Section 143(12) of the Companies Act, 2013 creates a specific statutory reporting route when a company auditor comes across a suspected fraud in the course of audit work. The key practical question is not simply whether “fraud exists”. The auditor must determine whether the matter falls within the prescribed reporting threshold, identify the correct recipient, follow the statutory timeline and preserve a defensible audit trail.
The current Rule 13 framework is available in the ICSI Companies Act e-book on reporting of frauds by auditors. ICAI also maintains its Revised Guidance Note on Reporting on Fraud under Section 143(12) and lists that guidance in its official auditing guidance-note collection. Because Rule 13 was amended after the Guidance Note was issued, the current statutory rule and current electronic filing process should control any live filing.
First distinction: Section 143(12) reporting is not the same as fraud-risk audit work
Fraud considerations in a financial statement audit affect risk assessment, procedures, communication and documentation. Section 143(12), however, is a separate legal reporting obligation. A practical file should answer two questions separately: what audit work is required because of the suspected fraud, and what Companies Act reporting is required?
The ₹1 crore threshold: what changes?
Under Rule 13, where a statutory auditor has reason to believe that a fraud against the company by its officers or employees involves, or is expected to involve, ₹1 crore or more individually, the matter is reportable to the Central Government through the prescribed process.
Where the amount is less than ₹1 crore, the reporting route is different. The auditor reports the matter to the Audit Committee constituted under section 177 or, where applicable, to the Board. The threshold therefore changes the statutory destination; it does not mean a below-threshold matter can simply be ignored.
Step-by-step timeline for a ₹1 crore-or-more fraud
- Report to the Board or Audit Committee within two days. Rule 13 requires the auditor to report the matter immediately, but not later than two days after knowledge of the fraud, and seek the Board's or Audit Committee's reply or observations within 45 days.
- If a reply is received, act within 15 days. The auditor must forward the report, the Board or Audit Committee's reply or observations, and the auditor's comments on that reply to the Central Government within 15 days from receipt.
- If no reply arrives within 45 days, do not wait indefinitely. The auditor forwards the report to the Central Government together with a note describing the earlier report sent to the Board or Audit Committee and the fact that no reply or observations were received.
- Use the current electronic ADT-4 route. The amended Rule 13 states that the report to the Central Government is filed electronically in Form ADT-4. The ICSI e-book also records that the earlier postal-reporting clause was replaced and the old ancillary clauses were omitted under the 2025 amendment.
What must be reported when the amount is below ₹1 crore?
For a fraud involving less than the prescribed ₹1 crore threshold, Rule 13 requires reporting to the Audit Committee or Board immediately but not later than two days after the auditor's knowledge. The report should specify:
- the nature of the fraud with a description;
- the approximate amount involved; and
- the parties involved.
Rule 13 also links these below-threshold reports to the Board's Report. For frauds reported to the Audit Committee or Board during the year, the Board's Report is required to disclose the prescribed particulars, including the nature of the fraud, approximate amount, relevant party information in the circumstances specified by the rule, and remedial action taken.
Worked example: suspected employee diversion of ₹1.25 crore
Assume the statutory auditor obtains evidence indicating that an employee may have diverted company collections through a controlled bank account and the suspected amount is approximately ₹1.25 crore. The audit team should not wait for the entire forensic exercise to finish before considering Rule 13. Once the statutory trigger of having reason to believe is reached, the two-day reporting clock to the Board or Audit Committee becomes critical.
The auditor would document the basis for the belief, report the matter to the appropriate governance body within the Rule 13 timeline and seek observations within 45 days. If observations are received, the auditor would evaluate them, add comments and complete the Central Government reporting step within 15 days of receipt. Under the current rule, that Central Government report is filed electronically in ADT-4.
If the same fact pattern involved an individually assessed amount below ₹1 crore, the Rule 13 route would generally remain with the Audit Committee or Board rather than move to Central Government reporting under sub-rule (2), while the audit consequences of the suspected fraud would still need to be addressed.
Do not mechanically aggregate unrelated frauds
Rule 13 applies the ₹1 crore test to a fraud that “individually” involves or is expected to involve that amount. Audit teams should therefore avoid casually aggregating unrelated incidents or artificially splitting one connected scheme. Document the actors, method, period and linkage among transactions before concluding whether matters are one fraud or separate frauds.
Documentation checklist for the audit file
- Trigger memo: record when the team obtained the information and why it created reason to believe that a fraud may have occurred.
- Amount assessment: document the known and expected financial exposure and how the individual-fraud threshold was evaluated.
- Scope and parties: identify the persons involved, affected locations, accounts, transactions and periods.
- Governance communication: retain the dated communication to the Board or Audit Committee and proof of delivery.
- 45-day tracking: record the date by which the requested reply or observations are due.
- Auditor comments: where a reply is received, document the auditor's evaluation rather than merely forwarding management's response without analysis.
- ADT-4 evidence: retain the filed electronic form, attachments and acknowledgement where Central Government reporting applies.
- Financial statement impact: separately consider misstatement, disclosures, control implications and the effect on the auditor's report.
Common mistakes to avoid
- Assuming only frauds above ₹1 crore need any reporting.
- Waiting for a final forensic report before even evaluating the statutory trigger and two-day timeline.
- Using the old physical-post reporting procedure instead of the current electronic ADT-4 requirement.
- Treating the Board's reply as the auditor's conclusion without independent evaluation.
- Forgetting the Board's Report disclosure consequences for below-threshold matters reported under Rule 13.
- Failing to distinguish statutory fraud reporting from the separate audit response to fraud risk and possible financial-statement misstatement.
Does Rule 13 apply only to statutory auditors?
Rule 13 states that its provisions also apply, with necessary changes, to a cost auditor and a secretarial auditor while performing their respective statutory duties.
Practical takeaway
The most useful Section 143(12) workflow is a decision tree: establish the reason-to-believe trigger, assess the individual amount, report to the correct governance body within two days, track the 45-day response window, and use electronic ADT-4 where Central Government reporting applies. Keep the statutory reporting file separate but connected to the audit work on fraud, financial-statement impact and controls. Before any live filing, recheck the current Rule 13 text and MCA filing requirements because forms and procedures can change.
