Spotting a fraud — corporate red flags before they cost you
The answer
Almost every large corporate fraud was disclosed before it was discovered. The warning appeared in a filing, an auditor's letter, a shareholding pattern or a note to the accounts, months or years before the collapse.
The 3 highest-value checks a private investor can make take about 5 minutes each: whether the auditor left before the end of their term, whether the controlling shareholders have pledged their shares, and whether the company's reported cash behaves like real cash.
Why this costs you money
You do not need to be defrauded to lose money to fraud. You need only to own the share when the fraud is announced.
The loss has a distinctive shape. It is not a 20% decline over 6 months that you can think about. It is a 60% to 90% decline in days, often with the share locked at the lower circuit limit, which means there is no buyer and you cannot sell. You watch it for a week and it is over.
And it is unrecoverable in a specific way. When a business simply performs badly, you can reassess and decide. When the accounts turn out to be false, there is nothing to reassess, because everything you based your view on was the thing that was false. Your research was not wrong. Your research was applied to fiction.
Here is the part most people do not accept. You are not being asked to detect a fraud. You are being asked to notice that a particular company has 3 or 4 characteristics that fraudulent companies usually have, and to reduce your position or refuse to buy. You will be wrong most of the time. Most companies with red flags are not frauds. That is fine, because the cost of avoiding an honest company is a missed return, and the cost of holding a fraud is the whole position.
How it works
Red flags are not equally useful. Here they are in order of signal strength, strongest first.
1. The auditor leaves
An auditor resigning before the end of their term is the single loudest signal available in public markets. Auditors are paid to sign. Walking away costs them the fee, and they do it when signing would expose them to a risk larger than the fee.
Distinguish 3 events. Scheduled rotation is routine and required by law in India. Non-reappointment at the end of a term with a clear explanation is usually ordinary. Resignation mid-term is not ordinary, and the reason given matters enormously. Phrases such as "unable to obtain sufficient information", "lack of cooperation" or "unable to complete the audit" are as close to an explicit warning as an auditor will ever put in writing.
Also read the audit opinion itself. A qualified opinion means the auditor disagrees with something specific. A disclaimer of opinion means the auditor could not form a view at all. An emphasis of matter paragraph is milder but tells you which item worried them.
2. The cash that does not behave like cash
This is the check that catches the frauds nothing else catches, because it attacks the balance sheet directly.
Real cash earns interest. So:
Interest income ÷ average cash and investments = the yield the company earned on its own money.
Compare that yield to short-term deposit rates in the country. If a company reports large cash balances and earns 1% on them while bank deposits pay 6%, ask why. There are honest answers: the cash arrived at the end of the year, or it is held as margin, or it is in current accounts for operating reasons. There are also dishonest answers: the cash is pledged against somebody else's borrowing, or it is in a subsidiary that cannot send it, or it does not exist.
The second half of the same test: is the company holding large cash and borrowing at high rates at the same time? A company with ₹4,000 crore of cash earning 4% and ₹3,000 crore of debt costing 10% is losing money every day for no reason. Sometimes there is a genuine explanation, usually about where the cash sits. Often the explanation is that one of the 2 numbers is not what it appears to be.
3. Pledged shares of the controlling shareholders
When a promoter or founder pledges their shares as collateral for a personal or group loan, 2 things follow. It tells you they needed money and could not raise it another way. And it creates a mechanism by which a falling share price forces the lender to sell those shares, which drives the price down further, which triggers more selling.
What matters is the percentage of the promoter holding that is pledged, and whether it is rising. A rise from 20% to 60% over 4 quarters is a much stronger signal than a stable 40%.
4. Money moving to entities you do not own
The related-party transactions note lists every transaction with entities connected to the directors or controlling shareholders. In an asset-diversion fraud, the mechanism is almost always here: loans and advances to related entities, guarantees given on their behalf, purchases from them at inflated prices, or sales to them that are never collected.
The 2 lines to find first are loans and advances given to related parties and guarantees given. Both move value out of the company without touching the profit line.
5. Receivables that grow faster than sales
Compute days sales outstanding — receivables divided by revenue, multiplied by 365 — for each of the last 5 years. A steady rise means the company is waiting longer to be paid. Beyond a point it means revenue is being recognised on sales that will not be collected.
Watch particularly for a jump concentrated in the fourth quarter, and for "unbilled revenue", which is revenue recognised for work done but not yet invoiced. Unbilled revenue is a legitimate accounting item and it is also the easiest place to put a number nobody can verify.
6. Debt that is not in the debt line
Three places to look. Contingent liabilities, a note listing obligations that may become real — guarantees, disputed tax claims, letters of credit. Corporate guarantees given to subsidiaries and associates, which are debts that have not happened yet. And supply-chain finance or reverse factoring, where a bank pays a company's suppliers early and the company repays the bank later; this can be classified as a trade payable rather than borrowing.
Also compare year-end net debt with the interest cost. If a company reports low net debt but pays interest that implies a much larger average balance, the debt was higher during the year and was reduced before the reporting date.
7. Structural complexity that has no operating purpose
A large number of subsidiaries, joint ventures and special purpose vehicles, particularly in multiple jurisdictions, particularly where the operating business does not require it. Complexity is not fraud. Complexity is where fraud is possible, because consolidation obscures individual entities and few outsiders will trace them.
8. People leaving, and filings arriving late
A chief financial officer resigning suddenly, especially more than once in a few years. Independent directors resigning, particularly the audit committee chair. Results postponed. An annual general meeting delayed. Each is weak alone. Two or 3 together, in the same year, is a pattern.
What it tells you, and what it does not
These checks tell you where to be more careful and how large a position to take. They are a filter on position size and on the price you are willing to pay.
They do not tell you a company is fraudulent. Most companies displaying several of these characteristics are honest. Family groups have related-party transactions. Growing companies have rising receivables. Auditors sometimes resign over fees.
They will not catch everything. Where the fraud is a fabricated bank balance confirmed by fabricated documents, the accounts can be internally consistent and pass every ratio test. The interest income check helps here more than any other, which is why it is second on the list, but it is not certain.
And they give you no timing. Companies with many red flags have continued to report growth and rising share prices for 3, 5 and 7 years. Being right early feels identical to being wrong. This is why the correct response to red flags is to own less, not to short.
The decision rule
Red flags are counted, not weighed. One is noise. Three together, in the same company, in the same year, is a decision.
The single hard rule. If the auditor resigns before the end of their term, treat the accounts as unverified until a new firm has signed a full year. Do not average down. Do not wait for the price to recover. The auditor has more information than you and has chosen to give up income rather than sign.
The counting rule. Score the company on these 8. Any 3 present at once means the position should be small or absent. The specific combination that has preceded the most severe outcomes is: rising promoter pledge, plus large loans or guarantees to related parties, plus an auditor change.
The conditional on cash. A large cash balance is usually a strength — unless the yield earned on it is far below prevailing deposit rates, or the company is simultaneously borrowing at high rates. In those cases the cash is either restricted, trapped in a subsidiary, or not there, and all 3 mean it is not available to you.
The conditional on growth. Rapid growth is usually good news — unless no competitor in the same market is reporting anything similar. When one company's margins or growth are far outside the range of every peer, either it has a genuine and explainable advantage, or the numbers are not comparable to the peers' numbers for a reason.
Try this now
Five minutes, 1 holding you own. Three checks, in order.
- The auditor. Search the company's filings on the NSE, BSE or SEC website for the words auditor and resignation. On the SEC's EDGAR database, look for form 8-K filings under item 4.01, which covers changes in the certifying accountant. Note any auditor change in the last 5 years, and whether the outgoing firm resigned or completed its term.
- The pledge. Open the latest shareholding pattern filed with the exchange. Find the promoter or promoter group holding, and the percentage of that holding which is pledged or otherwise encumbered. Then open the same filing from 4 quarters ago and write down the same 2 numbers.
- The cash. Open the latest balance sheet. Add cash and cash equivalents, bank balances and current investments. Then open the profit and loss statement and find interest income, usually shown within other income and broken out in the notes. Divide interest income by the average of this year's and last year's cash total. Express it as a percentage. Compare it with the current 1-year bank fixed deposit rate in that country.
What you should see. For most holdings, 3 clean answers, and that itself is worth knowing.
The auditor will usually have changed only at a scheduled rotation, or not at all. If you find a mid-term resignation you did not know about, read the resignation letter, which is filed with the exchange. That is the most valuable 2 minutes in this whole cluster.
The pledged percentage will usually be zero or small in a well-run company. If it is above 25% and rising quarter on quarter, the size of your position is now a question, regardless of how much you like the business.
The cash yield will usually land somewhere in the range of prevailing short-term deposit rates, allowing for balances that arrived late in the year. If a company holds a very large cash balance and earns 1% or 2% on it, write down the question. Then look for the answer in the notes, where restricted balances, margin money and balances held in foreign subsidiaries are disclosed. If the notes do not explain it, you have found something the market may not have priced.
Three real cases
1. Satyam Computer Services, January 2009 (India) — cash that was never there On 16 December 2008 Satyam's board approved the acquisition of Maytas Infrastructure and Maytas Properties, companies associated with the family of chairman B. Ramalinga Raju. Shareholders reacted so strongly that the decision was reversed within about 12 hours. Independent directors resigned in the weeks that followed. On 7 January 2009 Raju wrote to the board admitting that the company's accounts had been falsified over a period of years, including cash and bank balances of approximately ₹5,040 crore that did not exist, against a reported figure of about ₹5,361 crore. The share price collapsed. Every warning arrived in public, in sequence: a related-party acquisition, a shareholder revolt, independent directors leaving, and only then the confession. The attempted Maytas purchase is the clearest example of the fourth red flag on this list, and it was 3 weeks before the end.
2. Wirecard, June 2020 (Germany) — the balance the auditor could not confirm Wirecard was a payments company and a member of Germany's DAX index. Journalists at the Financial Times had published allegations about its accounting from 2015 onward, and German regulators at one stage investigated the journalists and imposed a temporary ban on short selling the shares. On 18 June 2020 the auditor EY declined to issue an opinion on the 2019 accounts, stating it could not obtain sufficient evidence for approximately €1.9 billion said to be held in trust accounts. Within days the company acknowledged that the balances likely did not exist, and it filed for insolvency on 25 June 2020. The shares lost almost all their value. The failure was in cash confirmation — precisely the item the interest income test is designed to question.
3. Infrastructure Leasing and Financial Services, 2018 (India) — complexity as the mechanism IL&FS was a large infrastructure finance group. It began defaulting on debt obligations from around June 2018, with defaults escalating through September 2018, and the government superseded its board on 1 October 2018. Group debt was reported at roughly ₹91,000 crore and the group contained a very large number of subsidiaries, associates and joint ventures. The group had carried high credit ratings shortly before the defaults. Subsequent investigations examined the ratings, the group structure and disclosure practices. The defining feature was structural complexity in a lending group funding long-dated assets with short-dated borrowing. No single ratio at the consolidated level would have exposed it. The number of entities would have prompted the question.
The question that resolves it
A novice looks at a suspicious company and asks: is this a fraud?
That question cannot be answered from outside, and trying to answer it is what keeps people invested while they wait for proof.
An expert asks: how many independent warning signs does this company have at once, and is my position size appropriate for that?
The second question can always be answered, in 5 minutes, from free filings.
What would make this wrong
If these red flags reliably identified frauds, then screening for them would produce a short list containing almost every fraud and almost nothing else. It does not.
The false positive rate is very high. Family-controlled groups have related-party transactions as a matter of ordinary operation. Fast-growing companies have rising receivables because growth consumes working capital. Companies hold cash in current accounts for legitimate reasons. Auditors resign over fee disputes and over workload. If you refuse every company that triggers 2 of these flags, you will exclude a large share of the market, and a meaningful number of good long-term investments.
The false negatives are the dangerous ones. A well-executed fraud produces internally consistent statements. Fabricated cash comes with fabricated confirmations. Fabricated revenue comes with fabricated customers and fabricated collections, so receivables look fine. Several of the largest frauds passed audits by major firms for years.
There is no timing information here at all. A company can carry every flag on this list and continue to rise for years. This matters practically: these checks are for deciding whether to own and how much, never for deciding when to sell short. Short positions against apparent frauds have lost enormous sums to companies that were later confirmed to be frauds.
And the honest general limit: the base rate of outright fraud among large listed companies is low. Most of the money lost in markets is lost to ordinary business failure, overpaying, and impatience. Fraud is the most dramatic risk and not the most common one. Treat this article as insurance, not as a worldview.
In India
Auditor resignations must be explained. SEBI has required detailed disclosure where a statutory auditor of a listed company resigns, including the reasons and whether information was withheld. The resignation letter is filed with the exchanges and is free to read. Under section 139 of the Companies Act, 2013, listed companies must also rotate audit firms periodically, so a change at the scheduled point is routine.
Promoter pledging is disclosed quarterly in the shareholding pattern filed with the exchanges, showing the promoter group holding and the percentage pledged or encumbered. This disclosure has no equivalent significance in most other markets and it has preceded a striking number of Indian corporate failures. Check it every quarter on every holding.
Surveillance lists are public. The exchanges operate the Additional Surveillance Measure and Graded Surveillance Measure frameworks, which apply restrictions such as higher margins or periodic-call auctions to shares showing unusual price or volume behaviour. Appearance on these lists is not proof of anything and it is information you did not have to pay for.
Credit rating actions are published by the rating agencies and by the exchanges. A sequence of downgrades, or a rating placed on watch, is public and often earlier than the equity market's reaction.
Forensic audits. Where a lender or a regulator orders a forensic audit of a listed company, it is generally disclosed. It is among the strongest single signals in the Indian market.
Group structures. Indian promoter groups often include many unlisted entities. The related-party note in the consolidated accounts is where the relationship between them and the listed company is described. Read it every year, not only at purchase.
In the United States
Auditor changes are filed on form 8-K under item 4.01, and the filing must state whether the former accountant's reports contained an adverse opinion or disclaimer, and whether there were disagreements on accounting matters. This is a short, specific, searchable filing.
Restatements are filed under item 4.02. When a company concludes that previously issued financial statements should no longer be relied upon, it must say so. A history of such filings is a history of accounting that did not hold.
Internal control weaknesses are disclosed. Under the Sarbanes-Oxley Act of 2002, management must assess internal control over financial reporting and an auditor must attest to it for larger filers. A disclosed material weakness names the specific control that failed.
The SEC publishes enforcement actions, including Accounting and Auditing Enforcement Releases, which are searchable and describe exactly what was done and how it was found. They are among the best free education in forensic accounting that exists.
A whistleblower programme pays awards. The Dodd-Frank Act established monetary awards for whistleblowers whose information leads to successful enforcement actions above a threshold. This has materially increased the flow of internal information to regulators.
Adversarial research is a real force. Short sellers publish detailed research reports alleging fraud, and several major frauds were first described publicly in such reports. The reports are self-interested and sometimes wrong. They are also frequently the first specific, evidenced allegation available to a private investor.
Where they differ, and what that tells you
The typical mechanism of loss differs, so the priority order of the checks differs.
In India, the recurring pattern at smaller and mid-sized companies has been diversion — value moving from the listed entity to unlisted entities controlled by the same family, often alongside heavy promoter pledging. So the Indian reader's first 2 checks should be the shareholding pattern's pledge column and the related-party note's loans, advances and guarantees.
In the United States, the recurring pattern at large companies has been recognition — revenue or profit recognised earlier or more aggressively than the economics justify, or costs capitalised rather than expensed. So the US reader's first 2 checks should be the non-GAAP reconciliation table and the relationship between reported profit and operating cash flow over 5 years.
The information environment is more adversarial in the United States. Short selling is widespread and short sellers publish research. That produces a public challenge to a company's numbers, often years before a regulator acts. India permits short selling within a framework that does not allow naked short selling, and there is far less published adversarial research on Indian companies . The practical consequence: an Indian investor cannot expect somebody else to do this work and publish it. The checks in this article are more likely to be the only ones performed on your holding.
One Indian disclosure has no strong US equivalent, and it is unusually valuable. The quarterly promoter pledge disclosure is specific, standardised and free. US insiders do pledge shares and it is disclosed in the proxy statement, but ownership is dispersed enough that a single insider's pledge rarely threatens the company. In India a pledge over a controlling stake is a structural risk to every other shareholder.
One US disclosure has no Indian equivalent. The 8-K restatement filing under item 4.02, stating that earlier accounts should not be relied upon, is a single unambiguous document. In India the equivalent information usually has to be assembled from a qualified audit opinion, a restated comparative figure, or a regulatory order.
Carry this
- An auditor who resigns before the end of their term has told you something at their own cost. Treat the accounts as unverified until a new firm signs a full year.
- Real cash earns interest. Divide interest income by the cash balance and compare it with deposit rates.
- Count the flags, do not weigh them. Three at once means a smaller position or none — not a short position, because there is no timing information here.