Undisclosed related parties are most often surfaced by matching data points across nominally unrelated counterparties that a related-party list built only from management's declaration would never catch — shared registered addresses, common phone numbers or email domains, directors who resigned from the client shortly before that counterparty started transacting with it, and pricing or payment terms that look nothing like the terms given to genuinely unrelated parties. None of these alone proves a relationship; together, or in combination with a weak business rationale, they justify a harder look.

Why this needs its own procedure

Related-party transaction testing, as usually scoped, starts from a list and tests whether the transactions against that list are complete and properly priced. It does not, by itself, find the related party that was never on the list. That requires a separate, more exploratory procedure that looks at the vendor and customer population as a whole and asks which of these counterparties, despite appearing unrelated, behave as though they are not.

Address and contact-detail matches

Registered or correspondence address matching the client's own address, a director's residential address, or the address of a known group entity.
Two or more "unrelated" vendors or customers sharing the same address, particularly where that address is a small office or residential unit rather than an obvious commercial building with many tenants.
Phone numbers or email domains repeated across vendors that otherwise present as independent businesses with different names and different lines of business.
A vendor's bank account number matching an account that also receives payments under a different vendor name, which is a stronger signal than a shared address because it is harder to explain away as coincidence.
Company names that are superficially different but share a distinctive, uncommon word with the promoter's family name or an existing group entity's name.

Timing signals around directors and management

A new vendor or customer begins transacting with the client shortly after a director or senior manager resigns, particularly if that person's new role or business is not disclosed to the audit team.
A vendor incorporated within weeks of a group restructuring, a demerger, or a director's departure, with no public information about who stands behind it.
An existing vendor's shareholding or directorship changes mid-year to someone connected to the client, without the client treating this as a change in relationship status going forward.
A long-serving employee leaves to "start their own business" and that business becomes a significant vendor or service provider to the client within the same year.

Transaction-pattern signals

Patterns worth investigating when found in vendor or customer data
Pattern	Why it is worth a closer look
Payment terms materially better than those given to comparable unrelated counterparties	An unrelated vendor or customer rarely gets terms the client does not extend to similar counterparties without a commercial reason
No negotiation history — pricing or terms set once and never revisited	Ordinary commercial relationships usually show some negotiation or renegotiation over time; a static arrangement can indicate common control
A counterparty with no apparent independent commercial presence — no other visible customers, no separate premises, minimal staff	Suggests the counterparty may exist substantially to transact with the client rather than as an independent business
Round-sum, recurring payments with vague descriptions ("consultancy", "services rendered")	Common pattern for disguised payments to a connected party where there is reluctance to describe the service specifically
A vendor whose only identifiable business is supplying this one client	Raises the question of who actually controls that vendor, and why

Patterns worth investigating when found in vendor or customer data

Analytical review techniques

01Run a full address and contact-detail match across the vendor and customer mastersNormalise addresses, phone numbers, and email domains, then look for any value appearing against more than one counterparty name. Do this across the whole population, not a sample, since the value of this check depends entirely on catching every match.
02Match PAN and bank account numbers in the same wayA PAN or bank account repeated against two different vendor or customer names in the master is close to conclusive, not merely suggestive, and deserves immediate follow-up rather than being noted and left for later.
03Profile new vendors and customers added during the year against known departuresCross the date a new counterparty first appears in the ledger against the dates directors, KMP, or senior staff left the client, looking for a pattern rather than a single coincidence.
04Compare terms given to the flagged counterparty against the client's own standard termsPull the range of credit periods, pricing, and discount levels given to the broader vendor or customer base, and see where the flagged counterparty sits relative to that range.
05Search public sources for the counterparty's own directors and shareholdersA quick check of the counterparty's own MCA filings for directors or significant shareholders who also appear in the client's own director, KMP, or shareholder records settles many of these questions directly.
06Raise what you find with management and document the responseNot every match is a related party — shared office parks and common service providers (accountants, company secretaries) create innocent address matches. Document what was found, what was asked, and what the resolution was, rather than only documenting the matches that turned out to matter.

An auditor's duty here is diligence under SA 550 and sound analytical review, not the investigative powers of a forensic examiner. Where the evidence suggests a relationship strongly enough that it affects the audit opinion, escalate within the firm and consider the reporting obligations that may apply; do not attempt to build a case beyond what audit evidence supports.

Common practice, not a requirement

Keeping a standing register of addresses, phone numbers, and bank accounts already associated with the client's known related parties, and checking every new vendor or customer against it as they are onboarded during the year rather than only at the final audit, catches far more than a once-a-year review of the full master, because the match is made closer to when the relationship actually began.

How we think about this

Matching addresses, phone numbers, PANs and bank accounts across an entire vendor and customer master is an exhaustive comparison problem, and running it on every row every time is exactly the kind of work that should be computed rather than sampled. Deciding what a match means — coincidence, a shared service provider, or an undisclosed related party — is a judgement that belongs to the auditor, made with the complete set of matches in front of them.

This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.

Free tools, no signup

Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.

Undisclosed related parties: red flags to test for