CARO requires the auditor to report whether any fraud by the company or any fraud on the company by its officers or employees has been noticed or reported during the year, and, separately, whether any whistle-blower complaints were received during the year and, if so, whether they have been considered while determining the nature, timing and extent of audit procedures. Both points depend on a documented enquiry with management and those charged with governance, not on the auditor's own knowledge alone, and the exact clause wording should be confirmed against the current order.
Two distinct reporting points, often conflated
These are two separate questions and the file should treat them separately. The first is about fraud actually noticed or reported, whether or not it was ever labelled a whistle-blower complaint. The second is specifically about whistle-blower complaints as a channel, which can include complaints that turn out to have nothing to do with fraud at all, or that are still under investigation with no conclusion reached. Answering one in place of the other is a common drafting error.
Fraud noticed or reported
This draws on the auditor's own fraud risk procedures performed under the applicable auditing standards, not on a fresh exercise invented for CARO. The auditor's responsibility to consider fraud risk as part of the audit, and to communicate certain matters to those charged with governance and in some cases to the regulator, exists independently of CARO; the CARO clause asks the auditor to state the conclusion of that work.
- Review the fraud risk assessment performed for the engagement and whether any instance was identified during fieldwork, however small.
- Review internal audit's fraud register or incident log for the year, if the company has an internal audit function.
- Review board and audit committee minutes for any discussion of a suspected or confirmed fraud, including matters raised but not formally labelled as fraud at the time.
- Enquire directly with management and, separately, with those charged with governance, documenting both enquiries rather than relying on one conversation covering both.
- Cross-check against any regulatory filing the company may have made reporting a fraud to a regulator, since such a filing is strong corroborating evidence that should be reconciled against what the auditor was told.
Enquiring only with the finance team and not separately with the audit committee or those charged with governance is a common gap. A fraud matter raised at board level that never reaches the finance team's day-to-day awareness will be missed entirely if the enquiry stops at one level of management.
Whistle-blower complaints
This point is narrower and more mechanical: it asks whether whistle-blower complaints were received during the year, and if so, whether the auditor considered them in planning audit procedures. It does not require the auditor to conclude that every complaint was substantiated or unsubstantiated; it requires evidence that complaints received were looked at and factored into the audit approach.
- 01Request the whistle-blower complaint logMost companies with a vigil mechanism maintain a log, even where the company is not otherwise required to have a formal whistle-blower policy. Ask for the log covering the full year, not just complaints that reached a conclusion.
- 02Reconcile the log to audit committee minutesA complaint logged but never discussed at the audit committee is itself worth noting; it suggests the vigil mechanism may not be functioning as intended.
- 03Map each complaint to an audit responseFor every complaint received, note whether it had any relevance to financial reporting, internal controls or fraud risk, and if so, what specific procedure was added or adjusted because of it.
- 04Document complaints with no relevance explicitlyWhere a complaint relates to a matter such as a workplace grievance with no bearing on the financial statements, record that assessment rather than leaving the complaint unaddressed in the file.
Coordination with those charged with governance
Both reporting points depend on a genuine two-way conversation with those charged with governance, not a one-way representation letter. A representation letter stating that no fraud occurred and no complaints were received is evidence, but it is weak evidence on its own, particularly where the auditor has not independently reviewed minutes or logs that would corroborate or contradict it.
| Source | Strength | Why |
|---|---|---|
| Management representation letter alone | Weak | Self-reported, not independently corroborated |
| Audit committee minutes review | Strong | Independent record of what governance actually discussed |
| Whistle-blower log reconciled to minutes | Strong | Cross-checks two independent sources against each other |
| Internal audit fraud register | Strong, where internal audit exists | An independent function's own findings, not management's characterisation of them |
Regulatory requirement
The precise wording and clause numbering of the fraud and whistle-blower reporting points, and the auditor's broader fraud-related responsibilities under the applicable Standards on Auditing and the Companies Act, should be confirmed against the current versions of each before the report is drafted. This article describes the testing approach, not the authoritative text.
How we think about this
Reconciling a whistle-blower log against audit committee minutes is a matching exercise that benefits from being done completely rather than on a sample of complaints. Deciding whether a given complaint was adequately investigated, or whether a pattern across several complaints points to a control weakness worth escalating, is a judgement call that depends on reading the substance of each complaint, which stays firmly with the auditor.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- CARO & Companies ActCARO 2020 reporting checklist for statutory auditorsThe topic areas CARO reporting covers, what evidence each one needs, and how the clauses fit together across the audit file.
- CARO & Companies ActCARO clause on loans, advances and investmentsTesting loans, advances and investments given by the company for CARO reporting, including the overdue-loan-renewal pattern the clause is designed to surface.
- CARO & Companies ActSecretarial compliance checklist for a statutory auditorBoard meeting frequency, statutory registers and ROC filing timeliness, read as evidence of compliance culture rather than a secretarial checklist in its own right.
- Internal audit & IFCReviewing the whistleblower mechanism as part of the auditWhat a whistleblower mechanism review has to check beyond the policy existing on paper, how to test whether complaints were actually investigated and closed, and how it connects to the auditor's fraud-reporting conversation.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.