Nobody stole a large sum on day one. A policy was bypassed once because a supplier needed urgent payment. An approval was taken on a phone call. A photocopied invoice was accepted because the amount was small and the explanation sounded reasonable. Nobody objected, so it happened again, and then again. Eighteen months later, the exception had become the process and the losses were real. This article explains how frauds grow from tolerated exceptions, the warning signs internal audit should look for, the controls that matter most, and what to do when a pattern appears.
Most corporate frauds start with small control exceptions that are accepted without challenge: informal approvals, unverified documents, master data changes without review, and delayed reconciliations. When the same exception repeats and nobody questions it, it creates the opportunity for fraud. Internal audit detects this early by analysing exceptions, overrides, master data changes and period-end transactions as patterns rather than isolated items.
How small exceptions turn into fraud
Fraud is rarely a single large event. It grows where three conditions meet, often described as the fraud triangle: pressure (personal debt, targets, lifestyle), opportunity (weak or bypassed controls) and rationalisation ('I will pay it back', 'the company owes me'). Of the three, opportunity is the one an organisation controls directly.
Opportunity is created gradually. The first exception is usually genuine: a real emergency, a trusted employee, a small amount. The problem is not the exception itself; it is that nobody records it, reviews it or asks why it recurs. Each tolerated deviation tells the organisation's people what the real rules are.
- Exception. A control is bypassed for a plausible reason and the amount is immaterial.
- Repetition. The same shortcut is used again because it worked and nobody objected.
- Normalisation. The shortcut becomes the expected way of working; questioning it feels obstructive.
- Exploitation. Someone realises the gap can be used for personal benefit with little chance of detection.
- Concealment. Reconciliations are delayed, documents are recreated and explanations become routine.
By the time losses become visible in the financial statements, the gap has usually existed for a long time.
Where small exceptions most often lead to fraud
A common thread runs through all six: one person can initiate, approve and record a transaction, or can change master data that others rely on, without anyone independent checking.
Early warning signs internal audit should track
Individual exceptions mean little. Patterns mean a lot. Internal audit should look for:
- Repeated management overrides by the same person or for the same vendor or customer.
- Segregation of duties not enforced, especially where system access allows one user to create a vendor and process its payment.
- Vendor and employee master changes without review, particularly bank account changes shortly before a payment run.
- Reconciliations delayed or unsupported, such as bank, vendor, inventory or suspense accounts with old reconciling items.
- Unusual transactions near reporting dates, including round-sum entries, reversals early in the next period and manual journals by senior users.
- Invoices clustered just below approval limits.
- An employee who never takes leave or resists handing over work.
- Complaints from vendors or customers about payments or balances that do not match.
A bank payment, a GST invoice or a signed delivery note does not by itself prove a transaction is genuine. Fraudsters create documents precisely because they know a document check is the only control. Our article on why bank payment is not proof of a genuine transaction explains this from the tax angle.
Illustrative example: the vendor that was approved once
An accounts executive is allowed to create vendors because the purchase manager is often travelling. One new 'service vendor' is created with a bank account belonging to the executive's relative. The approval limit for the purchase manager is ₹50,000, above which the CFO must approve.
Over 18 months, the vendor submits 26 invoices for 'maintenance services', each between ₹45,000 and ₹49,500, averaging ₹47,500. Total payments are ₹12,35,000. Each invoice is within the manager's limit and is approved on email without checking a service report. The bank reconciliation is current, so nothing looks wrong in the books.
A simple analysis would have flagged it: a new vendor with no GST history at that address, invoices just below the threshold, no service records, and a bank account changed a week after onboarding.
The loss was not caused by one failure. It was caused by three tolerated exceptions: vendor creation without independent verification, approvals without supporting evidence, and no analysis of payments near approval limits.
Fraud reporting and whistle-blower requirements
| Provision | What it requires |
|---|---|
| Section 143(12), Companies Act, 2013 | The statutory auditor reports suspected fraud by officers or employees to the board or Audit Committee within two days of knowledge, and to the Central Government in Form ADT-4 where the amount is ₹1 crore or more; smaller frauds reported to the board are disclosed in the board's report |
| Section 177(9) and (10) | Listed companies and specified classes of companies must establish a vigil mechanism for directors and employees to report genuine concerns, with safeguards against victimisation |
| CARO 2020 clause 3(xi) | The auditor reports whether any fraud by or on the company was noticed, whether a section 143(12) report was filed, and whether whistle-blower complaints received were considered |
| SA 240 | The statutory auditor identifies and responds to fraud risks, including the risk of management override, but the primary responsibility for prevention and detection rests with management and those charged with governance |
The last point is often misunderstood. The statutory audit is not designed to find every fraud. Prevention and early detection depend on the company's own controls and on internal audit.
Controls that stop small exceptions from growing
- Exception register. Every policy deviation is logged with reason, approver and date, and reviewed monthly for repeats.
- Independent master data control. Vendor, customer and employee master changes, especially bank details, are verified by someone outside the payment team, with call-back confirmation.
- System-enforced segregation of duties. Access rights prevent one user from creating a vendor, posting an invoice and releasing payment.
- Three-way match. Purchase order, goods or service receipt and invoice must agree before payment.
- Timely reconciliations with review. Bank, vendor, inventory and suspense reconciliations are prepared on time and signed by a reviewer who examines old items.
- Data analytics. Periodic tests for duplicate payments, threshold splitting, vendor-employee bank account matches and weekend or late-night postings.
- Mandatory leave and job rotation for sensitive finance roles.
- A working vigil mechanism that people trust and use.
Our internal audit and corporate governance guide explains how such tests fit into a risk-based internal audit plan and Audit Committee reporting.
What to do when a pattern appears
When internal audit finds a pattern that may indicate fraud, the response should be measured and documented. Preserve evidence first: secure system logs, master data histories and documents before anyone is alerted. Escalate to the Audit Committee chair or the designated authority under the company's policy rather than to the line management involved.
Avoid accusations before facts are established. Fix the control gap immediately, even while the investigation continues, so that losses stop. Then assess whether the statutory auditor, lenders or regulators need to be informed, and take legal advice on recovery and further action.
Fraud risk checklist: are small exceptions being challenged?
- Is there an exception or override register, and does someone review it for repeats?
- Are vendor and employee master changes verified independently, including bank details?
- Do system access rights enforce segregation of duties, and are they reviewed at least half-yearly?
- Are bank, vendor and suspense reconciliations prepared on time and reviewed?
- Are payments analysed for threshold splitting, duplicates and unusual timing?
- Are period-end and reversing journal entries reviewed?
- Do staff in sensitive roles take mandatory leave?
- Is the vigil mechanism publicised, accessible and trusted?
- Does the Audit Committee receive a summary of exceptions and fraud risk indicators?
Frequently asked questions
How do most corporate frauds start?
Most start with small control exceptions that are accepted without challenge, such as informal approvals or unverified documents. When the same exception repeats and is not questioned, it creates an opportunity that someone eventually exploits.
What is the fraud triangle?
It describes three conditions usually present in fraud: pressure or incentive, opportunity, and rationalisation. Organisations have the most control over opportunity, which is reduced through strong, consistently enforced controls.
What are common red flags of fraud in a company?
Repeated overrides, segregation of duties not enforced, master data changes without review, delayed or unsupported reconciliations, invoices just below approval limits and unusual transactions near period end.
Is the statutory auditor responsible for detecting fraud?
The statutory auditor must assess and respond to fraud risks under SA 240 and report under section 143(12) where applicable. However, the primary responsibility for preventing and detecting fraud lies with management and the board.
Which companies must have a vigil mechanism?
Under section 177(9) of the Companies Act, 2013, listed companies and prescribed classes of companies, such as those accepting public deposits or with specified levels of bank borrowings, must establish a vigil mechanism. Many other companies adopt one voluntarily as good practice.
When must an auditor report fraud to the Central Government?
Where the auditor has reason to believe that fraud involving ₹1 crore or more is being or has been committed by officers or employees, it is reported to the Central Government in Form ADT-4 after following the board or Audit Committee reporting process.
Conclusion
Controls do not fail overnight. They erode gradually when minor exceptions are accepted as normal. The organisations that avoid large frauds are not those without exceptions, but those that record, question and learn from every exception before it becomes a habit.
Internal audit's contribution is to look at exceptions as patterns, test the controls that create opportunity, and give the Audit Committee early sight of where discipline is slipping.
Need a fresh look at your internal controls?
H K Davra & Co. supports companies with risk-based internal audit, internal financial controls testing and Audit Committee reporting.
Talk to usThis article is for general information only and does not constitute professional advice or solicitation. Examples are illustrative and do not refer to any specific company. Provisions are summarised as of October 2026. Please refer to the relevant provisions and seek advice on your specific facts.