management, Resolution Professionals (RPs), and internal audit teams. It details the RBI Master Directions on Fraud Classification, practical techniques for detecting shell entities and circular trading, application of forensic data analytics like Benford's Law, and the execution of legally sustainable Forensic Audit Reports.

---

1. Regulatory Framework: RBI Master Directions & Legal Definitions

The Reserve Bank of India (RBI) has mandated stringent frameworks for commercial banks, Financial Institutions (FIs), and NBFCs regarding fraud identification, Red Flagged Accounts (RFA), and reporting to law enforcement agencies like the CBI, Serious Fraud Investigation Office (SFIO), and Enforcement Directorate (ED).

   [ Early Warning Signals (EWS) Triggered ]
                      |
                      v
   [ Account Classified as Red Flagged Account (RFA) ]
                      |
                      v
   [ Mandate Issued for Forensic Audit / Investigation ]
                      |
                      v
   [ Execution of Investigative Workflow & Field Tests ]
                      |
                      v
   [ Forensic Audit Report Submitted to Consortium / JLF ]
                      |
                      +-----------------------+
                      |                       |
                      v                       v
   [ Genuine Loss / Re-structuring ]   [ Fraud Declared / FIR / IBC S.66 ]

Diversion of Funds vs. Siphoning of Funds

The RBI Master Directions on Fraud Classification and Reporting clearly distinguish between Diversion of Funds and Siphoning of Funds. Understanding this distinction is critical because each carries different legal consequences under civil and criminal law.

Red Flagged Accounts (RFA) & Early Warning Signals (EWS)

Under RBI guidelines, credit facilities of ₹50 Crore and above must be monitored under the RFA framework. An account is tagged as an RFA when one or more Early Warning Signals are triggered. Common EWS triggers monitored by consortium lead banks include:

1. Frequent Overdrawing: Operating Cash Credit/Overdraft accounts beyond sanctioned limits without corresponding growth in inventory/receivables.
2. Sales Mismatch: High turnover reported in GST returns (GSTR-1/GSTR-3B) with minimal routing of cash flows through the consortium bank accounts.
3. Unapproved Sub-banking: Opening current accounts with non-consortium banks without obtaining a No Objection Certificate (NOC) from the lead lender.
4. Sudden Vendor Spikes: High-value transactions with newly formed vendors or related entities registered at identical addresses.
5. Inventory Velocity Lapses: Inventory turnover days stretching drastically while stock audit reports continue to show static stock values.

If an account is classified as an RFA, lenders are required to launch a forensic audit immediately. The investigation must ideally be completed within six months, leading to either clearance or formal declaration of the account as Fraud.

---

2. Forensic Audit Investigative Workflow

Forensic auditing requires a methodical, evidentiary approach. Unlike routine financial audits that rely on sampling, forensic investigations analyze 100% of high-risk transactions, cross-referencing banking data, digital footprints, counterparty records, and public registries.

Here is the standardized workflow executed during a bank-mandated forensic audit:

+-----------------------------------------------------------------------+
| PHASE 1: PRE-ENGAGEMENT SCOPING & RISK PROFILING                      |
| - Review Sanction Terms, Credit Monitoring Reports, Stock Audits      |
| - Obtain Full Ledger Dumps, Bank Statements, GST & ITR Data           |
+-----------------------------------------------------------------------+
                                   |
                                   v
+-----------------------------------------------------------------------+
| PHASE 2: FORENSIC DATA ANALYTICS & BANK STATEMENT TRACING             |
| - Run CAATs tool for Fund Flow Tracing across all accounts            |
| - Benford's Law tests, round-sum transaction extraction              |
| - Related Party / MCA MCA21 DIN & GSTIN Network Mapping               |
+-----------------------------------------------------------------------+
                                   |
                                   v
+-----------------------------------------------------------------------+
| PHASE 3: FIELD VERIFICATION & COUNTERPARTY INVESTIGATION              |
| - Physical Verification of Plant, Equipment, and Warehouses           |
| - Direct Counterparty Confirmation & Independent Site Visits          |
| - Transporter & E-Way Bill Verification (Vahan Portal Validation)     |
+-----------------------------------------------------------------------+
                                   |
                                   v
+-----------------------------------------------------------------------+
| PHASE 4: MANAGEMENT INTERFACE & REBUTTAL OPPORTUNITY                  |
| - Issue Show-Cause Queries with Documentary Evidence                  |
| - Conduct Recorded Interviews with Key Management Personnel (KMP)     |
+-----------------------------------------------------------------------+
                                   |
                                   v
+-----------------------------------------------------------------------+
| PHASE 5: DRAFTING REPORT & EVIDENTIARY DOSSIER                        |
| - Quantify Diversion vs Siphoning Amounts                             |
| - Compile Documentary Dossier (Court-Admissible Standard S.65B/BSA)   |
| - Submit Final Forensic Audit Report to Joint Lenders Forum (JLF)     |
+-----------------------------------------------------------------------+

---

3. Common Modus Operandi & Forensic Detection Techniques

Over years of conducting forensic reviews for lenders and corporate entities in Central India, we have observed that fund diversion rarely occurs through simple cash withdrawals. Instead, promoters often use layered corporate structures, circular invoices, and fictitious capital expenditure.

1. Siphoning to Shell Entities & Related Parties

Borrowers frequently route funds to proprietary firms, LLPs, or private limited companies held by relatives, employees, or trusted associates.

• Detection Methodology:
  • DIN & MCA Network Analysis: Extract Director Identification Numbers (DIN) and cross-map directorships, registered office addresses, and email domains across the corporate group using MCA21 databases.
  • GSTIN Matching: Cross-check the GST registration dates of major suppliers. If a borrower transfers ₹15 Crore to a supplier registered only three weeks prior to the transaction with zero physical office infrastructure, it indicates a potential shell entity.
  • Common Bank Account / IP Address Analysis: Analyze internet banking log files. If transactions for the borrower and five ostensibly "independent" suppliers originate from the same IP address or authorized signatory, it confirms related-party layering.

2. Circular Trading & Accommodation Invoices

Circular trading involves passing invoices back and forth between a network of controlled entities to artificially inflate revenue. This inflates drawing power for working capital loans without any actual movement of physical goods.

[ Borrower Entity A ] ---> (Fake Sales Invoice) ---> [ Controlled Shell B ]
        ^                                                   |
        |                                                   v
[ Layering Shell D ] <--- (Accomodation Entry) <--- [ Controlled Shell C ]

• Detection Methodology:
  • Triangulation of Financial Statements: Compare turnover reported in Profit & Loss statements against GSTR-1, GSTR-3B, and GSTR-9C reconciliations.
  • E-Way Bill & Vahan Portal Verification: Cross-check E-Way bill vehicle numbers against the Ministry of Road Transport & Highways (VAHAN) database. In multiple forensic engagements, we have identified instances where invoices for 50 metric tons of steel billets or paddy listed vehicle numbers belonging to two-wheelers, autorickshaws, or non-existent registration series.
  • Freight & Weighbridge Log Audit: Verify corresponding freight expenses, transit insurance policy endorsements, and weighbridge slips (Dharam Kanta records). An absence of freight expenditure despite large trading volumes points directly to paper trading.

3. Inflated Capital Expenditure Invoices (Over-Invoicing Machinery)

When term loans are sanctioned for plant modernization or capacity expansion, borrowers may collapse capital costs by colluding with equipment suppliers.

• Detection Methodology:
  • Customs Duty & Bill of Entry Matching: For imported plant machinery, match the bank LC disbursement against the actual declared Value at Customs on the Bill of Entry.
  • Independent Asset Valuation: Engage certified chartered engineers to perform physical verification and techno-economic valuation of installed machinery, comparing serial numbers on the physical nameplates against tax invoices.
  • Vendor Bank Statement Tracing: Subpoena or trace the bank accounts of equipment vendors to identify immediate fund kickbacks returned to promoter personal accounts or sister concerns.

4. Off-Balance Sheet Liabilities & Unauthorized Accounts

To bypass credit monitoring, borrowers may open unapproved current accounts outside the lending consortium or create undisclosed liabilities through letters of credit or pledge of assets.

• Detection Methodology:
  • 26AS & AIS / TIS Data Cross-Matching: Review Form 26AS/AIS for interest income credits or TDS deductions (u/s 194A) from non-consortium bank branches.
  • CIBIL / CRILC Multi-Bank Scrutiny: Pull Central Repository of Information on Large Credits (CRILC) data to verify all credit facilities registered under the borrower's PAN across all Indian financial institutions.

---

4. Forensic Data Analytics & Digital Evidence Gathering

Modern forensic audits rely heavily on digital data analytics tools to identify patterns across millions of ledger entries.

       RAW LEDGER & BANK DATA (CSV / XML DUMP)
                          |
                          v
         +----------------------------------+
         | CAATs & Python Data Analytics    |
         +----------------------------------+
          /               |                \
         /                |                 \
        v                 v                  v
 [ Benford's Law ] [ Round-Sum Extraction ] [ Split Invoices ]
  Anomaly Spike     Repeated Tranches        Just Below S.L.

Benford's Law (First-Digit & Second-Digit Analysis)

Benford's Law states that in naturally occurring numerical datasets, the number 1 will be the leading first digit approximately 30.1% of the time, while the number 9 will be the leading digit only 4.6% of the time.

When financial records are manually fabricated or invoices are artificially created to extract funds, the numerical distribution shifts away from Benford's natural curve.

$$\text{Probability}(d) = \log_{10}\left(1 + \frac{1}{d}\right)$$

Benford's Law First-Digit Probability Distribution:
Digit 1: [==============================] 30.1%
Digit 2: [=================] 17.6%
Digit 3: [============] 12.5%
Digit 4: [=========] 9.7%
Digit 5: [========] 7.9%
Digit 6: [======] 6.7%
Digit 7: [=====] 5.8%
Digit 8: [====] 5.1%
Digit 9: [====] 4.6%

• Application in Forensic Audits:
  • Split Purchase Orders: Identifying multiple invoices created just below approval thresholds (e.g., ₹4,99,000 to bypass ₹5,00,000 dual-signatory mandates).
  • Manual Journal Entry Spikes: Running Benford analysis on year-end adjustment entries in the general ledger. A sudden spike in digits 7, 8, and 9 frequently signals fabricated manual entries designed to inflate closing inventory or trade receivables.

Digital Evidence Preservation under Bharatiya Sakshya Adhiniyam (BSA)

For a forensic audit report to hold up in court—whether before the National Company Law Tribunal (NCLT), Debt Recovery Tribunal (DRT), or criminal courts—electronic evidence must be preserved carefully.

• Mirror Imaging: Forensic extraction of hard drives, Tally database backups, and ERP system logs must use write-blocking hardware tools to prevent meta-data alteration.
• Hash Value Certification: Generating SHA-256 or MD5 cryptographic hash values for extracted data files at the exact time of seizure/audit collection.
• Admissibility Certificates: Issuing formal compliance certificates under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (formerly Section 65B of the Indian Evidence Act, 1872) to certify that computer-generated ledger dumps and email chains were retrieved from operational systems without manipulation.

---

5. Summary Table: Common Fraud Red Flags & Forensic Test Procedures

The following reference matrix outlines key red flag indicators alongside their corresponding forensic test procedures and required evidentiary support:

---

6. Regional Case Perspectives: Chhattisgarh & Odisha

In our practice across Chhattisgarh and Odisha, ground realities vary across specific industrial sectors. Forensic investigations in these regions require sector-specific knowledge of local trade practices, regulatory frameworks, and commodity markets.

Scenario 1: Steel Re-rolling Mills & Scrap Traders (Urla & Bhanpuri, Raipur)

• The Modus Operandi: A steel re-rolling unit in Urla availed ₹35 Crore Cash Credit facility. To maintain drawing power against declining market demand, the unit engaged in circular trading with sponge iron and scrap suppliers in Bhanpuri and Mandir Hasaud.
• Forensic Findings: Our forensic analysis revealed that while GST returns reflected sales of ₹120 Crore, physical power consumption records (CSEB electricity bills) showed power usage sufficient for only one-third of that production volume. The unit was generating fake accommodation bills through shell scrap traders. The actual bank funds were siphoned off via cash withdrawals and land acquisitions under promoter family names around Naya Raipur.

Scenario 2: Rice Millers & Paddy Procurement (Kalahandi & Jayapatna, Odisha)

• The Modus Operandi: A commercial rice mill operating in Kalahandi district obtained seasonal working capital lines from a commercial bank for Custom Milled Rice (CMR) operations under the Odisha State Civil Supplies Corporation (OSCSC).
• Forensic Findings: Audit procedures revealed that paddy stock reported in monthly stock statements to the bank was overstated by 65%. The miller had diverted working capital funds to acquire unapproved real estate assets in Bhubaneswar and Vizag. The physical paddy bags in the godowns were arranged using "hollow-stacking" techniques—stacking bags along the outer perimeter while leaving the interior completely empty.

Scenario 3: PWD Civil Contractors & Sub-Contracting Layers (Durg, Bhilai & Sambalpur)

• The Modus Operandi: A Class-A PWD infrastructure contractor secured ₹45 Crore in bank guarantees and working capital limits for road construction projects in Chhattisgarh and Odisha.
• Forensic Findings: Funds disbursed by the bank were systematically transferred to 12 sub-contracting proprietary firms. Forensic tracing established that all 12 firms were registered under the names of the contractor's site supervisors, drivers, and office staff. Sub-contracting expenses were inflated, cash was withdrawn in small tranches below PAN reporting limits, and the funds were siphoned into unrecorded personal accounts.

---

7. Structuring the Forensic Audit Report for Lenders & Management

A forensic audit report is an evidentiary document that must withstand intense scrutiny from defense attorneys, bank consortium heads, law enforcement agencies, and judicial bodies like the NCLT.

Essential Structure of an Actionable Report

1. Executive Summary & Mandate: Clear statement of the scope, period under audit (PUA), credit facilities evaluated, and aggregate financial exposure.
2. Quantified Summary of Findings: Explicit categorization and numerical quantification of:
   • Total Amount Diverted: (Short-term funds used for long-term assets / group loans).
   • Total Amount Siphoned: (Funds routed to shell entities with no commercial substance).
   • Unrecorded Liabilities & Third-Party Pledges.
3. Detailed Findings with Modus Operandi: Individual chapters dedicated to each red flag, supported by detailed charts, transaction IDs, bank voucher references, and counterparty responses.
4. Evidentiary Annexures: Inclusion of court-admissible evidence, including MCA network graphs, VAHAN search results, email headers, and signed interview transcripts.
5. Conclusive Forensic Opinion: Direct assessment of whether the actions of the borrower fall under the RBI definition of Willful Defaulter, Diversion of Funds, Siphoning of Funds, or Fraud under Section 66 of the Insolvency and Bankruptcy Code (IBC), 2016.

---

8. Preventive Measures & Institutional Safeguards for Lenders

To protect capital and identify fund siphoning before accounts turn into irrecoverable NPAs, financial institutions and corporate boards should implement effective internal controls:

• Real-time API Integration: Lenders should integrate credit monitoring software directly with the GSTN portal, E-Way Bill system, and RBI CRILC database for automated cross-verification of declared turnover.
• Strict NOC Enforcement: Banks must enforce strict zero-tolerance policies for unauthorized current accounts. Any cash flows routed through non-consortium banks must immediately trigger a freeze on drawing power.
• Unannounced Physical Stock Audits: Traditional stock audits announced weeks in advance allow borrowers time to adjust physical stocks or borrow inventory temporarily. Mandatory unannounced stock counts, complete with 3D volumetric laser measurement for bulk commodities (coal, iron ore, grain), eliminate stock manipulation risks.
• Independent Pre-Disbursement Capex Verification: Term loan disbursements for capital expenditure should be released strictly against direct verification of vendor credentials, original Bill of Entry documents, and independent engineer certification.

---

Conclusion & Practice Callout

Forensic financial auditing is more than an accounting exercise—it is a specialized discipline at the intersection of financial analysis, data analytics, corporate law, and criminal investigation. Whether identifying fund diversion in an industrial unit, defending management against unsubstantiated RFA allegations, or providing investigative reports to bank consortiums and Resolution Professionals, independent forensic expertise is essential for protecting financial integrity.

At Rabi Agrawal & Associates, our team brings deep practitioner experience, advanced CAATs data analytics, and ground-level understanding of commercial operations across Chhattisgarh and Odisha.

Practice Consultation Callout

If your financial institution requires a Bank-Mandated Forensic Financial Audit, or if your corporate board, MSME unit, or Resolution Professional team requires an Independent Fraud Investigation, Transaction Audit under IBC (Section 43, 45, 50, 66), or RFA Defense Strategy, contact our senior partners for a confidential consultation.

• Head Office (Raipur): Office No. 304, Commercial Complex, Near Pandri, Raipur, Chhattisgarh – 492001
• Branch Office (Odisha): Main Road, Near Bus Stand, Junagarh / Bhawanipatna, Kalahandi, Odisha – 766014
• Direct Email: contact@carabiagrawal.com | rabiagrawal@gmail.com
• Key Practice Areas: Forensic & Fraud Audits, Statutory & Internal Audits, IBC Transaction Audits, GST & Income Tax Investigation Defense, CG RERA & Bank CMA Consultancy.