The Concern
During a quarterly reconciliation, a regional distribution company’s finance team found a variance of [₹X lakh]. Read More
What We Did
Defined the question. We agreed three objectives with the client: establish whether the unexplained payments were fraudulent; if so... Read More
What We Found
The routine explanations didn’t hold. None of them accounted for the pattern. Read More
The Outcome
Clarity: The client knew what happened, how it was done, who was involved and the full extent of the loss. Read More
The Concern
During a quarterly reconciliation, a regional distribution company’s finance team found a variance of [₹X lakh]. Compared with total spend it was small, so it was first put down to timing differences and coding errors.The same gap came back the next quarter, and again the quarter after that.Every payment involved looked legitimate. Each had an invoice and a purchase order, and each had been approved through the correct workflow. Nothing on the surface pointed to fraud, but nothing explained the gap either.
The CFO needed to know whether this was an accounting issue or something more serious, without alarming the finance team or accusing anyone. An internal review wasn’t a reliable option, because anyone in a position to review the payments could also have made them. The company needed findings that management, auditors and legal counsel could rely on, from someone outside the reporting line.
What We Did
Defined the question. We agreed three objectives with the client: establish whether the unexplained payments were fraudulent; if so, work out how the scheme was carried out and who was involved; and measure the full financial exposure.
Followed the evidence. We analysed [three years] of accounts payable data, vendor master records, bank payment files and invoice documents. Under the client’s authorisation and data policies, we also reviewed system access logs and relevant company email records.
Ruled out the obvious explanations first. A discrepancy is not automatically fraud. We tested timing differences, miscoding and duplicate entries before looking at anything else.
Verified the vendors behind the pattern. We checked trading addresses, tax registrations and delivery records. We traced bank account ownership through lawful public-record and corporate registry checks.
Documented everything for action. We delivered a structured report that set out the sequence of events and the evidence behind each finding. Confirmed findings were kept separate from matters that needed further inquiry. All evidence was preserved so it could support legal proceedings.
What We Found
- The routine explanations didn’t hold. None of them accounted for the pattern. What remained was a cluster of payments to two vendors, almost all falling within [5%] of the single-approval threshold.
- The vendors had no real business behind them. Neither had a verifiable trading address, a tax registration matching its invoices, or any record of deliveries in the warehouse system.
- The links pointed inward. The same user account had created both vendors in the vendor master. Their registered bank accounts traced back to individuals connected to an accounts payable employee. Invoice templates recovered from company systems matched the documents that had been submitted.
- The exposure was larger than the variance suggested. Total losses came to [₹X crore] over [14 months].
- The controls had gaps that made it possible. The same people could create vendors and process payments. New vendors were never independently verified. Approval thresholds were easy to stay just below.
The Outcome
- Clarity: The client knew what happened, how it was done, who was involved and the full extent of the loss.
- A basis for action: Management and legal counsel had documented, evidence-backed findings to support disciplinary action, legal proceedings and recovery. We worked with counsel on the recovery options.
- Discretion throughout: The investigation was completed without disrupting the finance function or alerting the people involved too early.
- Controls that close the gap: The company separated vendor-creation rights from payment rights, introduced independent verification of new vendors, and added automated flags for payments that cluster near approval thresholds.
No single payment looked wrong, because the scheme was built to pass individual checks. What gave it away was the pattern.Fraud rarely sits in one transaction. It sits in the space between controls, where every step looks normal on its own.