CARO's clause 3(xi) requires the auditor to report whether any fraud by the company or any fraud on the company by its officers or employees has been noticed or reported during the year, and if so, the nature and the amount involved. It further requires reporting whether any report under Section 143(12) of the Companies Act has been filed with the Central Government, and whether the auditor has considered whistle-blower complaints received during the year while determining the nature, timing and extent of audit procedures. This clause is a disclosure requirement about what was found — the detection work itself is governed separately by SA 240, which this clause presupposes rather than duplicates.
The two separate fraud categories the clause names
| Category | Example |
|---|---|
| Fraud by the company | The company itself deliberately misrepresenting its financial position — to a lender, a regulator, or in its own financial statements |
| Fraud on the company, by officers or employees | An employee embezzling funds, a manager manipulating payroll (a ghost employee, for instance), or an officer diverting company assets for personal benefit |
Section 143(12) — a separate, more serious trigger
Section 143(12) is a distinct statutory obligation, separate from the CARO report itself: if, during the course of performing their duties, the auditor has reason to believe that an offence involving fraud is being or has been committed against the company by its officers or employees, the auditor must report the matter — to the Central Government directly, where the amount involved exceeds a prescribed threshold, or to the audit committee or board, where it's below that threshold. CARO's clause 3(xi) asks whether such a report was actually filed, making the two provisions connected but not identical: a fraud finding can exist without necessarily crossing the materiality bar that triggers Section 143(12) reporting, and the clause response needs to address both questions explicitly.
- 01Identify any fraud actually noticed or reported during the yearFrom the audit team's own findings, management's disclosures, or matters raised through the whistle-blower mechanism.
- 02Quantify the nature and amount involvedA specific figure and description, not a vague reference to "an irregularity."
- 03Determine whether the amount crosses the Section 143(12) reporting thresholdIf it does, confirm whether the required report was actually filed, and to whom.
- 04Confirm whistle-blower complaints were considered in shaping audit proceduresNot just logged, but actually factored into risk assessment and the response to it — a distinct, explicit requirement within this same clause.
A fraud finding disclosed in the CARO report but with no corresponding confirmation of whether a Section 143(12) report was required and filed leaves the clause response incomplete — both halves of the question need an explicit answer, not just the existence of the fraud itself.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Internal audit & IFCSA 240: the auditor's responsibilities relating to fraudSA 240 doesn't make the auditor a fraud investigator. It requires planning and performing the audit as if fraud could exist, and documenting that you did.
- CARO & Companies ActCARO whistleblower and fraud reporting clausesThe auditor's reporting responsibility on fraud noticed and whistle-blower complaints received, and how to document the enquiry behind it.
- Payroll & employee costThe ghost employee payroll testing caughtOne employee ID had drawn a full salary for eleven months with no biometric attendance record at all. The HR file for that ID was thin in a specific way.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.