This is a composite, illustrative scenario, not an account of a named client. A vendor spend concentration analysis — ranking every vendor by total annual spend and by win rate on competitive tenders — showed one vendor had won 100% of tenders above ₹15 lakh for three consecutive years, against four to six other bidders each time, a win rate implausible for a genuinely competitive process. A company-name search against the Registrar of Companies showed that vendor's sole director shared a surname and residential address with a director of the client, and was in fact that director's brother-in-law — a related party under the Companies Act definition that had never been disclosed anywhere in the related-party register or the financial statement notes.
Why the related-party register never caught it
The related-party identification process at this company relied on directors self-declaring their own interests annually, through a standard disclosure form. The director in question had not declared the relationship, whether through oversight or otherwise, and the vendor's own name gave no indication of the connection — it was a generically named trading company, not something carrying a family name that would have prompted a second look during onboarding.
What the concentration analysis actually tested
- 01Ranked all vendors by total annual purchase value and flagged the top twenty for tender-level detailThis vendor sat mid-table on total spend but stood out completely once tender win rate was added as a second dimension.
- 02Pulled the tender files for the last ten awards above the thresholdEvery one named this vendor as lowest bidder by a narrow margin, and two tenders showed bid amounts from competing vendors that were implausibly close round numbers, suggesting the competing bids may not have been genuinely independent.
- 03Ran a Registrar of Companies search on the vendor's directorsThis is the step that found the family relationship, something no amount of testing the tender paperwork alone would have surfaced.
- 04Checked pricing against two comparable unrelated vendors for similar scopeThis vendor's pricing was within a normal range, so this was a disclosure and approval gap rather than also a clear overpricing issue — a distinction worth establishing precisely rather than assuming both.
| Related-party register | Concentration analysis + RoC search | |
|---|---|---|
| Vendor appears as related party | No | Yes — director's brother-in-law's company |
| Approvals obtained under section 188 | None — not flagged as related party | Required retroactively; board ratification sought |
| Disclosure in notes to accounts | Absent | Added for the current and corrected for comparative years where material |
What went into the file
- The vendor concentration and tender win-rate analysis as the originating procedure, not the related-party register.
- The Registrar of Companies search results establishing the directorship link.
- The pricing benchmark against unrelated comparable vendors.
- Management's remediation — retrospective section 188 approval, updated disclosure, and a revised related-party identification process that cross-checks director relatives against the vendor master rather than relying solely on self-declaration.
How we think about this
Self-declared related-party disclosures assume the person with the conflict will name it. A spend or win-rate pattern that looks statistically implausible doesn't rely on anyone's honesty — it just needs someone to ask why one vendor keeps winning, and then to check who actually owns it.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Related parties & disclosuresIdentifying related parties: the audit starting pointA client declaration is a starting point for the related-party list, not evidence of it. How to build and cross-check the list independently.
- Related parties & disclosuresUndisclosed related parties: red flags to test forThe counterparties that most need scrutiny are the ones nobody flagged as related. Here is what actually surfaces them.
- Purchase & AP auditVendor master data governance audit: duplicates, stale records, and approvalsA duplicate vendor record isn't a data-quality curiosity — it's how duplicate payments and fictitious vendors both get past controls that check the invoice but never check the master.
- Related parties & disclosuresThe vendor that turned out to be a director's own companyNothing in the vendor name suggested any connection. The director identification number on the vendor's own incorporation filing was a different story.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.