Forensic accounting suits Chartered Accountants who like following evidence, rebuilding transactions and explaining exactly how a financial irregularity happened. It differs from statutory audit in where it starts: not with a set of financial statements to report on, but with an allegation, a suspicious pattern, a disputed transaction or a suspected control failure. The professional's job is to build a chain from source data to findings that can stand up to review by a board, a lawyer, a regulator or a court. This guide walks through how an investigation actually runs, the professional standards that now govern it in India, the ICAI qualification route, and how to turn an audit, tax or finance background into a credible forensic profile.
The standards that now govern forensic engagements in India
Forensic work by CAs is no longer guided only by general auditing practice. ICAI's Digital Accounting and Assurance Board (DAAB) released the revised Forensic Accounting and Investigation Standards (FAIS) and an Implementation Guide on 27 July 2023, stating that "these standards have now become mandatory for all the engagements conducted on or after 01st July 2023." Any CA taking on a forensic accounting or investigation engagement is therefore expected to plan, gather evidence, document and report in line with FAIS.
The standards continue to evolve. On 29 May 2025 ICAI issued exposure drafts of updated FAIS and the Implementation Guide for comment. ICAI said the update aims to "enhance global applicability by making them generic and country agnostic" and to "align the standards with continuing technical developments and emerging forensic techniques." Anyone entering the field should read the current version of FAIS on ICAI's website rather than rely on older summaries.
Anatomy of an investigation: a vendor-payment case
The clearest way to understand the work is to follow one case from start to finish. A company receives a whistle-blower complaint that a purchase manager is routing orders to a vendor connected to him. Here is how a forensic team would approach it.
Step 1: Frame the allegation and the hypotheses
The team writes down exactly what is alleged and then lists competing explanations: a connected vendor receiving inflated orders; payments for goods never supplied; genuine purchases from a legitimate vendor that happens to share an address; or a simple control weakness with no dishonesty. Keeping innocent explanations on the list from the start is what separates an investigation from a witch-hunt.
Step 2: Secure the data before anyone is alerted
The team obtains the vendor master with its change history, the purchase and payment ledgers, approval logs, bank statements and, where lawful and authorised, email and system access records. Electronic evidence is copied in a way that preserves its integrity. Interviews come later, after the documents have been examined.
Step 3: Analyse the whole population
Suppose the payment ledger holds 18,400 payments in the period, and payments above Rs. 5 lakh need a second approver. The team finds 212 payments between Rs. 4.75 lakh and Rs. 5 lakh, against only 38 between Rs. 5 lakh and Rs. 5.25 lakh. A band just under the threshold holding about 5.6 times as many payments as the band just above it is a classic sign that invoices may be sized to avoid a second approval. A duplicate test on vendor, amount and invoice date within 30 days finds 37 matching pairs worth Rs. 61.8 lakh in total, or about Rs. 1.67 lakh per pair on average.
Other tests run at the same stage: vendor bank accounts and addresses compared with employee records, round-amount payments, weekend and holiday postings, sequential invoice numbers from a single vendor, and manual journals near period-end.
Step 4: Trace selected transactions to source
For a sample of exceptions, the team traces each payment backwards: purchase requisition, purchase order, goods receipt or service evidence, invoice, approval trail and bank transfer. The question is not only what was booked, but who initiated it, what evidence existed at the time and whether the commercial purpose fits the surrounding facts.
Step 5: Interview with evidence in hand
Only now are the purchase manager and others interviewed. Questions move from open ("walk me through how this vendor was onboarded") to clarification to contradiction ("the bank account on this vendor's master record matches the one on your salary file; can you explain that?"). Interviews are recorded and the notes preserved.
Step 6: Report what is proven and what is not
The report separates three categories: facts established by evidence, matters that are suspicious but unresolved, and further work needed. A conclusion must never go beyond the evidence. If the duplicate payments turn out to be a system error, the report says so.
Skills that transfer from each CA background
| Background | What transfers | What to add |
|---|---|---|
| Statutory audit | Evidence evaluation, journal testing, documentation | Hypothesis-led testing and whole-population data analysis |
| Internal audit | Process walkthroughs, control design, root-cause analysis | Thinking like the person exploiting a weak control |
| Tax and GST | Invoice scrutiny, related-party structures, document inconsistencies | Tracing money flows across bank records and entities |
| Controllership and finance | How ERP postings, approvals and month-end close really work | Independence of mind and formal interview technique |
Across all backgrounds, three capabilities matter most: transaction reconstruction (moving from financial statement to ledger, source document, bank movement and approval), evidence discipline (every conclusion referenced to its source, facts separated from assumptions), and data analysis on full populations rather than samples. Awareness of digital evidence is also expected: you do not need to be a digital-forensics engineer, but you must know when emails, logs and device data need a specialist to preserve them properly.
The ICAI qualification route
ICAI's DAAB offers the Certificate Course on Forensic Accounting and Fraud Detection (FAFD). According to the course page, it runs over six months in a hybrid format: 17 hours and 30 minutes of e-learning plus seven full days of in-person professional training. The e-learning covers fundamentals of forensic accounting, fraud concepts, interviews, banking case studies, red flags, financial statement analysis and IT and business laws. The classroom days cover MS Excel, fraud investigation methods, computer-assisted audit tools, digital forensics, cyber law and internal financial controls.
- Fee: Rs. 16,520 per delegate (Rs. 14,000 plus 18 percent GST).
- Assessment: module tests and project work of 100 marks, with 50 percent needed to qualify, followed by a 100-mark FAFD assessment test held quarterly in March, June, September and December; the pass mark is 50 percent in aggregate.
- CPE: 20 hours in total, of which 15 are granted for at least 90 percent attendance and 5 on passing the assessment.
The certificate signals commitment, but employers hire on evidence of investigative thinking. Treat the course as a structured foundation, not a substitute for case work.
Building a case portfolio before you apply
Instead of a generic study timetable, build three short case files from fictional facts and be ready to talk through each one:
- Duplicate or split vendor payments: threshold analysis, duplicate tests and tracing to purchase orders, as in the case above.
- Unusual year-end journals: manual entries posted after hours or by unusual users, reversed early in the next period, and their effect on revenue or profit.
- Employee expense abuse: duplicate claims, weekend claims, round amounts and claims just under approval limits.
For each, write the allegation, hypotheses, data requested, tests performed, exceptions, and a conclusion that states what remains unproven. In interviews, expect a case exercise: you receive an allegation and must name the first five data sets you would request, explain your tests and say what evidence would change your view. Rewrite your CV around anomalies you found and resolved, not just the industries you audited.
Mistakes to avoid
- Expecting dramatic interviews rather than long hours of document and data work.
- Relying on accounting knowledge while neglecting data analysis and electronic evidence.
- Writing conclusions stronger than the evidence.
- Treating every anomaly as fraud instead of testing error, process weakness and legitimate explanations.
- Collecting certificates without building practical case samples.
Is forensic work right for you?
It is a strong fit if you are comfortable with ambiguity, enjoy detailed evidence and data patterns, and can explain a complicated financial story plainly. It is less attractive if you prefer fixed, repeatable procedures with little uncertainty. Early in the move, put evidence discipline, transaction reconstruction and data analysis ahead of memorising fraud typologies, and use FAIS as your professional framework from the first engagement.
Updated on 27 September 2026: rewritten around a step-by-step investigation with worked threshold and duplicate-payment figures, added the May 2025 FAIS exposure drafts and verified FAFD course fee, assessment and CPE details from ICAI.
