Fraud Risk Management Training

Section 447 of the Companies Act, 2013 defines fraud in relation to the affairs of a company or body corporate very widely: any act, omission, concealment of any fact or abuse of position, committed with intent to deceive, to gain undue advantage from, or to injure the interests of the company, its shareholders, its creditors or any other person. It does not matter whether there is any actual wrongful gain or loss.

Where the fraud involves at least ten lakh rupees or one per cent of the company's turnover, whichever is lower, the punishment is imprisonment of six months to ten years and a fine of at least the amount involved and up to three times that amount. If the fraud involves public interest, the minimum term is three years. Smaller frauds that do not involve public interest are punishable with imprisonment up to five years, or a fine up to fifty lakh rupees, or both. Section 448 applies the same punishment to anyone who knowingly makes a materially false statement, or omits a material fact, in a return, report, financial statement or other document required under the Act.

Under section 143(12), if a company's auditor, in the course of the audit, has reason to believe that an offence of fraud is being or has been committed in the company by its officers or employees, the auditor must report it. Frauds involving an amount at or above the threshold prescribed in the rules go to the Central Government; smaller frauds go to the audit committee or, where there is none, the Board. Companies whose auditors reported frauds only to the audit committee or Board must disclose the details in the Board's report.

Section 143(13) protects an auditor who reports in good faith, and section 143(14) extends the same duty to cost accountants conducting cost audit and company secretaries in practice conducting secretarial audit. Under section 143(15), failure to comply attracts a penalty of five lakh rupees for a listed company's auditor and one lakh rupees in any other case.

Every listed company, and other classes of companies prescribed by rules, must establish a vigil mechanism for directors and employees to report genuine concerns. The mechanism must provide adequate safeguards against victimisation of people who use it, and direct access to the chairperson of the Audit Committee in appropriate or exceptional cases. Details of the mechanism must be disclosed on the company's website, if any, and in the Board's report. The mechanism only works if staff know the channel exists and trust that it is safe to use.

For commercial banks, the Reserve Bank of India (Commercial Banks - Fraud Risk Management) Directions, 2026, dated 31 July 2026, replace earlier instructions on the subject. They apply to banking companies other than small finance banks, payments banks and local area banks, to corresponding new banks and to the State Bank of India. Other classes of regulated entity should check the RBI directions issued for them.

Banks must have a Board-approved policy on fraud risk management covering prevention, early detection, investigation, staff accountability and reporting, reviewed by the Board at least once every three years (paragraphs 5 and 7). A Special Committee of the Board for Monitoring and Follow-up of cases of Frauds, with at least three Board members including a whole-time director, oversees the framework (paragraph 8). Banks must have a transparent mechanism for examining whistle blower complaints on possible fraud (paragraph 10) and must examine staff accountability in all fraud cases in a time-bound manner (paragraph 36). Individual fraud cases must be reported to RBI through the Fraud Monitoring Return immediately, and no later than 14 days from the date an incident or account is classified as fraud (paragraph 49).