deloitte forensic audit ndb bank

What a Forensic Audit Actually Finds (and Why Standard Audits Miss It)

Three years ago, a regional bank's board asked me to review a subset of their loan portfolio after a regulatory query surfaced inconsistencies in their provisioning methodology. The files looked clean on the surface. Reconciliations matched, approval chains were documented, the audit trail was intact.

What wasn't intact was the underlying credit assessment logic. Loan officers had been applying discretionary overrides to risk ratings without documenting the commercial rationale, and those overrides had compounded across quarters. By the time the regulator flagged it, the provision gap was material enough to require restatement.

This is what forensic audit work does that a standard audit doesn't. A standard audit checks compliance with stated policy. A forensic pass checks whether the policy itself is being applied consistently, and whether the numbers it produces reflect the economic reality underneath.

When a forensic audit is commissioned by a major firm like Deloitte into an institution like NDB Bank, the scope isn't just verifying the numbers. It's reconstructing the decision chain that produced them, testing whether controls were applied or bypassed, and isolating where discretion became distortion.

The gap between a clean reconciliation and a sound balance sheet is wider than most boards assume.

(A shorter version of this piece appears on [LinkedIn](LINKEDIN_POST_URL), but the mechanism behind forensic audit work requires more room than a post allows. What follows is the full breakdown.)

The Difference Between Audit Types Isn't Scope, It's Question

Standard financial audits answer one question: do the financial statements present fairly, in all material respects, the financial position of the entity in accordance with the applicable framework? That's IFRS, US GAAP, local standards, whatever the reporting regime requires. The auditor samples transactions, tests controls, confirms balances with third parties, and issues an opinion. Clean opinion means the statements are reliable for their intended purpose.

Forensic audits answer a different question: what actually happened here, and does the documented version match the economic substance? The scope isn't compliance with a framework. It's reconstruction. You're not testing whether the accounting treatment follows the rules. You're testing whether the transactions themselves occurred as described, whether the approvals were genuine, whether the judgments applied were defensible, and whether any party benefited improperly from the way the transaction was structured or recorded.

This distinction matters because institutions can pass a standard audit and still harbour material issues that only a forensic pass will surface. A standard audit samples. A forensic audit targets. If you're sampling randomly and the misconduct or error is concentrated in a specific product line, counterparty, or approval chain, the sample won't catch it. A forensic engagement starts with a hypothesis, or at minimum a red flag, and works backwards through the population that hypothesis touches.

In the regional bank case, the standard audit had tested loan provisions by sampling individual facilities and checking that the provision calculation matched the stated risk rating. It did. The problem was that the risk rating itself had been manipulated, not through fraud in the criminal sense, but through a pattern of undocumented overrides that loan officers applied when they felt the model was too conservative. Each override in isolation looked defensible. Across the portfolio, the pattern was clear: risk was being systematically understated, and provisions were lagging actual exposure.

The forensic pass didn't sample. It pulled every loan file where the final risk rating differed from the model output, traced the override back to the approving officer, and tested whether the override was supported by documented credit analysis. In most cases, it wasn't. The officers had applied judgment, but hadn't recorded the basis. That's a control failure, and it compounded.

What Forensic Work Actually Involves

Forensic audit isn't a term with a single definition. Depending on the engagement, it can mean investigating suspected fraud, reconstructing financial records after a system failure, quantifying damages in a dispute, or validating the integrity of a transaction before it closes. The unifying thread is that you're building an independent view of what happened, from source documents and primary evidence, without assuming that the existing records are accurate.

That process has structure. You start with a scope definition: what are we testing, what period, what hypothesis or allegation are we addressing? Then you gather the population of relevant transactions or balances. Then you apply tests designed to isolate anomalies, inconsistencies, or patterns that suggest the controls weren't applied or the substance differs from the form.

In a loan provisioning case, that might mean:

• Pulling the full loan tape, not a sample
• Comparing the stated risk rating to the model output for every facility
• Identifying where overrides occurred and testing whether they were documented
• Recalculating provisions under the stated policy and comparing to the booked amount
• Interviewing the officers who applied the overrides to understand the rationale
• Testing whether the override pattern correlates with officer performance incentives

The last point is critical. Forensic work doesn't assume bad faith, but it does test for it. If loan officers are compensated based on loan volume, and risk overrides reduce the provision charge and therefore improve the apparent profitability of the book, you have a structural incentive misalignment. That doesn't mean fraud occurred. It means the control environment has a weakness, and you need to test whether that weakness was exploited.

In the regional bank case, the provision gap wasn't fraud. It was a judgment failure that had been allowed to persist because the control, review of overrides, wasn't being performed consistently. The forensic pass quantified the gap, traced it to the source, and gave the board the evidence base they needed to restate and to redesign the control.

The Deloitte NDB Bank Context

When a major audit firm conducts a forensic audit into a bank, the engagement typically follows regulatory pressure, a whistleblower report, or board-level concern about the integrity of a specific area of the financials. The firm isn't there to provide comfort. It's there to answer a specific question that the standard audit process either didn't address or couldn't answer with the level of certainty the situation now requires.

Banks are complex. The balance sheet is large, the transaction volume is high, the products are varied, and the judgments embedded in the numbers are significant. Loan loss provisions, fair value estimates, hedge accounting, off-balance-sheet exposures, related party transactions, these are all areas where management judgment plays a material role, and where that judgment can be applied consistently or inconsistently, conservatively or aggressively, with proper documentation or without it.

A forensic audit into a bank's loan book, for example, will often focus on:

• Credit risk ratings: Are they applied consistently across the portfolio? Are overrides documented and approved? Do the ratings reflect the current financial condition of the borrower, or are they lagging?
• Provisioning methodology: Is the bank applying the stated policy? Are the inputs to the provision model (probability of default, loss given default, exposure at default) reasonable and supported? Are there pockets of the portfolio where provisions look light relative to the underlying risk?
• Collateral valuation: Are collateral values current? Are they based on independent appraisals or management estimates? If the latter, are those estimates tested and supportable?
• Loan modifications and forbearance: Are modifications being used to avoid recognizing impairment? Are forbearance arrangements genuine, or are they masking credit deterioration?
• Related party exposures: Are loans to insiders, directors, or connected parties disclosed and arm's length? Are the terms comparable to third-party facilities?

Each of these areas requires judgment. Forensic work tests whether that judgment was applied within the bounds of the policy, whether the policy itself is reasonable, and whether the outcome, the numbers on the balance sheet, reflects the economic reality.

The Mechanics of a Provision Gap

Loan loss provisions are an estimate. Under IFRS 9 or CECL (the US equivalent), banks must recognize expected credit losses, not just incurred losses. That means you're estimating what will go wrong in the future, based on current conditions and reasonable forecasts. The estimate is inherently uncertain, but it's not arbitrary. It must be supportable, documented, and consistent with the data.

The provision calculation typically follows this structure:

Where:

• PD is the probability of default over the relevant time horizon
• LGD is the loss given default, expressed as a percentage of the exposure
• EAD is the exposure at default, the outstanding balance at the point the borrower defaults

Each of these inputs is an estimate. PD might come from a credit rating model, internal or external. LGD depends on the expected recovery, which in turn depends on collateral value, seniority of the claim, and the efficiency of the recovery process. EAD depends on the facility structure, whether it's a term loan (EAD equals the outstanding balance) or a revolving facility (EAD includes undrawn commitments that might be drawn before default).

A provision gap arises when one or more of these inputs is systematically misstated. If PD is understated because risk ratings are too optimistic, the provision is too low. If LGD is understated because collateral values are stale or overstated, the provision is too low. If EAD excludes off-balance-sheet exposures that should be included, the provision is too low.

In the regional bank case, the gap was in PD. The model was producing risk ratings that reflected the borrower's financial condition, but loan officers were overriding those ratings downwards (lower risk, lower provision) without documenting the commercial rationale. The overrides weren't fraud. They were judgment calls. But they were being applied in one direction, optimistically, and they weren't being reviewed.

The forensic pass recalculated the provision using the model outputs, without the overrides. The difference was the provision gap. That gap had to be booked, the financials had to be restated, and the control over overrides had to be redesigned.

Why Boards Commission Forensic Work

Boards don't commission forensic audits lightly. They're expensive, they're disruptive, and they signal to regulators, investors, and sometimes the market that something is wrong. But the alternative, leaving a material uncertainty unresolved, is worse.

The trigger is usually one of three things:

1. Regulatory pressure: The regulator has identified an issue during an inspection or review, and the board needs an independent assessment of the scope and the remediation required.
2. Whistleblower or internal report: An employee or stakeholder has raised a concern about a specific transaction, relationship, or practice, and the board needs to establish the facts before deciding how to respond.
3. Transaction due diligence: The institution is being acquired, merged, or recapitalized, and the counterparty or the board itself wants assurance that the financials are clean before the deal closes.

In each case, the forensic audit serves the same function: it produces an independent, evidence-based view of what happened, so the board can make decisions with confidence. That might mean restating financials, exiting a relationship, redesigning a control, or simply confirming that the concern was unfounded and the numbers are sound.

The regional bank case was category one. The regulator had flagged the provisioning issue during a routine inspection. The board needed to know how big the problem was, whether it was isolated or systemic, and what had to change. The forensic pass gave them that answer.

What Forensic Audits Don't Do

Forensic audits don't issue opinions. A standard audit concludes with an opinion: the financials are fairly presented, or they're not. A forensic audit concludes with findings: this is what we tested, this is what we found, this is what it means. The findings might support a restatement, a control redesign, a disciplinary action, or a decision to take no further action. But the forensic auditor doesn't decide. The board does.

Forensic audits also don't replace management judgment. If the issue is that a provision estimate is at the low end of a reasonable range, the forensic auditor can point that out, can test whether the estimate is supportable, can highlight the sensitivity of the number to the assumptions. But if the estimate is within the range, it's management's call. The auditor's role is to test whether the judgment was applied consistently, documented, and defensible, not to substitute their own judgment for management's.

Finally, forensic audits don't catch everything. They're targeted. If the scope is loan provisioning, the audit won't test revenue recognition. If the scope is a specific counterparty, it won't test the rest of the portfolio. The value of a forensic audit is depth, not breadth. You're going deep into a specific area, reconstructing it from the ground up, and producing a level of assurance that a standard audit doesn't provide. But you're not re-auditing the entire entity.

What This Means for Institutions Under Pressure

If your institution is carrying regulatory pressure, board-level uncertainty, or stakeholder concern about the integrity of a specific area of the financials, the question isn't whether to commission forensic work. It's whether you can afford not to.

The cost of a forensic audit is measurable. The cost of leaving a material issue unresolved, where it surfaces later in a regulatory enforcement action, a failed transaction, or a market loss of confidence, is not. Boards that move early, that commission the work when the concern is still containable, come out ahead. Boards that wait, that hope the issue resolves itself or that the next audit cycle will provide clarity, usually don't.

The regional bank case is instructive. The board acted within weeks of the regulatory query. They scoped the work tightly, focused on the area of concern, and gave the forensic team access to the files and the people they needed. The result was a restatement, yes, but it was a controlled restatement. The board had the facts, they had the remediation plan, and they had the evidence base to show the regulator that the issue was understood and being addressed. The alternative, dragging it out over multiple quarters while the provision gap grew and the regulator's patience wore thin, would have been far worse.

The Practical Edge Cases

Forensic work surfaces edge cases that standard audits don't have time for. One of those, in the regional bank case, was the treatment of partially secured facilities. A loan is secured if the bank holds collateral. If the collateral value exceeds the exposure, the loan is fully secured, and the LGD is low. If the collateral value is less than the exposure, the loan is partially secured, and the LGD should reflect the unsecured portion.

The bank's policy was clear: LGD for partially secured loans should be a weighted average of the secured and unsecured portions. In practice, loan officers were treating partially secured loans as fully secured if the collateral covered more than half the exposure. That's not the policy. It's a simplification, and it understates LGD, which understates the provision.

The forensic pass tested every partially secured facility in the portfolio, recalculated LGD under the stated policy, and quantified the difference. It wasn't the largest component of the provision gap, but it was material, and it was a direct policy violation. The standard audit had sampled a handful of these loans and hadn't caught the pattern. The forensic pass tested the population and did.

This is the value of a forensic approach. You're not sampling and extrapolating. You're testing the full population of the area in question, and you're catching the patterns that a sample would miss.

When the Numbers Look Clean But the Logic Doesn't

The hardest cases aren't the ones where the numbers are obviously wrong. They're the ones where the numbers reconcile, the controls appear to have been applied, and the audit trail is intact, but the underlying logic doesn't hold.

In the regional bank case, the reconciliations were clean. The provision balance on the general ledger matched the sum of the individual loan provisions. The loan provisions matched the stated risk ratings. The risk ratings had been approved by the credit committee. Everything checked.

What didn't check was the question: are these risk ratings defensible? The forensic pass didn't assume they were. It tested them. It pulled the borrower financials, recalculated the model outputs, compared them to the final ratings, and identified where the two diverged. Then it traced the divergence back to the override, and tested whether the override was documented and supportable.

In most cases, it wasn't. The officers had applied judgment, but the judgment was optimistic, and it wasn't backed by analysis. That's the gap a standard audit doesn't catch, because a standard audit assumes the controls were applied. A forensic audit tests whether they were.

The Role of Documentation

Documentation is the difference between defensible judgment and indefensible judgment. If a loan officer overrides a model-generated risk rating, and the override is supported by a memo that explains the borrower's strengths, the collateral coverage, the repayment track record, and the officer's view of the forward risk, that's defensible. If the override isn't documented, it's not.

The regional bank's policy required documentation. The practice didn't match the policy. That's a control failure, and it's the kind of failure that compounds. One undocumented override in a portfolio of hundreds of loans isn't material. A pattern of undocumented overrides, concentrated in a specific product line or officer, is.

The forensic pass didn't just identify the overrides. It tested whether the pattern was random or systematic. It wasn't random. The overrides were concentrated in the commercial real estate book, and they were applied by a small number of officers. That's a red flag. It suggests either that those officers were applying judgment differently from their peers, or that the model was miscalibrated for that segment. Either way, it's a problem that needs to be addressed.

The board addressed it. They tightened the override policy, introduced a secondary review for all overrides above a certain threshold, and recalibrated the model