At a Glance
- India's statutory audit structure, constrained by low fees, compressed timelines, and a compliance-first culture, is structurally ill-equipped to detect orchestrated siphoning.
- Forensic case data shows that three indicators, GST filing mismatches, deteriorating cash conversion, and sudden vendor concentration shifts, surface diversion in over 80% of cases when tested proactively.
- Boards that commission independent forensic reviews are not admitting failure. They are exercising the fiduciary duty that regulators, lenders, and investors increasingly expect.
The Pattern Behind the Problem
Corporate fraud does not announce itself. In the experience of Northrop Management's forensic practice, it follows a remarkably consistent architecture, one that has appeared in nearly every major Indian corporate fraud of the last two decades, from Satyam to DHFL to ABG Shipyard.
This article maps the four-stage anatomy of promoter-driven fund diversion, draws parallels to documented cases, and outlines the forensic indicators that boards, lenders, and investors should be monitoring today.
The pattern has four stages. Each stage is designed to exploit a specific gap in India's audit and governance infrastructure.
Stage 1: Entity Infrastructure
The objective: Build a network of corporate entities with no visible connection to the promoter or the parent company. Twelve to eighteen months before any funds move, the promoter incorporates three to five private limited companies across different states. Directors are drawn from family members, former employees, or trusted associates. In some cases, individuals do not know their names and identity documents are being used. Each entity opens current accounts at banks different from the parent company's banking relationships. Names are deliberately generic: "Skyline Ventures Limited," "Pinnacle LLP." At this stage, nothing appears in the parent company's books. These entities exist only on the MCA portal.
Documented precedent. The CBI investigation into ABG Shipyard, India's largest bank fraud at ₹22,842 crore, revealed a network of shell entities incorporated years before the fund diversion began. Each entity was structured with directors who had no visible link to promoter Rishi Agarwal on paper. The infrastructure was in place long before the first rupee moved.
How forensic investigation responds. Northrop Management's forensic audit methodology begins every engagement with a full related party mesh: Director Identification Number (DIN) cross-referencing, shared registered address analysis, common signatory mapping, PAN linkage tracing, and Ultimate Beneficial Ownership (UBO) reconstruction. This approach mirrors the investigative framework used by firms such as Kroll and Alvarez & Marsal in cross-border asset tracing engagements, adapted for India's regulatory data infrastructure, particularly the MCA portal, GST Network, and property registrar databases. The shell layer is the first structure a competent forensic audit disassembles.
Stage 2: Transaction Fabrication
The objective: Create a legitimate-looking reason for funds to leave the parent company's bank account. The parent company begins placing purchase orders with the newly created entities for services or goods chosen specifically because they are difficult to verify physically:
- Management consulting fees (no tangible deliverable)
- Software development or IT support (subjective scope, no hardware)
- Raw material supply (where the parent already procures from 30+ vendors)
- Subcontracting charges (standard in infrastructure, pharmaceutical, and manufacturing sectors)
Invoices are generated. GST is charged and, in many cases, paid to make the paper trail appear clean. Payments flow with proper UTR numbers and ledger entries.
From Northrop Management's engagement experience. In one forensic investigation, ₹38 crore moved in a single financial year through invoices described as "cloud migration support." The vendor's registered office was a 200 square foot rented flat. It had no employees on the Provident Fund rolls, no IT assets, and filed GST returns showing zero input tax credit on software or hardware purchases for three consecutive years. The parent company did not use cloud services. The "deliverables" folder on the company server contained four generic PDFs sourced from the internet.
Documented precedent. Satyam Computer Services, India's most widely studied corporate fraud, used an identical mechanic at scale. Ramalinga Raju fabricated over ₹5,000 crore in revenue through fictitious invoices, manufactured bank statements, and approximately 7,000 non-existent employees. The invoices appeared legitimate. Audit confirmations returned clean. PricewaterhouseCoopers, the statutory auditor at the time, signed off. The mechanic is the same whether it operates at ₹38 crore or ₹5,000 crore. The only variable is scale.
The audit gap. Standard statutory audit procedures verify that an invoice exists, that a payment was made, and that the GST filing is in order. What they typically do not verify is whether the vendor actually operates, employs people, or delivered anything. This is the gap that Northrop Management's due diligence practice is designed to close, through vendor existence verification, physical site inspection, employee headcount cross-referencing, and GST return triangulation.
McKinsey's 2023 research on corporate resilience noted that companies with independent vendor verification protocols experienced 40% fewer procurement-related fraud incidents. BCG's 2022 analysis of corporate governance failures in emerging markets identified vendor verification as the single most cost-effective fraud prevention measure available to boards.
Stage 3: Fund Layering
The objective: Make the money untraceable by routing it through multiple entities before it reaches its final destination. From Shell Entity A, funds move to Shell Entity B as "payment for services rendered." Entity B pays Entity C for "material supply." Entity C invests in Entity D as "share application money" or "unsecured loan." Each hop introduces a new invoice, a new ledger, a new GST return, and a new banking relationship. By the final entity, the money has passed through three to four companies across different states and banking institutions. The terminal entity then typically executes one of three exit strategies:
- Real estate acquisition in the name of a family member, associate, or trust
- Outbound investment in a foreign entity, commonly in Dubai, Singapore, or Mauritius, via LRS remittance or round-tripping structures
- Unsecured loan extended back to the promoter or a promoter-linked entity, structured to never be repaid
From Northrop Management's engagement experience. In the most complex fund flow reconstruction Ashish Chaudhary's forensic team has undertaken, layering involved eight entities across four Indian states and two foreign jurisdictions. The total amount diverted: ₹142 crore over fourteen months. Funds entered the network as IT consulting fees and exited as property held in a family trust and equity in a Mauritius-registered holding company. No single entity in the chain held the funds for more than eleven days.
Documented precedent. The DHFL case remains India's most instructive example of institutional-scale layering. The Grant Thornton forensic audit, commissioned by the RBI-appointed administrator, identified over 70 shell entities used to divert more than ₹12,000 crore. Loans were disbursed to fictitious borrowers, routed through interconnected entities, and ultimately used to acquire real estate and other assets for the Wadhawan promoter group. Bain & Company's 2023 India Private Equity Report cited the DHFL case as a turning point in how institutional investors evaluate governance risk in Indian financial services.
Bhushan Steel followed an almost identical architecture. The JPC forensic audit revealed circular transactions through shell companies used by promoter Neeraj Singal to divert lender capital into personal ventures.
What forensic reconstruction looks like. Northrop Management's forensic investigations practice treats every rupee as traceable. The reconstruction process uses bank statement forensics, MCA filings, Registrar of Companies records, property registrar data, and GST Network analytics to map the complete fund flow, entity by entity, transaction by transaction. This approach draws on methodologies consistent with those deployed by FTI Consulting and Grant Thornton in cross-border fraud investigations, adapted for India's regulatory data environment. The question in forensic reconstruction is never whether the money can be found. The question is how many layers deep it has been buried.
Stage 4: Audit Neutralization
The objective: Ensure the statutory audit process does not detect, question, or flag the transactions. This is the stage that should concern every board member, audit committee chair, and independent director. The promoter does not need the auditor to be complicit. The promoter needs the auditor to be constrained. And India's statutory audit structure, by design, produces exactly that constraint.
Related party structuring. Shell entities are incorporated so they fall below the legal definition of "related party" under Ind AS 24 and Section 188 of the Companies Act, 2013. Directors are different. Shareholding stays below threshold. Family links are indirect.
Confirmation circularity. Audit confirmations are sent to the shell entities. The entities confirm the balances. They are controlled by the same person.
Materiality threshold exploitation. For a company with ₹2,000 crore turnover, a ₹12 crore vendor payment falls below most auditors' materiality floor. It will not be sampled, tested, or questioned.
The structural problem. Statutory audit fees in India are, on average, a fraction of what comparable engagements cost in other major economies. A ₹5,000 crore company may pay ₹25 to 40 lakh for its statutory audit. At that fee level, the engagement deploys three to four junior staff for four to six weeks. The work is compliance-driven, not investigative.
Deloitte's 2023 Global Boardroom Program survey found that 62% of Indian audit committee members rated their current audit scope as "inadequate for detecting sophisticated fraud." KPMG's India Fraud Survey, published in the same period, reported that 68% of detected frauds in Indian companies were identified through internal tips or forensic reviews, not through statutory audits. Forensic auditing operates on a fundamentally different principle. The auditor's role is not to accept management's version of a transaction's story but to verify it independently.
Exhibit 1: The Three Forensic Indicators That Matter Most
Northrop Management's forensic practice has identified three indicators that, when tested proactively, surface fund diversion in the majority of cases. In order of diagnostic reliability:
Indicator 1: GST Filing Mismatch
What it reveals: The vendor's GST returns show different revenue figures than what was invoiced to the parent company.
Why it works: This is the single most reliable forensic indicator available in India today, because the GST Network is an independent data source outside management's control. In the ₹38 crore case referenced above, the vendor filed GST returns showing ₹90 lakh in annual revenue while invoicing ₹38 crore to a single client.
Immediate action: Request your finance team to run a GSTR-2A/2B reconciliation for your top 20 vendors by value. Discrepancies exceeding 10% require explanation. Discrepancies exceeding 30% warrant forensic review.
Indicator 2: Cash Conversion Deterioration
What it reveals: Revenue grows, but operating cash flow remains flat or declines. Cash is being absorbed by something that does not appear in operations.
Why it works: In every major Indian corporate fraud of the last 15 years, the cash conversion ratio deteriorated two to three years before the fraud became public. Satyam's operating cash flow diverged from reported profit beginning in 2006. The fraud was disclosed in 2009.
Immediate action: Compare your company's operating cash flow to reported PAT across the last five financial years. A declining ratio alongside revenue growth is a forensic trigger.
Indicator 3: Vendor Concentration Shift
What it reveals: A new vendor captures 8 to 15% of total procurement within a single year, with no competitive bidding, no board approval, and no verifiable track record.
Why it works: Fabricated vendors must absorb large payment volumes quickly to justify the infrastructure cost of the fraud. This creates a detectable concentration anomaly.
Immediate action: Sort your vendor master by total payments over the last 12 months. Any vendor in the top 10 that was absent two years ago should have its MCA filing, registered office, director list, and GST returns independently verified. This exercise takes an afternoon and, based on Northrop's engagement data, would have flagged the fraudulent vendor in approximately 60% of the cases investigated.
Additional Indicators
Boards and audit committees should also monitor for service-heavy procurement spikes (consulting or IT expenses increasing 40%+ year on year without corresponding operational change), director or registered address overlap between the company and its vendors below the statutory related party threshold, unsecured loans to non-strategic parties, and round-trip fund flows where outflows recorded as investment return as revenue or equity from a different entity.
If three or more indicators appear simultaneously, an independent forensic review should be commissioned without waiting for the next audit cycle.
What Boards, Lenders, and Investors Should Do Now
For Board Members and Audit Committees
Request your company secretary to pull the DIN list of directors for your top 10 vendors by payment value. Cross-reference against MCA records. If any director's DIN appears across two or more vendors, or matches any individual connected to the promoter group, the thread has been found. This is also the point at which Northrop Management's corporate governance advisory typically engages, helping boards structure the terms of reference for an independent forensic review and manage the stakeholder communication that follows.
For CFOs and Finance Leaders
Run the GSTR-2A/2B reconciliation for your top 20 vendors immediately. If discrepancies exist and you identify them proactively, it is a governance win. If a forensic auditor, regulator, or lender's credit monitoring team identifies them first, it becomes a career risk. Northrop Management's financial advisory and risk advisory practices support CFOs in building the internal controls infrastructure that prevents these gaps from forming.
For Lenders and Credit Monitoring Teams
Credit monitoring reports are only as reliable as the financial statements they are built on. One question should be standard in every review meeting: "Has any independent party verified that the company's top 10 vendors actually exist and deliver what they invoice for?" If the answer is no, the lending decision is based on a narrative, not verified reality. Northrop Management's due diligence practice works with lenders on vendor verification, fund flow analysis, and borrower financial statement forensics, the same capabilities Deloitte, EY, and Grant Thornton deploy in PSU bank-directed forensic engagements.
For Investors and Fund Managers
Cash conversion ratio remains the single most efficient screen for distinguishing real earnings from manufactured ones. If a company reports consistent revenue growth but does not generate proportional operating cash flow, the earnings may not be real. Cross-reference against the Satyam pattern, the DHFL pattern, and the ABG Shipyard pattern. The signal is always the same.
BCG's annual Value Creators Report and McKinsey's research on total shareholder returns have both emphasised cash conversion as the most reliable predictor of sustainable value creation, and, inversely, as the earliest signal of manufactured performance.
Northrop Management's Forensic and Governance Capabilities
Northrop Management Private Limited, under the leadership of Ashish Chaudhary, has built its forensic investigations and corporate governance advisory practice to address precisely the pattern described in this article. The firm does not audit to confirm. It audits to verify. The distinction is the difference between a compliance exercise and a fiduciary investigation. Northrop's forensic and governance capabilities span the full investigative lifecycle:
Forensic Investigations: Bank statement forensics and fund flow reconstruction. Entity network mapping and UBO tracing. Vendor existence and transaction substance verification. GST return cross-matching and revenue triangulation. Related party disclosure gap analysis. Promoter asset tracing across domestic and cross-border jurisdictions.
Corporate Governance Advisory: Board-level governance reviews and audit committee effectiveness assessments. Internal controls framework design and implementation. Related party transaction monitoring architecture. Whistleblower mechanism design and independent investigation protocols.
Due Diligence: Financial, commercial, and vendor due diligence for M&A transactions, lender mandates, and investor evaluations. Fund flow verification and borrower financial statement forensics for banking and NBFC clients.
Risk Advisory: Enterprise risk management framework design. Internal audit co-sourcing and outsourcing. IFC over financial reporting assessments.
Every engagement is led by professionals with direct experience on PSU bank-directed forensic audits, NCLT and IBC mandates, and complex due diligence assignments involving balance sheets exceeding $6 billion.
To Conclude
₹100 crore does not disappear. It gets reclassified, rerouted, and repackaged until it no longer resembles what it is. The mechanics are not sophisticated. They are patient. And they rely on a single assumption: that nobody will follow the money all the way to the end.
Northrop Management exists to break that assumption.
For forensic audit, corporate governance advisory, due diligence, or risk advisory engagements, contact Northrop Management Private Limited at Business@NorthropIndia.com or call +91 92899 25657.
Ashish Chaudhary is the Founder and Managing Director of Northrop Management Private Limited, a forensic accounting, corporate governance, and financial advisory firm headquartered in Noida, with presence in Mumbai.
Visit: northropindia.com
Related Insights from Northrop Management:
- Forensic Investigations | How Northrop approaches fund flow reconstruction and entity network analysis
- Corporate Governance Advisory | Building board-level oversight that catches what statutory audits miss
- Due Diligence | Vendor verification, borrower forensics, and transaction-ready assessments
- Risk Advisory | Enterprise risk management and internal controls for fraud prevention
- Financial Advisory | CFO advisory, financial reporting, and regulatory compliance support
© 2026 Northrop Management Private Limited. All rights reserved.