Kaveri Agri Fresh: Vendor Fraud, CFO Override and the IFC Reporting Chain

Classification framework. A deficiency exists where a control is missing or does not operate. It becomes significant where it could result in a misstatement that is more than inconsequential; it becomes a material weakness where there is a reasonable possibility that a material misstatement would not be prevented or detected on a timely basis. The tests are materiality of the exposure, likelihood, and, critically, whether the top of the organisation can override the control.

Finding	Classification	Reasoning
(i) ₹3.7 crore to a related proprietorship, self-approved	Significant deficiency, fraud indicator	Conflict of interest concealed through self-approval; ₹3.7 crore is ~0.4% of revenue but is a fraud on the company and a related-party transaction requiring audit committee approval
(ii) 42 post-payment changes to vendor bank master by one person	Material weakness	Direct route to diverting any payment; 42 instances show the control is absent, not merely weak; the population at risk is the entire payables book
(iii) Shrinkage 3.8% vs 1.2%, with spoilage billed to insurers	Significant deficiency, possible fraud	Misclassification of loss to support an insurance claim; misstatement of inventory and claims receivable
(iv) CFO override of three-way matching for ₹2.6 crore	Material weakness	Override by senior management, no compensating approval, and a seasonality excuse that will recur annually
(v) Whistleblower channel routed to and closed by the CFO	Material weakness	The mechanism intended to detect override is controlled by the person overriding; complaints may concern the CFO himself
Audit committee: two meetings, 95 minutes	Significant deficiency in the control environment	Insufficient time to challenge the above; oversight is nominal

Two findings on their own could be treated as isolated; taken together, with CFO override and a compromised whistleblower route, the entity-level control environment fails. Management's assertion of adequate IFC is not supportable.

Statutory auditor

• Section 143(3)(i) read with Rule 10A: report on whether the company has adequate internal financial controls with reference to financial statements and whether they operated effectively. On these facts the opinion cannot be unqualified; the basis must describe the override and the vendor master failure.
• Section 143(12) read with Rule 13 of the Companies (Audit and Auditors) Rules, 2014: report fraud to the Board/audit committee, and where the amount involved is ₹1 crore or more, report to the Secretary, Ministry of Corporate Affairs in Form ADT-4 within 15 days of the Board/audit committee meeting. The ₹3.7 crore related-party payments and the insurer-billed spoilage both engage this section.
• CARO 2020, clause 3(xi): report whether fraud by or on the company has been noticed or reported, and the whistleblower complaints received.
• SA 580 and SA 240: management representations cannot substitute for evidence where contradictory information exists. Accepting 'isolated' on representation alone is a documentation and professional-scepticism failure, disclosable under SA 250/SA 230.

Audit committee

• Section 177(4): review internal financial controls, risk management systems, and related-party transactions. The ₹3.7 crore payments needed prior approval; approval was neither sought nor given.
• Section 177(9) and SEBI LODR Regulation 22: a vigil mechanism with direct access to the audit committee chair. Routing complaints to the CFO breaches this.
• SEBI LODR Regulation 18: the audit committee must meet at least four times a year. Two meetings of 95 minutes is a compliance failure that must be corrected and explained.

Board

• Section 134(3) and the Directors' Responsibility Statement: the Board cannot certify adequate IFC on these facts; the Board's report must disclose the frauds reported and the corrective action.
• Section 447 and section 448 exposure arises if a liability is concealed by false statements; restitution and disgorgement may follow for those who benefited.

1. Vendor master change control - Owner: Head of Finance. Every bank-account or address change requires dual authorisation (maker, independent checker) plus call-back verification to a number from the original onboarding file, with a cooling-off period so the change cannot take effect in the same payment run. Evidence: exception log of change requests, call-back records, zero single-user changes in the user-access review.

2. Payment run certification - Owner: Financial Controller. Each payment run is certified by a second signatory against the approved purchase order, goods receipt and invoice, and any post-run master change automatically freezes that vendor's next payment. Evidence: signed run certificates, matched three-way records, reconciliation of the certified total to the bank file.

3. Procurement segregation of duties - Owner: Head of Procurement. No individual may raise a purchase order, receive goods and release payment. Depot managers lose payment-release rights entirely; approvals above ₹25 lakh move to the central authority matrix. Evidence: user-access matrix reviewed quarterly, exception report of any user holding two conflicting rights (target zero).

4. Whistleblower and conflict-of-interest mechanism - Owner: Audit Committee Chair. Complaints go to an externally hosted hotline and directly to the audit committee chair, bypassing the CFO and the HR head; all employees and depot staff declare related-party interests annually, including relatives' firms. Evidence: quarterly complaint register to the audit committee, declaration completion rate, cases closed with documented rationale.

5. CFO override register - Owner: Audit Committee. Any manual override of a key control is logged with the reason and reported to the next audit committee meeting for retrospective ratification; overrides above ₹1 crore need prior Chair approval. Evidence: override register, minutes showing challenge, trend in override volumes.

6. Insurance and shrinkage analytics - Owner: Internal Audit. Monthly reconciliation of depot shrinkage against the norm, with any spoilage classified as 'transit loss' independently reviewed before an insurance claim is lodged. Evidence: depot-wise shrinkage report, claims-supported file, and the reversal of the two claims already lodged.