Loading
Risk Management Services
We help organizations identify, assess, and mitigate risks through structured frameworks, forensic insights, and audit-driven assurance.
For a foreign parent company running an Indian subsidiary, joint venture, or liaison office, the annual statutory audit answers one question — do the financial statements give a true and fair view. It does not tell the board whether internal controls are strong enough to prevent a finance manager from routing payments to a shell vendor, whether a joint-venture partner’s reported numbers can be trusted, or whether the company is ready for a lender- or regulator-directed review. That is where enterprise risk management, forensic services, and special audits come in — and where we typically get called in. For a US parent, this risk oversight sits alongside the Operate stage of our India entry guide for US companies:
- The board or overseas HQ wants assurance beyond the statutory auditor’s sign-off.
- A whistleblower complaint, anonymous tip, or unexplained variance surfaces.
- A lender, investor, or JV partner requires an independent review under a loan or shareholders’ agreement.
- A regulator — the RBI, MCA/ROC, or SEBI — directs or requests a special audit.
- Pre-acquisition or pre-investment due diligence needs a forensic lens, not just a financial one.
- Internal audit becomes mandatory under Section 138 as the company crosses turnover, capital, or borrowing thresholds.
Risk Management Services
Enterprise Risk Management (ERM)
Identifying, assessing, and mitigating enterprise-wide risks aligned with business strategy.
Talk to an expert →
Internal Control Framework
Designing and implementing robust internal control systems for operational efficiency.
Talk to an expert →
Risk Assessment & Gap Analysis
Evaluating risk exposure and identifying gaps in controls and compliance.
Talk to an expert →
Process Improvement & SOP Design
Optimizing business processes with structured SOPs to enhance efficiency and control.
Talk to an expert →
An enterprise risk management engagement typically starts with a structured risk register — mapping operational, financial, regulatory, and reputational risks against likelihood and impact — and ends with a control framework the finance and operations team can actually run day to day, not just present to the board once a year.
For companies preparing their statutory audit, this work also feeds directly into the auditor’s opinion on Internal Financial Controls over Financial Reporting (IFC-FR) required under Section 143(3)(i) of the Companies Act, 2013. Weak IFC design or operation is one of the more common qualification triggers we see in first- and second-year India subsidiaries of foreign parents.
Forensic Services
Fraud Investigation
In-depth investigation into suspected fraud and financial misconduct.
Talk to an expert →
Forensic Audit
Audit procedures to uncover irregularities and financial discrepancies.
Talk to an expert →
Litigation Support
Expert reporting and support for legal disputes and proceedings.
Talk to an expert →
Data Analytics & Fraud Detection
Using analytics to identify anomalies and fraud risks.
Talk to an expert →
A forensic audit is not a deeper version of the statutory audit — it is a different discipline. A statutory auditor tests samples against accounting standards to form an opinion on the financial statements as a whole. A forensic engagement starts from a specific allegation or red flag — a whistleblower complaint, an unexplained variance, a vendor nobody can identify — and works backwards through transactions, correspondence, and system logs to establish what happened, who was involved, and how much money moved. The output is built to hold up under scrutiny in an internal disciplinary proceeding, an arbitration, a police complaint under the Bharatiya Nyaya Sanhita, or a regulatory inquiry — not just to support an audit opinion.
A typical forensic engagement runs through four stages
- Scoping & evidence preservation — defining the allegation and locking down relevant systems, mailboxes, and financial records before anyone has a chance to alter them.
- Data analytics & transaction testing — screening the full population of transactions (not a sample) for anomalies such as duplicate payments, related-party transactions routed through unfamiliar vendors, or round-tripping.
- Interviews & documentation review — structured interviews with relevant personnel, cross-checked against physical and digital evidence.
- Reporting & next steps — a findings report built for its actual audience — board, lender, or legal counsel — with clear recommendations on recovery, disciplinary action, or regulatory disclosure.
Under Section 143(12) of the Companies Act, 2013, a statutory auditor who has reason to believe a fraud is being or has been committed against the company must report it — to the Audit Committee or Board if the amount involved is below the prescribed threshold, or to the Central Government, in Form ADT-4, if it is ₹1 crore or above. A forensic audit is frequently what substantiates or rules out that suspicion before the auditor has to make that call.
Special Audit & Review
Internal Audit
Independent evaluation of internal processes and governance.
Talk to an expert →
Compliance Audit
Ensuring adherence to statutory and regulatory requirements.
Talk to an expert →
Operational Audit
Assessing efficiency and effectiveness of business operations.
Talk to an expert →
Due Diligence Review
Comprehensive review for investments, mergers, and acquisitions.
Talk to an expert →
“Special audit” covers audits triggered by someone other than the company’s own annual compliance calendar. In our experience with foreign-owned subsidiaries, the request usually comes from one of four places: a lender or investor exercising an inspection right under a loan agreement or shareholders’ agreement, a joint-venture partner disputing reported numbers, a Registrar of Companies inquiry under Sections 206–208 of the Companies Act, 2013, or a sector regulator — the RBI for NBFCs and banks, SEBI for listed entities — directing a review. Because it is initiated by an outside party, scope, access, and timelines are usually set by whoever ordered it, not by the company.
Does your subsidiary need a mandatory internal audit?
Internal audit is mandatory, not optional, once an Indian company crosses any of these thresholds under Section 138 of the Companies Act, 2013 (Companies (Accounts) Rules, 2014, Rule 13):
- Every listed company, regardless of size.
- Every unlisted public company with paid-up share capital of ₹50 crore or more, turnover of ₹200 crore or more, outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore, or outstanding deposits of ₹25 crore or more, at any point in the preceding financial year.
- Every private company with turnover of ₹200 crore or more, or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore, at any point in the preceding financial year.
A growing India subsidiary of a foreign parent can cross the private-company turnover threshold well before it would consider itself “large” by its home-country standards — worth checking every year, not just at incorporation. Separately, CARO 2020 requires the statutory auditor to state whether any fraud on or by the company has been noticed or reported during the year, and whether a Section 143(12) report, if any, has been filed in Form ADT-4 — one more reason internal-control and forensic readiness now sits upstream of the audit sign-off, not downstream of it.
Our Approach
Whether the engagement is a routine ERM review or a forensic investigation triggered by a specific complaint, the underlying process is the same four steps — scoped differently depending on what brought you to us.
1. Scope & Risk Assessment
We map the specific risk, allegation, or regulatory trigger against your business and your India entity structure — no generic checklist.
Talk to an expert →
2. Fieldwork, Testing & Analytics
Transaction testing, control walkthroughs, and data analytics across the full population of relevant data, not a sample.
Talk to an expert →
3. Findings & Reporting
A report built for its actual audience — board, lender, regulator, or legal counsel — with evidence that holds up under scrutiny.
Talk to an expert →
4. Remediation & Monitoring
Practical fixes to controls, SOPs, and reporting lines, with a follow-up review to confirm they are actually working.
Talk to an expert →
Frequently Asked Questions
What's the difference between a statutory audit, an internal audit, and a forensic audit?+
A statutory audit gives an opinion on whether the financial statements are true and fair, for shareholders and regulators. An internal audit evaluates whether internal controls and processes are working, is management-facing, and — above the Section 138 thresholds — mandatory. A forensic audit investigates a specific suspected fraud or irregularity and produces evidence suitable for litigation, arbitration, or regulatory disclosure. Different scope, different audience, different trigger.
Does my Indian subsidiary need a mandatory internal audit?+
It depends on whether you cross the thresholds under Section 138 of the Companies Act, 2013 and Rule 13 of the Companies (Accounts) Rules, 2014 — based on paid-up capital, turnover, outstanding borrowings, or deposits. Listed companies always need one; unlisted public and private companies need one once they cross specific size thresholds. We check this against your latest financials as part of the initial assessment.
When would a special audit be required, and who orders it?+
Usually a lender, investor, joint-venture partner, or a regulator such as the RBI, SEBI, or the Registrar of Companies — rather than the company itself. Because an outside party initiates it, that party typically sets the scope, access requirements, and timeline.
Can forensic audit findings be used in a legal proceeding?+
Yes — that is a core reason evidence is preserved and documented properly from the outset. Findings are built to be produced before arbitrators, courts, or regulators, though how much weight they carry ultimately depends on the specific tribunal or forum.
How long does a forensic audit take?+
It varies widely depending on the volume of transactions, how quickly records and systems were preserved, and how many jurisdictions or entities are involved. We scope timelines at the outset of each engagement rather than quoting a generic duration up front.
Is enterprise risk management only relevant for large companies?+
No. Smaller subsidiaries often carry more concentration risk — fewer people wearing more hats, weaker segregation of duties — which can make a lean control framework more urgent, not less, even though the formal ERM process scales with company size.
Do these services replace our statutory auditor?+
No. They typically run alongside, not instead of, your statutory audit. Where independence rules require separation between audit and advisory work — for example if we are also your statutory auditor — we structure the engagement accordingly.
Related Resources
Accounting & AssuranceFinancial statements, Ind AS/IFRS, and audit assurance support.Transaction AdvisoryDue diligence for M&A, fundraising, and restructuring.Taxation & RegulatoryDirect tax, GST, and FEMA/RBI regulatory compliance.Regulatory Compliance in IndiaOngoing statutory and secretarial compliance for foreign-owned entities.
Talk to an Expert