Auditor Fraud Reporting: How Section 143(12) and Form ADT-4 Can Put Your Board in NFRA’s Crosshairs

Auditor Fraud Reporting: How Section 143(12) and Form ADT-4 Can Put Your Board in NFRA's Crosshairs

Last updated: 16 September 2026 · By CS Sapna Malpani, Practising Company Secretary, Bangalore

When NFRA penalised the statutory auditor of a Coffee Day group company, the headline number was ₹5 lakh and a multi-year debarment. The actual finding was sharper. The regulator held that the auditor "failed to report the offence of fraud to the Government of India and thus violated section 143(12)" while roughly ₹3,535 crore was being diverted from subsidiaries. The audit paperwork was not the problem. The silence was. Auditor fraud reporting is now the fault line where boards, promoters and their own auditors part company, and most private companies still treat it as somebody else's rule.

Why auditor fraud reporting has become a board-level risk

Section 143(12) of the Companies Act, 2013 gives the auditor a statutory duty that runs straight past the management. If the auditor, during the audit, has reason to believe that an offence of fraud is being or has been committed against the company by its officers or employees, the auditor must report it. Where the amount is ₹1 crore or more, the report goes to the Central Government. The company cannot instruct the auditor to hold back, and the auditor cannot resign the problem away.

For years this sat quietly in the statute. That has changed. Between 2022 and 2025 the National Financial Reporting Authority debarred 85 chartered accountants and imposed penalties on 103 professionals. A recurring theme in the orders is not a botched audit procedure but a delayed or missing fraud report. In the Reliance Capital matter, NFRA imposed penalties totalling ₹4.5 crore across the firm and two engagement partners, with debarments of 10 and 5 years. The direction of travel is settled: the regulator treats the failure to escalate as a primary offence, not a footnote.

The part that catches boards off guard is the reach. A promoter-led private company with ₹40 crore of revenue assumes NFRA is a listed-company concern. The fraud reporting duty under Section 143(12) applies to every company that has a statutory auditor, which is every company. The ₹1 crore threshold is modest for a growing business, and a single related-party diversion, an inflated vendor, or a round-tripping entry can cross it without anyone in the boardroom deciding to commit fraud in the ordinary sense.

The problem: the auditor answers to the government, not to you

The people who feel the effect of Section 143(12) most directly are directors and promoters who believe the audit relationship is theirs to manage. It is not. Once the auditor forms a reason to believe fraud has occurred, a clock starts that the company can influence but cannot stop. The cost of getting this wrong shows up in three places at once.

First, the fraud itself, once established, attracts Section 447, which carries imprisonment of six months to ten years and a fine that can reach three times the amount involved. Second, the company's directors and officers who were involved carry that criminal exposure personally. Third, the auditor who stays silent to keep a client happy faces a penalty and NFRA debarment, so the auditor's incentive is to report early and report in writing. That last point matters more than any board expects. Your auditor's self-protection and your promoter's comfort now point in opposite directions.

The Coffee Day order is the cleanest illustration on the record. SEBI's investigation into the diversion of roughly ₹3,535 crore from seven subsidiaries reached NFRA, which examined the audit. The finding against the auditor was specific: the offence of fraud was not reported to the Government of India as Section 143(12) required. Two chartered accountants were debarred for 10 years and 5 years. The lesson for a private company board is that the regulator will look back at what the auditor knew and when, and whether the escalation happened.

The 2-day, 45-day, 15-day clock every board should memorise

Rule 13 of the Companies (Audit and Auditors) Rules, 2014 sets out the exact machinery for a fraud of ₹1 crore or more. It is a sequence with fixed windows, and the board's only real influence is a single 45-day reply. Miss it, and Form ADT-4 leaves the building.

For a fraud below ₹1 crore the path is shorter and stays inside the company. The auditor reports to the Board or Audit Committee within two days, and the company then discloses the nature of the fraud, the amount, and the parties involved in the Board's Report under Section 134. There is no ADT-4 in that case, but the disclosure obligation is real and reviewable.

What changed: NFRA turned a dormant rule into a live one

NFRA's 2024 circular on statutory auditors' responsibilities pressed a firm reading of Section 143(12). The regulator's position is that the auditor is duty-bound to file ADT-4 even where the auditor was not the first to detect the fraud, and even where investigation is still underway. Professional bodies pushed back, arguing this asks auditors to report suspicion rather than established fraud. The bodies filed representations. The regulator held its line. For a board, the takeaway is not the debate but the outcome: auditors now escalate earlier and document more, because the cost of waiting has moved onto them.

The enforcement record backs this up. The Coffee Day and Reliance Capital orders both turned in part on reporting conduct rather than only on technical audit quality. A single disciplinary order in the Religare Finvest matter in January 2025 again flagged delay in fraud reporting as a failing in its own right, even where the underlying audit work was largely complete. The message to every audit partner in the country is that a late report is treated as no report.

Who carries the duty, and what it costs to fail

Section 143(12) is not only a chartered accountant's burden. Sub-section (14) applies the section, with the necessary changes, to the cost accountant conducting a cost audit and to the Company Secretary in Practice conducting a secretarial audit under Section 204. A PCS who forms a reason to believe fraud has occurred during a secretarial audit carries the same escalation duty and the same personal penalty for silence. This is why a competent secretarial auditor now asks for board minutes, related-party registers, and charge documents with more insistence than before.

The penalty for the reporter who fails to comply sits in Section 143(15). The table below is the version every audit partner and every board should keep on hand.

What you must do now: a board playbook for the 45-day window

The single decision that determines the outcome of a Section 143(12) event is how the board uses its 45 days. A rushed or defensive reply pushes the auditor towards ADT-4. A documented, remediation-led reply can keep a genuine error from being escalated as fraud. Put the following in place before an auditor ever raises a concern.

1. Write a board fraud-response protocol. A one-page standing procedure that names who receives an auditor's 143(12) communication, who convenes the Audit Committee, and the timeline to a written reply. Approve it by board resolution and keep it in the minutes book. When the clock starts, you do not want to be designing the process.
2. Treat the auditor's letter as a filing, not a conversation. The moment a concern arrives in writing, log the date. Day 0 is the auditor's date of knowledge, and your 45 days run from receipt. Verbal assurances do not stop the clock and will not appear in an NFRA file.
3. Convene the Audit Committee, not just management. Where the company has an Audit Committee under Section 177, the reply must come from it. Management explaining itself to the auditor is exactly the pattern regulators distrust. Keep the independent directors in the room.
4. Reply on paper, with remediation attached. A strong 45-day reply states the facts, corrects the accounting entry or recovers the amount where possible, and records the governance step taken so it does not recur. Recovery and remediation are what let an auditor conclude an error was not a fraud within the meaning of the section.
5. Assume ADT-4 may still be filed, and prepare for it. If the auditor forwards Form ADT-4 to the Secretary, MCA, your board reply travels with it. That is the record the government reads first. Draft it as though a regulator will.
6. Fix the conditions that create ₹1 crore events. Most crossings of the threshold trace back to weak related-party controls, unvouched vendor advances, or inter-corporate movements booked without approval under Sections 185 and 186. Tighten those registers now, in calmer conditions.
7. Brief your secretarial auditor early. Because the PCS carries the same duty under Section 143(14), a secretarial audit is a second set of eyes on the same risk. Use it as a check before the statutory auditor forms a view, not after.

The deeper implication for growing companies

According to CS Sapna Malpani, the shift under Section 143(12) is less about a new rule and more about a change in who the auditor is protecting. "For a long time boards behaved as though the audit engagement was a private matter between the company and its firm. NFRA has quietly ended that assumption. An auditor who values a certificate of practice now escalates in writing and keeps the file, because the regulator has made silence more expensive than candour. The companies that struggle are the ones that discover this during a crisis rather than before one."

The forward view is straightforward. As NFRA extends its review of audit files down into mid-sized and unlisted companies, the ₹1 crore threshold will catch businesses that never expected to be inside the frame. A private company preparing for a fundraise or a listing should expect a buyer's or a merchant banker's diligence to ask directly whether any 143(12) communication has ever been received, and what the board did with its 45 days. The answer, and its paper trail, will move valuations.

How Section 143(12) compares with the reporting duties you already know

Boards often confuse the fraud-reporting duty with the routine audit forms, so it helps to separate them. Form ADT-1 records the appointment of the auditor. Form ADT-3 records an auditor's resignation. Neither has anything to do with fraud. Form ADT-4 is the fraud report to the Central Government, and it is the only one of the three that a company cannot see coming from its own filings.

The duty also differs from disclosure of significant beneficial owners under Section 90 or related-party approvals under Section 188. Those are the company's own obligations, filed by the company. Section 143(12) is unusual because the reporting is done by a professional the company pays, about the company, to the government, and the company's only formal role is a 45-day reply. That inversion is what makes it a governance risk rather than a compliance chore.

Sources and references

• Ministry of Corporate Affairs — Section 143(12), 143(14) and 143(15), Companies Act, 2013: mca.gov.in
• Rule 13, Companies (Audit and Auditors) Rules, 2014 (the 2-day / 45-day / 15-day procedure): Rule 13 text
• NFRA order on the auditor of a Coffee Day group company (Section 143(12) failure, debarment): Business Standard
• NFRA order on Reliance Capital audit (₹4.5 crore penalties, debarments): Business Standard
• ICSI, Company Secretaries Journal — Secretarial Auditor's Duty of Reporting Frauds under Section 143(12): ICSI CSJ
• Cyril Amarchand Mangaldas — NFRA circular on fraud reporting and India Inc.'s dilemma: India Corporate Law

Frequently asked questions on auditor fraud reporting

What is auditor fraud reporting under Section 143(12)?

Auditor fraud reporting is the statutory duty under Section 143(12) of the Companies Act, 2013 that requires an auditor who has reason to believe an offence of fraud is being or has been committed against the company by its officers or employees to report it. Where the amount is ₹1 crore or more, the auditor reports to the Central Government in Form ADT-4 after following the Rule 13 procedure. Where it is below ₹1 crore, the auditor reports to the Board or Audit Committee, and the company discloses it in the Board's Report. The duty cannot be waived by the company.

What is the time limit for filing Form ADT-4?

The clock has three parts. The auditor must report the matter to the Board or Audit Committee within two days of forming a reason to believe fraud has occurred, seeking a reply within 45 days. The Board then has 45 days to reply. Within 15 days of receiving the reply, or of the 45 days expiring with no reply, the auditor forwards the report, the board's comments and Form ADT-4 to the Secretary, Ministry of Corporate Affairs. If the board does not reply, ADT-4 is filed regardless.

Does auditor fraud reporting apply to private companies?

Yes. Section 143(12) applies to every company that has a statutory auditor, which includes every private limited company. NFRA and the Central Government can act on a fraud report from a small unlisted company just as they can from a listed one. The common belief that this is a listed-company rule is one of the more dangerous misreadings in private company governance, because the ₹1 crore threshold is easily crossed by a single related-party diversion.

What happens to directors if a fraud is reported?

Once a fraud is established against the company, the officers and directors involved face Section 447, which carries imprisonment from six months to ten years and a fine that can extend to three times the amount involved. Separately, the company may face disclosure and other defaults. The auditor's report under Section 143(12) is often the document that starts an investigation, which is why the board's 45-day reply, with remediation and recovery, matters so much.

Does the fraud reporting duty apply to a Company Secretary in Practice?

Yes. Section 143(14) applies the section, with the necessary changes, to the cost accountant conducting a cost audit and to the Company Secretary in Practice conducting a secretarial audit under Section 204. A PCS who forms a reason to believe fraud has occurred during a secretarial audit carries the same escalation duty and the same penalty for failing to report, which is ₹5 lakh for a listed company and ₹1 lakh for any other company under Section 143(15).

What penalty does an auditor face for not reporting fraud?

Under Section 143(15), an auditor, cost accountant or company secretary in practice who does not comply with Section 143(12) is liable to a penalty of ₹5 lakh in the case of a listed company and ₹1 lakh in the case of any other company. Beyond the monetary penalty, NFRA can debar the professional from audit work, as it did in the Coffee Day and Reliance Capital orders, where the reporting failure was central to the finding.

What should a board do when it receives a 143(12) communication?

Log the date of receipt, convene the Audit Committee rather than leaving it to management, and prepare a written reply within 45 days that states the facts, records any recovery or correction, and documents the governance fix. Assume Form ADT-4 may still be filed and that your reply will travel with it to the MCA. Having a board-approved fraud-response protocol already in place is the difference between a controlled reply and a scramble.