Business Continuity & Fraud Risk Assessments

It is a structured review that answers two practical questions together: if something disrupts your business tomorrow — a key system going down, a critical vendor failing, a facility becoming inaccessible — how long could you keep operating and how quickly could you recover; and separately, where in your organisation does the way people, processes, and controls are set up today create a genuine opportunity for fraud, whether by an employee, a vendor, or a combination of both. We assess both together because the underlying discipline — systematically identifying where things can go wrong before they do — is the same for each.

There is no single statute in India that mandates a 'Business Continuity & Fraud Risk Assessment' by that exact name. However, the underlying obligations are real: Section 134(5)(e) of the Companies Act 2013 requires directors of applicable companies to represent that internal financial controls are adequate and operating effectively — fraud risk assessment is a foundational input to making that statement in good faith. SEBI LODR Regulation 21 requires the top 1,000 listed companies by market capitalisation to have a Risk Management Committee whose risk policy must address business continuity and cybersecurity risk explicitly. Standards on Auditing (SA 240) place an express responsibility on management and those charged with governance to design controls that prevent and detect fraud.

Because in practice they share root causes and PNPC can offer either separately when that is genuinely what a client needs. A weak IT access-management control, for example, is simultaneously a business continuity risk (unauthorised or accidental system changes causing an outage) and a fraud risk (excessive access enabling record manipulation undetected). Assessing them together surfaces this overlap and produces a more efficient, more coherent remediation plan than two disconnected reviews conducted by different teams at different times.

A Business Impact Analysis identifies which of your business processes are genuinely critical, and for each, quantifies the Maximum Tolerable Downtime, the Recovery Time Objective (how quickly it must be restored), and the Recovery Point Objective (how much data loss, if any, is acceptable). Without a BIA, a BCP has no basis for prioritisation — it either treats every process as equally urgent, which wastes recovery resources, or is built around management's assumptions rather than a tested reality. We always run the BIA first; the BCP is built on its findings, not the other way around.

A single point of failure is any person, vendor, system, or facility whose unavailability would materially disrupt a critical process, with no fallback in place. We identify these through structured interviews with process owners, review of vendor contracts for sole-source dependencies, and mapping of who holds undocumented institutional knowledge of key processes. Key-person dependency — where only one individual genuinely understands how to run a critical process — is one of the most common and most under-assessed single points of failure in mid-sized Indian businesses.

The Fraud Triangle is a widely used framework describing the three conditions that typically must be present for fraud to occur: opportunity (a control weakness that allows it), pressure or incentive (a personal or business reason to commit it), and rationalisation (a way for the individual to justify it to themselves). We apply this framework primarily to the opportunity leg — since that is the one an organisation can most directly control through segregation of duties, access management, and oversight — while also considering where business or personal pressures (aggressive targets, financial distress, inadequate compensation relative to trust placed) may elevate risk in specific roles or process areas.

Segregation of duties means no single individual should be able to both execute and conceal a fraudulent transaction alone — for example, the person who creates a new vendor in the system should not also be the person who approves payment to that vendor. Many organisations have a segregation of duties matrix on paper that does not match actual system access rights. We test the actual ERP or accounting system permissions granted to each user, and sample real transactions, to confirm whether the documented segregation genuinely held in practice — not just whether the policy exists.

Full textbook segregation of duties is often genuinely difficult with a small finance team — this is a real, structural constraint, not a failure of discipline. Where full segregation is not achievable, we recommend compensating controls: mandatory secondary review or approval by someone outside the finance team (even a business owner or a Board member) above defined thresholds, periodic surprise reconciliation checks, and system-enforced approval workflows that at least require a second click by a different login even if the same small team is involved. We size the recommendation to what is realistic for the organisation's stage.

A tabletop exercise is a facilitated, structured walkthrough of a realistic disruption scenario — for example, your core system becomes unavailable for 48 hours, or your primary facility is inaccessible for a week — in which management works through the actual decisions the written plan calls for: who is notified first, who has authority to declare an incident, what the manual workaround is, how customers and vendors are communicated with. This consistently surfaces gaps that a document review alone does not — an outdated contact list, an assumption that someone else holds a critical password, a step that reads clearly on paper but nobody has actually rehearsed.

A Forensic Audit investigates a specific, already-suspected incident — what happened, who was involved, and what the quantified loss is — and is engaged reactively after a concern has already surfaced. A BCP & Fraud Risk Assessment is proactive and systemic: it identifies where fraud opportunity and continuity risk exist across the organisation before any specific incident has occurred, so gaps can be closed ahead of time. Where a specific incident has already occurred, we recommend a Forensic Audit for that matter, often followed by (or alongside) a broader BCP & Fraud Risk Assessment to identify whether the same root-cause control gap exists elsewhere.

GRC Assurance is a broader, entity-wide review of governance structure, the full enterprise risk universe, and the control environment as a system — of which fraud risk and business continuity are two components among several (governance, compliance management, whistleblower mechanisms, and more). A BCP & Fraud Risk Assessment is a focused, deeper dive specifically into operational resilience and fraud exposure. Organisations that have already had a GRC Assurance review, or whose immediate concern is specifically continuity and fraud rather than the full governance picture, typically choose this narrower engagement; a first-time, entity-wide governance review is better served by GRC Assurance, with BCP and fraud risk as one workstream within it.

The business continuity component includes assessing your dependency on IT systems, your backup and recovery arrangements, and whether IT-related disruption scenarios are addressed in your BCP/DRP — because IT resilience is usually central to overall business continuity today. However, a deep technical cybersecurity assessment — penetration testing, vulnerability scanning, technical security architecture review — is a more specialised, separate engagement. We scope the appropriate level of IT/cyber coverage within this assessment and can bring in or refer to our dedicated Cybersecurity Audit capability where deeper technical testing is warranted.

If you already have a specific, identifiable concern — a discrepancy, a whistleblower report, an anomaly someone has flagged — start with a Forensic Audit to establish the facts of that specific matter. A BCP & Fraud Risk Assessment is the right next step once the specific matter is resolved, or can run in parallel, to answer the systemic question: what control gap allowed this, and does the same gap exist in other processes or locations across the organisation.

A written report covering: the Business Impact Analysis with RTO/RPO for each critical process; a single-point-of-failure register; an updated or newly drafted BCP/DRP reflecting the BIA findings; a fraud risk heat map by process area with root-cause analysis; a segregation-of-duties and access-rights testing summary; a prioritised, rated findings register (Critical/High/Medium/Low) with management's response and remediation timeline; and a recommended follow-up review date. This is supplemented by a live presentation to the Audit Committee or Board and, typically, a facilitated tabletop exercise.

A first-time, entity-wide assessment for a mid-sized company typically takes 8–12 weeks from initial scoping to Board presentation, depending on the number of critical processes and locations covered and the depth of segregation-of-duties testing agreed. A more narrowly scoped assessment — for example, business continuity only, or fraud risk limited to the finance function — can be completed faster. Subsequent cycles are generally quicker once the BIA and fraud risk baseline already exist.

Fees depend on entity size, the number of critical processes and locations in scope, whether a full tabletop exercise is included, and the depth of segregation-of-duties and access-rights testing agreed. PNPC provides a written scope and fixed-fee proposal after an initial scoping conversation — we do not quote a fee before understanding what is actually being assessed and why.

Where PNPC is also your statutory auditor, we structure this engagement with an appropriately separate team and reporting line to preserve independence, consistent with the Companies Act and applicable professional standards. For companies where independence rules restrict the statutory auditor from providing certain non-audit services, we advise upfront on whether PNPC can undertake this assessment or whether an independent firm should be engaged instead.

We design the engagement to minimise disruption. Most of the work involves document and system-access review, structured interviews with process owners (typically 30–60 minutes each), sample-based testing that does not require processes to pause, and a single facilitated tabletop exercise scheduled at a convenient time. We coordinate through a single internal point of contact — typically the CFO's office or Company Secretary — to manage information flow efficiently.

No. This is a private, management-and-Board-facing advisory and assurance engagement — findings are reported to the Audit Committee, Risk Management Committee, or Board that commissioned it, not to SEBI, MCA, or any other regulator. Separately, where a finding indicates a potential fraud that triggers the statutory auditor's specific reporting obligation under Section 143(12) of the Companies Act, that obligation applies to the entity's statutory auditor in that defined circumstance — not to PNPC in this advisory capacity, unless PNPC also happens to hold that statutory role for the entity.

For listed companies and larger private companies with an active Risk Management Committee, we recommend revisiting the BIA and fraud risk map every 1–2 years, or sooner following material business change — a new system implementation, a new geography, significant headcount growth, or a merger. For smaller unlisted companies without a regulatory trigger, every 2–3 years, or ahead of a major milestone such as a fundraise, is generally proportionate.

Institutional investors and acquirers routinely assess operational resilience and internal control/fraud risk maturity as part of due diligence — key-person dependency, vendor concentration risk, and segregation-of-duties gaps are common diligence findings that can affect valuation, deal terms, or timeline if discovered late in a live process. Conducting this assessment proactively, well ahead of a transaction, allows genuine remediation on your own schedule rather than under the pressure and scrutiny of active diligence.

A Business Continuity Plan (BCP) is the broader plan covering how the entire organisation continues critical operations through a disruption — people, processes, facilities, communications, and vendor relationships. A Disaster Recovery Plan (DRP) is the more technical, IT-specific subset focused on restoring systems, applications, and data after an outage. A DRP is typically a component nested within, or run alongside, the broader BCP — restoring the IT system is necessary but not sufficient if, for example, staff cannot reach the facility or a key vendor relationship has also failed.

Yes, where in scope. For group structures with a UAE or overseas subsidiary, PNPC's presence in both India and the UAE (Dubai office) allows a coordinated assessment across jurisdictions under a single engagement — assessing whether continuity planning and fraud control standards are applied consistently at the subsidiary level, and whether the parent Board has adequate visibility into subsidiary-level risk, rather than requiring separate, disconnected reviews by unrelated local providers.

Yes. While we recommend running both together where budget and time allow, given the overlap in root causes, we regularly scope either independently — a fraud risk assessment focused specifically on the finance function, for example, or a business continuity assessment focused only on IT and facilities. A narrower first engagement is often the right starting point for an organisation new to structured risk assessment, with the other half added in a subsequent phase.

Common red flags include: a vendor master file with duplicate or suspiciously similar vendor names, vendors sharing an address or bank account with an employee, round-number or just-below-approval-threshold transaction patterns, dormant vendor accounts suddenly becoming active, journal entries posted and approved by the same individual, unusually high employee reimbursement claims relative to role, and related-party transactions not routed through the formal approval and disclosure process. We test for these patterns using available transaction data as part of the assessment, alongside the qualitative control-environment review.

Insurance transfers financial risk after a loss occurs; it does not prevent the disruption or the fraud from happening, and most policies have conditions, exclusions, and sub-limits that only become apparent when a claim is made. In our experience, insurers themselves increasingly ask about the existence of a tested BCP and documented fraud risk controls when underwriting or renewing cyber and crime insurance — so a completed assessment can also support better insurance terms, not merely reduce reliance on the policy.

Both, by design. The report includes specific, sequenced remediation recommendations — not just a description of each gap. Where the client wants implementation support (updating the BCP/DRP document, redesigning a specific control, reconfiguring ERP access rights, drafting a revised vendor-onboarding approval workflow), PNPC provides that as a follow-on engagement, kept appropriately separate from the assessment role where independence considerations require it.

A Big 4 firm brings brand recognition and large-team capacity, typically at a substantially higher fee, often with the day-to-day engagement led by junior staff. A specialist risk consultancy may bring strong continuity or fraud-analytics expertise without the Chartered Accountancy grounding to connect findings back to the actual Companies Act, SEBI, and tax implications with full technical accuracy. PNPC combines nearly four decades of practising CA experience — including the statutory audit, tax, and regulatory context that fraud and continuity findings inevitably touch — with a senior-partner-led engagement model and coordinated India-UAE coverage for group structures.

Scoping consultation aligned to your actual driver and risk profile; Business Impact Analysis with RTO/RPO quantification for critical processes; single-point-of-failure mapping across people, vendors, systems, and facilities; review and update of existing BCP/DRP documentation; fraud risk mapping using the Fraud Triangle framework; segregation-of-duties and system access-rights testing; a facilitated tabletop exercise; a rated, prioritised findings register with root-cause analysis; management response capture; a written report; a live presentation to the Audit Committee/Board; and a follow-up verification review within the agreed remediation period.

Yes. Where the trigger is time-sensitive — an active investor due diligence process with a tight timeline, or a recent near-miss the Board wants addressed urgently — we can scope an accelerated, focused review covering the highest-risk processes and the most material fraud opportunity areas first, with the full assessment following as a second phase. This trades some breadth for speed and is agreed explicitly at scoping, not assumed.