Forensic Case Files + Capstone

Phase 2 · Week 25 · ~20 hours · Gate: the M3 milestone (two full QoE workups + timed forensic exam)

Where it sits. Seventeen documented corporate disasters, seven global and ten Indian, worked as forensic case files, each read the way you should have read it before the collapse. That's the week. It closes Phase 2 and pays off everything since week 14. You built the ratio and benchmarking toolkit first. Next came the seven earnings games and the residue they leave on the balance sheet. Then you added cash-flow games and the quantitative screens (Beneish M-Score, Sloan accruals, Altman Z/Z′/Z″, Piotroski F). Now all of it points at real companies. After the cases comes the capstone: two full quality-of-earnings workups on one live Indian company and one live American company, plus a timed spot-the-shenanigan exam. Passing certifies competency C2, judge quality of earnings, and unlocks Phase 3, where you begin valuing businesses. You'll go in knowing when the inputs to a valuation can be trusted, and that was the reason for this whole phase.

Suggested hour budget. Case files (read actively, compute along): 8h · worked examples: 1.5h · practice set: 2.5h · capstone Part A (two QoE workups): 6h · capstone Part B (timed exam): 1h · flashcards + review: 1h.

App link. The Quality & Red Flags branch's capstone tier is seeded from here: the "caught a shenanigan" badge cases, the timed forensic exam mode, and the calibration scoring (catches vs false positives). Your red-flags and quality-of-earnings checklist is the phase's own artifact. It gets finalised here. After that it becomes a permanent input to the one-to-two-hour teardown you'll learn much later.

A note on facts and fairness, before anything else. These case files describe real companies, real people, and real losses. Only what public findings established is stated as fact: regulator orders, court convictions, company restatements, administrators' and investigation-committee reports, signed confessions. Everything else is explicitly marked allegation or reported. Several matters remain in litigation; statuses are marked "(as of mid-2026)". You will practice this same discipline in your own write-ups, because it is both an ethical duty and a legal necessity of the analyst's craft.

Learning objectives

By the end of the week you can:

1. Reconstruct the mechanics of twenty-one major frauds and quality-of-earnings failures (Enron, WorldCom, Tesco, Toshiba, Valeant, Wirecard, Luckin Coffee, Steinhoff; Satyam, IL&FS, Yes Bank, DHFL, Manpasand, Vakrangee, PC Jeweller, Cox & Kings, CG Power, Zee, Gitanjali, Ricoh India, Gensol) at journal-entry level where publicly known, and classify each into the M2.06 taxonomy and M2.07 cash-flow/screen framework.
2. Name what was visible in advance for each case: the specific filing lines, ratios, notes, and disclosures that fired one to three years before collapse. State which M2.06/M2.07 test catches each one.
3. Distinguish adjudicated fact from allegation in your own writing, using the language protocol (what a regulator found, what an agency alleged, what a journalist reported), and explain why this distinction is an analyst's fiduciary and legal obligation.
4. Judge the gatekeepers: assess auditor independence (fees, tenure, confirmations, resignations), board and audit-committee fiduciary conduct, and promoter governance (pledge, related-party ecosystems), using the cases as calibrated precedents.
5. Run the full 10-step QoE workup on a live company in about three hours: spread, ratio panel, residue pass, notes evidence, quantitative screens, severity-laddered findings register, core-earnings bridge, management-credibility read, verdict memo, calibration log.
6. Pass a timed forensic exam: catch at least 80% of seeded shenanigans with a false-positive rate under 20%, naming the family and the detection test for each catch.
7. Convert flags into portfolio-grade decisions using the position-response ladder (question → discount → limit → avoid/exit) rather than binary fraud verdicts, and articulate why false positives destroy analyst credibility as surely as misses destroy capital.

Prerequisites & connections

Builds on. Everything in Phase 2, deliberately. M2.01–M2.02 (the ratio panel each case file computes), M2.03 (ROIC, Enron's single most damning number), M2.04 (CFO/EBITDA and FCF conversion, the WorldCom and Vakrangee tells), M2.05 (benchmarking: WorldCom's line-cost ratio and Cox & Kings' DSO die by cross-section), M2.06 (the seven earnings games, the residue table, the severity ladder, the India disclosure arsenal), M2.07 (CFO games, Beneish M-Score, Sloan accruals, Altman Z″, Piotroski F, the NBFC/ALM panel). From Phase 1: M1.06 (revenue recognition), M1.07 (capitalisation and impairment), M1.09 (consolidation: Enron's SPEs and IL&FS's 347 entities), M1.10 (the auditor's report, CARO, Schedule III).

Feeds into. Phase 3 immediately (never DCF a company you haven't QoE-cleared; garbage inputs produce precise garbage), M5 sector playbooks (each sector's red-flag panel descends from these cases), M8.02 (the ten-minute QoE pass inside the 1–2 hour teardown is all of this compressed), C7 (management and governance judgment), and your permanent red-flags checklist artifact, finalized here.

The week in one line. Seventeen times in twenty-five years, public filings told anyone who computed five ratios and read three notes that the reported numbers could not be true. The week makes you the person who computes them, then proves it under time pressure on companies whose endings are not yet written.

Core teaching content

4.1 How to work a case file: method, hindsight discipline, and the three duties

The five-part anatomy. Every case file below has the same skeleton, and every case file you ever write should too:

1. The business and the story told: what the company claimed to be, and why the market believed it. Frauds are narratives first; the numbers are set-dressing.
2. The mechanics: the actual manipulation, at journal-entry level where public findings permit. You already know that every lie is a debit and a credit. Here you see where real managements put them.
3. Visible in advance: the specific lines, ratios, and notes in public filings that fired before the end. That part builds your skill, so read it with a calculator in hand.
4. Tests that fire, meaning which of your instruments catch it: the residue tests, the screens, the India disclosure arsenal.
5. Aftermath and lesson: what broke, who paid, what the gatekeepers did and failed to do, and the one transferable rule.

The hindsight discipline. Worked casually, case studies teach arrogance, because everything is obvious after the fact. Worked properly, they teach calibration. For every case, ask three questions.

• (a) When did the evidence become visible in public documents?
• (b) At that moment, what confidence did the evidence justify: a question, a discount, a position limit, or an exit?
• (c) Who acted on it in real time, and what did it cost them to be early?

The answers are humbling. Flags typically came one to three years before collapse. They were enough to justify decisions about exposure, though never a fraud verdict. The people who acted early were mostly short sellers and journalists, plus a handful of auditors who resigned. They were attacked. They were sued and investigated. Some were right too soon to profit.

So don't ask yourself "would I have called the fraud". Ask "would my process have had me out, small, or demanding answers."

The three duties. They're the ethics spine of the week. Every case is a failure at three layers, and you need to grade each layer separately:

• Management's fiduciary duty. Directors and officers are fiduciaries for all shareholders. The frauds below are, at bottom, thefts of trust. Minority shareholders' capital gets converted into promoters' loans, executives' bonuses, or a stock price that insiders sold into. In India, promoter families typically control the board, so the fiduciary question sharpens into the promoter-governance question. Does value accrue to the listed company, or leak into the ecosystem around it?
• Gatekeeper independence. Auditors, boards, audit committees, rating agencies, and regulators exist to make outside capital safe. The cases show every failure mode. There's the auditor whose consulting fees exceed the audit fee: Enron's Andersen took roughly $27m for consulting against $25m for the audit in 2000. There's the auditor who never independently confirmed the cash: Satyam's PW, and for years Wirecard's EY. Enron's board waived its own ethics code so the CFO could run the entities on the other side of its trades, and it did so twice. IL&FS held its AAA rating until weeks before default. And in 2019 BaFin investigated the FT's journalists instead of the company. You'll also meet the gatekeepers who did their duty: Deloitte resigning at Manpasand and DHFL, Price Waterhouse resigning at Vakrangee, EY finally refusing Wirecard's opinion. Learn from them that a mid-tenure auditor resignation is among the highest-conviction public signals that exists.
• The analyst's duty. These are your own standards, in the mould of the CFA Institute's code. You owe diligence and a reasonable basis for every claim. You stay independent of management access and of your own book. You deal fairly in what you publish. You don't trade on material non-public information. The short sellers you'll admire below worked from public filings and legwork, from receipts, store counts and site visits, never from leaks. And your language keeps a finding apart from an allegation, and both apart from suspicion. The cases add one more duty, and make it vivid: courage. Think of Chanos on Enron, McCrum on Wirecard, 2Point2 Capital on Manpasand. The people who said the uncomfortable thing performed a fiduciary function for the whole market. They were called liars until the day they were called prophets.

Language protocol. Use it in every write-up, starting this week. State facts with attribution to the finder: "the SEC's order found…", "the CBI special court convicted…", "the company restated…", "the board disclosed…". State allegations as allegations with their source and status: "the ED has alleged…; trial ongoing (as of mid-2026)". Keep the word fraud for adjudicated findings or the company's own admissions. Your own analysis should describe evidence and leave verdicts to others: "reported cash yields 2.1% against deposit rates near 7%, which I cannot reconcile with the cash being both real and unencumbered". That sentence is true and useful, and you can defend it.

You can't defend "the cash is fake".

4.2 The global files: case files G1–G8

Two decades, eight collapses. By G7 you'll see they're essentially seven variations on plays you already know from the earnings-games taxonomy. Read each with the residue table open.

G1 · Enron (US, 2001): mark-to-market earnings, SPEs, and the related-party note nobody read

The business and the story told. A Houston pipeline company that Kenneth Lay and Jeffrey Skilling remade into an "asset-light" energy and derivatives trader in gas, power, broadband and weather, plus merchant investments. The story was a new-economy market-maker that deserved a tech multiple. Reported revenue of roughly $101bn for 2000 made it America's seventh-largest company by revenue. That revenue was gross-booked trading notionals, the size illusion you learned as the gross-up inside revenue that isn’t. Its stock peaked near $90 in August 2000.

The mechanics. Three engines, all now established by the Powers special-committee report, the bankruptcy examiner, SEC actions, and criminal convictions.

(1) Mark-to-market on long-dated contracts, which the SEC had permitted for Enron's gas trading from 1992. Enron booked the present value of a contract's entire projected profit at signing, off its own price curves: Dr Price risk management asset / Cr Revenue (unrealized). The infamous Braveheart structure monetised a Blockbuster video-on-demand pilot for roughly $110m of profit across two quarters. It never worked commercially. This is revenue too soon taken to its logical limit. Profit arrived a decade early, at a margin management invented.

(2) SPEs and off-balance-sheet debt. Entities like Chewco and the LJM partnerships absorbed debt, and the LJM partnerships were run by Enron's own CFO, Andrew Fastow. They "hedged" Enron's merchant investments with vehicles capitalised substantially in Enron's own stock, the Raptors. A hedge with an entity funded by your own shares is no hedge at all. When the stock fell, the hedges died with the assets they insured. Chewco never met even the era's threadbare 3% outside-equity rule. Consolidating it and an LJM subsidiary in November 2001 forced a restatement that cut 1997–2000 net income by about $586m.

(3) Prepay transactions. Enron borrowed billions from banks and dressed the loans as commodity trades, so the cash arrived inside operating cash flow. You've seen this classification game before. Enron played it at industrial scale.

Visible in advance. Almost everything, if you computed. The related-party note in the 1999 and 2000 filings disclosed, in plain if fog-grey prose, that a "senior officer" was managing member of partnerships doing billions of business with the company. It's the most damning footnote of the era, and Enron printed it twice.

Then the returns on capital. Jim Chanos's starting point in late 2000 was simply that Enron earned roughly a 6–7% return on capital, and its cost of capital was higher. As an illustration, EBIT near $2bn on ~$100bn of revenue is a ~2% margin, with NOPAT on invested capital in the low-to-mid single digits. So the "growth machine" destroyed value as it grew. Operating cash flow was violently back-end-loaded and propped up by prepays. Free cash flow after capex and acquisitions stayed negative year after year while debt climbed. And in March 2001, Bethany McLean's Fortune piece asked the disqualifying question.

Nobody, including Enron's admirers, could explain how it actually made money.

If you can't benchmark a company, don't treat it as a mystery to respect. Treat it as a risk, and size it at zero.

Tests that fire. Revenue too soon, from the mark-to-market pull-forward, with unbilled "price risk management" assets ballooning. Revenue that isn’t, from the related-party note and hedges with no economic substance. The gross-up screen: gigantic revenue on margins of ~1–2%. ROIC against WACC. CFO−NI divergence and the prepay classification game. Sloan accruals, with an enormous soft-asset build. Then the meta-signals: an auditor conflict (Andersen's consulting > audit fees), and a board waiving its ethics code for Fastow, a fiduciary self-own disclosed in the proxy.

Aftermath and lesson. In Q3 2001 came a $618m loss and a $1.2bn equity write-down. In November, the $586m restatement. On December 2, 2001, Enron filed what was then the largest US bankruptcy (~$63bn of assets). Skilling was convicted in 2006. Lay was convicted and died before sentencing. Fastow had personally pocketed roughly $45m from the LJM structures. He cooperated and served six years. Arthur Andersen was convicted of obstruction in 2002 and disintegrated, taking 28,000 US jobs with it. That conviction was overturned in 2005, too late to matter. Congress answered with Sarbanes-Oxley (2002). It brought CEO/CFO certifications and auditor-independence rules, and it created the PCAOB.

Lesson: read the related-party note before the P&L. Distrust profits that are opinions, which is what mark-to-model gives you. A company whose returns on capital trail its cost of capital is destroying value no matter how fast it grows. And when the CFO sits on both sides of the table, the fiduciary machinery has already failed, whatever the auditors sign.

G2 · WorldCom (US, 2002): the biggest cost line, moved below the line

The business and the story told. Bernie Ebbers rolled up over sixty telecom acquisitions into America's second-largest long-distance and internet carrier. The biggest was the $37bn MCI deal. He rode the claim that internet traffic doubled every hundred days. The story was that scale plus acquisition synergies meant margins that would keep expanding for ever.

The mechanics. Established by the SEC action, the bankruptcy examiner, the board's own Beresford report, and criminal convictions. WorldCom's largest expense was line costs, the fees it paid to lease other carriers' networks. When the telecom glut crushed pricing, CFO Scott Sullivan's team first drained accrual reserves into income, the cookie jar you already know. Then, from 2001, they simply capitalised ordinary line costs as "prepaid capacity": Dr PP&E / Cr Line cost expense. About $3.8bn surfaced in the first sweep. In total, the misstatement came to roughly $11bn.

You know this as cost parked, and you know its signature. EBITDA and CFO inflate, because the expense leaves the P&L and the cash moves into investing. FCF doesn't move at all.

Visible in advance. One cross-sectional ratio was enough, and that's the whole argument for benchmarking. WorldCom reported line costs at ~42% of revenue, quarter after suspiciously stable quarter. AT&T and Sprint reported ~50%+ in the same collapsing price environment. Either WorldCom had network economics that broke the laws of physics, or the costs were going somewhere else.

Other signs backed it up. Capex ran vastly above peers in an industry drowning in capacity, so capex ÷ D&A was elevated. Reported margins stayed flat while industry pricing fell 20%+, the "margin defies gravity" impossibility. Goodwill from the roll-up towered over tangible equity. And the proxy disclosed over $400m of board-approved loans to the CEO, secured by his stock. That's America's version of the promoter pledge, and the mechanics are identical: margin pressure on the insider becomes pressure on the accounts.

Tests that fire. Cost parked, through capex ÷ D&A and the scissor of EBITDA up while FCF stays flat. Profit in a jar and the big bath, through releases in the reserve roll-forward. Cross-sectional cost benchmarking. CFO inflation through reclassification. Beneish's AQI and TATA components. And the governance meta-signal, the loans to the CEO.

Aftermath and lesson. Internal auditor Cynthia Cooper's team surfaced the entries in June 2002, working nights against instructions to delay. In July the company filed what was then the largest bankruptcy, with $104bn of assets. Ebbers was convicted in 2005 and got 25 years. Sullivan cooperated. The SEC's civil settlement returned $750m to investors, and the company re-emerged as MCI and was bought by Verizon.

Lesson: benchmark the biggest cost line against peers every time. One ratio caught an $11bn fraud. A too-stable ratio in a volatile industry is a red flag in itself. And honour the Cynthia Cooper clause of the analyst's code: the person who checks the entries outranks the person who tells the story.

G3 · Tesco (UK, 2014): supplier rebates and the margin that defied the discounters

The business and the story told. Britain's dominant grocer, under siege from Aldi and Lidl, telling the market its margins could hold while like-for-like sales fell. Grocery retail runs on thin front margins plus commercial income: supplier rebates, volume bonuses and promotional funding, all booked as reductions of cost of sales.

The mechanics. The sources are the company's announcements and the FCA's findings. There's also the agreed statement of facts in the SFO's deferred prosecution agreement. Tesco pulled forward rebate income it hadn't yet earned and delayed cost accruals. That overstated expected first-half FY2014/15 profit by about £250m, finalised near £263m once prior periods were included. At entry level it looks like this: Dr Accrued commercial income (receivable from suppliers) / Cr Cost of sales, booked on deals whose conditions (volumes, promotions) hadn't yet been met. A whistleblower took it to the general counsel. New CEO Dave Lewis announced it on 22 September 2014.

Visible in advance. The abuse itself was hard to see because the disclosure didn't exist. Tesco didn't separately quantify commercial income, and that opacity is the flag. You learned the rule earlier: the number management most depends on and least discloses is where the stress concentrates. Some things were visible, though. Margins held implausibly flat while like-for-like sales fell and discounters took share, which fails the impossibility test. Payables and dependence on supplier funding were growing. And sector analysts were publicly worrying about rebate accounting across UK grocery.

A careful analyst's note in early 2014 would have said: "I cannot reconcile stable margins with this trading environment; the reconciliation likely lives in unquantified commercial income; treat earnings quality as low."

Tests that fire. The revenue too soon and cost hidden hybrid. Income was accrued early and costs late. A divergence test of margin against traffic. Sloan's accrual quality measure, which catches profits running ahead of operating cash. And the meta-signal of opaque disclosure.

Aftermath and lesson. Tesco's stock fell ~12% in a day. Buffett, a large holder, sold at a loss he publicly called "a huge mistake." The SFO's DPA (2017) cost £129m. On top of that came ~£85m to investors, the FCA's first-ever use of its compensation power. The three individual prosecutions failed at trial: one collapsed, and acquittals followed. Keep that in mind. Company-level findings and individual criminal guilt are different standards, and your language has to track the difference. UK grocers now disclose commercial income explicitly.

Lesson: in any retail or consumer business, ask how much profit is supplier money, on what conditions, and where it's disclosed. When a margin defies its industry's gravity, the explanation is either a moat you can name or an accrual you can't see.

G4 · Toshiba (Japan, 2015): "challenges," percentage-of-completion, and profit made to order

The business and the story told. A 140-year-old conglomerate in semiconductors, laptops, appliances and nuclear (Westinghouse), presenting the steady profitability expected of a Japanese blue chip through the post-2008 and post-Fukushima shocks.

The mechanics. Established by the independent investigation committee (2015) and Japan's FSA: roughly ¥152bn (~$1.2bn) of overstated pre-tax profit across FY2008–FY2014. Total restatements ended up larger once the self-review was complete. No single scheme produced it. A culture did. Successive CEOs issued quarter-end "challenges" (improve profit by so much, now), and the divisions delivered in three ways.

(1) Percentage-of-completion abuse on infrastructure contracts. They understated estimated total costs, which pushed cumulative revenue and margin ahead of reality. They also delayed recognising contract losses. That's the play described in section 4.3d of the earnings-games taxonomy. (2) The PC "masking price" carousel. Toshiba sold components to contract manufacturers at inflated internal prices and booked the margin before finished goods came back. Profit sat parked in quarter-end parts channels, an industrial cousin of channel stuffing. (3) Deferred writedowns and provisions. No forged document turned up at the top.

Pressure did the falsifying at the bottom.

That is the fraud triangle with the "opportunity" leg supplied by conglomerate opacity and a compliant audit.

Visible in advance. Segment-level scrutiny worked where consolidated ratios blurred. PC segment margins stayed stable-to-positive while HP, Dell and Acer bled in the same market. That's WorldCom's cross-sectional tell in a new home. Fourth-quarter profit made hockey sticks. Inventories and "advances" swelled in the PC channel. Contract-loss provisions were thin against peers in the same nuclear/EPC businesses. And Westinghouse goodwill sat serenely unimpaired through a global nuclear winter after 2011. You know that failure-to-impair signature of cost parked, and you know the test for it: "what would have to be true for this asset to earn its carrying value?"

Tests that fire. Revenue too soon, through understated cost estimates on POC contracts. Cost parked and cost hidden, through deferred writedowns and thin provisions. Big bath timing. Segment benchmarking, and accrual screens run on segment data. Then the governance meta-signals: an insider-dominated board, and an audit committee chaired by a former CFO of the company.

Aftermath and lesson. Three CEOs resigned in July 2015. Japan's FSA levied a then-record ¥7.37bn fine. The auditor, Ernst & Young ShinNihon, was fined ¥2.1bn and barred from new engagements for three months, a rare direct sanction on an auditor. Still, the deferred nuclear reckoning arrived. Westinghouse's 2017 Chapter 11 produced a ~¥1 trillion loss year and negative equity. Toshiba had to sell its crown-jewel memory business, and in 2023 it was taken private and delisted after 74 years.

Lesson: culture is an accounting control. When targets are commands, estimates become instruments. So read POC companies through their cost-estimate revisions and provision roll-forwards, and benchmark each segment against its own industry. "The writedown that never comes" is borrowing against a future that always collects.

G5 · Valeant (US/Canada, 2015–16): the roll-up, the captive pharmacy, and the non-GAAP chasm

The business and the story told. Under CEO Michael Pearson, Valeant Pharmaceuticals turned the industry model upside down. It bought drugs instead of discovering them, with R&D at ~3% of sales against an industry 15–20%. It raised prices hard. On acquisition day in February 2015 the cardiac drugs Isuprel and Nitropress went up 525% and 212%. It funded all this with more than $30bn of debt, and reported "cash EPS" that excluded amortisation and deal costs. The story was "platform value", a repeatable acquisition machine. For a while it made Valeant Canada's most valuable company, at ~$90bn.

The mechanics. Two layers. The first was legal, and the whole story rested on it. Growth was mostly price. GAAP results, weighed down by heavy amortisation and integration charges, drifted ever further from adjusted "cash EPS". And each new deal reset the comparability clock. Remember the serial-acquirer warning: the roll-up is the natural habitat of big-bath reserves and purchase-accounting fog.

The second layer was adjudicated. Philidor was a specialty pharmacy that Valeant secretly controlled. Valeant had bought an option to acquire it for $100m in December 2014, and consolidated it as a VIE without disclosing what it was or that it existed. Philidor pushed Valeant scripts through aggressive reimbursement practices, and Valeant booked revenue on sell-in to a channel it controlled. You know this as the captive-channel hybrid of revenue too soon and revenue that isn’t: stuffing your own warehouse and calling it demand. The March 2016 restatement moved roughly $58m of revenue out of 2014. The SEC's 2020 settled order ($45m penalty) cited improperly recognised revenue and misleading non-GAAP disclosure. Two Valeant/Philidor executives were criminally convicted (2018) in a kickback scheme.

Visible in advance. Start with the non-GAAP chasm: GAAP EPS near zero or negative against double-digit "cash EPS". Every release printed it. If you policed the adjusted metrics, the narrative layer of earnings games, you had the whole case. Analysts who split growth into price and volume found volumes flat-to-down in key franchises. Leverage was $30bn+ of debt against adjusted EBITDA whose adjustments never ended.

Then the channel. In October 2015 Roddy Boyd's SIRF and Citron Research exposed the undisclosed Philidor network within days of each other. A lawsuit by a pharmacy partner, R&O, had already put fragments on the public record. The meta-signals were there too: congressional subpoenas over pricing (September 2015), and a CEO celebrated for the very aggression that should have priced in the risk.

Tests that fire. Policing the non-GAAP reconciliation: bridge every adjustment back, and treat recurring "one-times" as windfall as operations. Revenue too soon through captive-channel sell-in, caught by DSO and channel checks. Roll-up hygiene, which means restating organic growth yourself and setting goodwill against tangible equity. Leverage and covenant pressure, with Altman run on the un-adjusted numbers. And reading the related-party and VIE disclosures with the consolidation question in mind: who bears the risk of entities you consolidate or conspicuously don't discuss?

Aftermath and lesson. Valeant's stock went from $263 (August 2015) to under $12 (2017), a >95% drawdown. Among the losses was roughly $4bn of Pershing Square's capital. The smartest money in the room had modelled everything except the accounting. Pearson left in May 2016. It paid a $1.21bn securities class-action settlement (2019) and the SEC $45m (2020), and renamed itself Bausch Health.

Lesson: when adjusted earnings and GAAP earnings diverge and the gap grows, the adjustments are the business model. Split growth into price and volume before you believe it. An undisclosed captive channel is related-party revenue wearing a customer's coat. And debt-funded roll-ups don't get the benefit of the doubt. They get rebuilt from the ground up, the way you learned in benchmarking.

G6 · Wirecard (Germany, 2020): the €1.9bn that was never there

The business and the story told. A Munich payments processor that grew from porn-and-gambling acquiring into a DAX-30 fintech champion. It joined the index in September 2018, displacing Commerzbank. Wirecard claimed high-margin payment processing across Asia through third-party acquiring (TPA) partners, in markets where it lacked licences, and said the resulting cash sat in trustee or escrow accounts. Peak market value: ~€24bn.

The mechanics. The sources are the KPMG special investigation (published April 2020), EY's refusal of an opinion (June 2020), the insolvency administrator, and the criminal proceedings still running. The Munich trial of CEO Markus Braun has been running since December 2022 (as of mid-2026). Here's what they established. The TPA business, roughly half of reported revenue and substantially all of reported EBITDA, couldn't be verified. And the €1.9bn of escrow cash "likely never existed". Banks in Manila said the confirmation documents were spurious.

Mechanically, this is Satyam's German twin, revenue that isn’t in pure form: Dr Escrow cash (fictitious) / Cr Commission revenue (fictitious). Fake revenue has to end up in a fake asset sooner or later. Wirecard picked the asset that auditors had historically checked on paper, without going to look. Working from internal documents in October 2019, the FT also documented round-tripping patterns. It reported an India acquisition bought for €340m from a Mauritius fund that had paid a small fraction of that weeks earlier, with money going to beneficiaries never satisfactorily identified. That part is reported. Civil and criminal proceedings continue.

Visible in advance. Five years of public record. From 2015 the FT ran its "House of Wirecard" series. In 2016 the Zatarra report made allegations. In January–February 2019 the FT published whistleblower accounts of forged contracts in Singapore, and police raided the office. In October 2019 it published internal spreadsheets indicating that the TPA partners carried the profits.

The filings showed cash that behaved like it wasn't there. Wirecard raised a €900m convertible from SoftBank (April 2019) and €500m of bonds (September 2019) while reporting billions of net cash. That fails the borrowing-despite-cash test. Interest income implied sub-1% yields on the supposed balances, which fails the cash-yield test. Receivables from TPA partners were swelling. And profits sat in the one segment the auditor couldn't directly verify, the segment-of-convenience test.

The meta-signals were deafening. EY had signed unqualified opinions for a decade without independently confirming the escrow balances at source. The Wambach report's account makes it a textbook failure of independence and diligence. Then there was the regulator. BaFin answered the FT's reporting by banning short sales of Wirecard (February 2019) and filing criminal complaints against the journalists.

When a gatekeeper is captured like that, you can trade on it.

Tests that fire. Revenue that isn’t, a fictitious revenue and asset pair. Cash-yield and borrowing-despite-cash tests. Profit concentrated in the geography nobody could audit. Growth in TPA receivables. KPMG's inability to verify, a public document two months before the end and the loudest pre-collapse warning in these seventeen files. At the meta level: the auditor's tenure and confirmation hygiene, plus the regulator's behaviour.

Now look at which tests don't fire. Fully fabricated revenue with fabricated cash defeats Sloan accruals. CFO looks fine, because the "cash" reconciles. The quantitative screens have a known blind spot here. What catches it is asking whether the asset can be verified, and the accruals won't tell you that.

Aftermath and lesson. EY refused the FY2019 opinion on 18 June 2020. The board conceded the €1.9bn likely did not exist, and insolvency followed on 25 June. Wirecard was the first DAX member ever to fail. Braun sits in the dock. COO Jan Marsalek fled and remains a fugitive, reportedly in Russia, with reported intelligence links that remain allegations. Germany rebuilt its audit oversight with FISG in 2021. It brought in mandatory rotation and gave BaFin direct investigation powers. In 2023 the audit regulator APAS fined EY Germany and barred it from new listed-company mandates for two years.

Lesson: verify the asset that backs the profit, cash most of all. Treat journalists and short sellers as unpaid due-diligence providers, and check their work. A company's denials don't count as a check. And when profits live where the auditor can't go, somebody chose that geography on purpose.

G7 · Luckin Coffee (China/US listing, 2020): fabricated sales, counted cup by cup

The business and the story told. Founded 2017, Nasdaq IPO by May 2019. Luckin called itself a "technology company that sells coffee". Ordering was app-only, stores opened faster than Starbucks China's, and management said the unit economics were turning profitable as discounts tapered off.

The mechanics. The sources are the company's special-committee findings, the SEC's settled action ($180m penalty, December 2020), and the restatement. From Q2 2019, employees under the COO fabricated roughly RMB 2.12bn of net revenue (April–December 2019). Most of it came from bulk "sales" of item vouchers to shell counterparties linked to associates of the chairman's network. They also inflated costs by about RMB 1.34bn so the expense side would hang together. Faking both legs made margins and cash burn look internally consistent. Fake order sequence numbers papered over the app trail. This is revenue that isn’t with production values. The bogus costs were camouflage against the very accrual screens you've just learned.

Visible in advance. Luckin was young, so the filing trail was thin. That's a benchmarking lesson in itself: no history to benchmark means wider error bars, and wider error bars mean a smaller position. What broke it was primary observation. An anonymous 89-page report, published via Muddy Waters on 31 January 2020, was built on 11,260 hours of store video across 981 store-days, plus 25,843 customer receipts and mobile-app order data. It found items per store per day overstated by ~69% (Q3 2019) and ~88% (Q4 2019), and net selling prices inflated ~12%. That's Phil Fisher's scuttlebutt turned into a weapon. Anyone can type a ledger.

Nobody can fake the queue at the counter, so they counted cups.

The filings had their own signs. The unit economics turned implausibly fast while discounting carried on undiminished. And the company disclosed that the chairman and CEO had pledged roughly half their combined holdings against a ~$518m margin facility. That's promoter-pledge risk, Nasdaq edition. In April 2020 the loan defaulted, and lenders seized the collateral.

Tests that fire. Revenue that isn’t: revenue nobody outside the ledger can see, which fails the "revenue you can verify with your feet" test. Related-party patterns among counterparties. At the meta level, the pledge disclosure. And the timing of an IPO followed by a raise. The fabrication window sat between listing and a January 2020 follow-on, which is the capital-raising incentive from section 4.1 of the earnings-games taxonomy. Then the humbling one. Beneish and Sloan largely don't fire when both legs are faked. Your screens are instruments.

They can't see the future.

Aftermath and lesson. Luckin made its disclosure on 2 April 2020 and the stock fell 75% in a day. Nasdaq delisted it by June. Then came the $180m SEC settlement. The chairman and CEO were ousted. Now the twist, and it should keep your cynicism in check. Under new ownership and management, the underlying business proved real enough to restructure and exit bankruptcy protection.

By 2023 it was out-selling Starbucks in China.

Lesson: fabricated accounts and viable businesses can coexist. Judge the fraud and the business separately. When the ledger and the sidewalk disagree, trust the sidewalk. And read pledge disclosures wherever on earth the ticker trades.

G8 · Steinhoff (South Africa / Netherlands / Germany, 2017): the roll-up that bought its own growth

The business and the story told. A South African furniture and general-merchandise group that grew by acquisition for two decades into a multinational retailer. It carried a primary listing in Frankfurt and a secondary listing in Johannesburg, and owned Conforama in France, Poundland in the United Kingdom, Mattress Firm in the United States and Pepkor in southern Africa. The story: a disciplined, tax-efficient consolidator of unloved retail assets, compounding earnings through scale and sourcing. Market value peaked near EUR 20bn in 2016.

The mechanics. On 5 December 2017 the company announced that the chief executive had resigned and that accounting irregularities requiring further investigation had come to light. Within days the share price fell more than 90%. PwC's forensic investigation, whose overview the company published in March 2019, found roughly EUR 6.5bn of irregular transactions recorded between 2009 and 2017, entered by a small group of former executives together with counterparties that were presented as independent third parties and were not. Three recurring patterns ran through the findings: fictitious or irregular income booked through those entities and recognised as profit; assets and intra-group receivables carried at values the underlying businesses could not support; and a structure of contributions and reimbursements that moved apparent profit between group companies. The restated 2016 and 2017 accounts, published in 2019, reduced reported equity and profit by amounts that made the pre-2017 record largely uninformative.

You know the shape from AA3, in section 4.15 of the cash-flow lessons. Acquisitions that arrive every year keep the consolidated growth rate smooth, and the organic rate underneath goes unreported. Steinhoff never gave an organic split anyone could reconstruct. That missing split was the disclosure to demand.

Visible in advance. More than in most files. German prosecutors searched the group's offices in November 2015 in connection with suspected balance-sheet irregularities, and the company confirmed it publicly at the time, so a criminal investigation into the accounts had been in the public record for two full years while the stock traded at a premium multiple. The group structure was, by common consent among the analysts covering it, not reconcilable: cross-border, dual-listed, with a long tail of entities whose relationship to the group was described rather than quantified. Goodwill and intangibles dwarfed tangible net assets after a decade of deals. Cash conversion trailed reported profit persistently, in a retail business that should generate cash. The effective tax rate was implausibly low for the mix of jurisdictions. And the acquisition pace itself was the tell: three large deals in 2016 and 2017 alone, each resetting the base against which growth was measured.

By the benchmarking rules, Steinhoff earns the same verdict as Enron. If a diligent reader can't reconstruct a group's accounts, don't admire the puzzle. Size the position at zero.

Tests that fire. Revenue that isn't, for income booked with parties presented as independent. AA3's serial-acquisition screen and the missing organic split (section 4.15 of the cash-flow lessons). Goodwill and intangibles as a share of total assets. CFO ÷ net income and CFO ÷ EBITDA conversion, and effective-tax-rate benchmarking against the jurisdiction mix. Related-party identification, in the case where the disclosed related-party list is the wrong list.

Three meta-signals sit above all of those. A live criminal investigation into the accounts, disclosed and then ignored by the market. A chief executive with unusual personal control over the group's deal-making. And audit opinions issued year after year on a structure that the auditor's own successors could not unwind quickly.

Aftermath and lesson. The company avoided immediate insolvency through a lender standstill and a debt restructuring, then sold or listed most of the assets. South Africa's Financial Sector Conduct Authority fined it in 2022. Criminal proceedings followed in Germany and South Africa against former executives, claims from shareholders and former counterparties were settled for amounts in the low billions of euros, and the group was wound down with its listing terminated in 2023.

The former chief executive was charged in Germany in 2023. Proceedings and their outcomes should be verified against the courts' own records, which continue to move. Lesson: a serial acquirer that will not give you an organic growth rate is asking you to take its most important number on trust, and a public criminal investigation into a company's accounts outranks every ratio you can compute. Both signals were free, and both were available for two years.

Pause and consolidate before the India files. Eight cases in, and the plays already repeat. Fake revenue needs a fake asset. Look at Enron's SPE-hedged assets, Wirecard's escrow, Luckin's vouchers. Costs park in capex (WorldCom) or in someone else's quarter (Toshiba and Tesco). Valeant owned its channel. Toshiba stuffed its parts carousel. And the meta-signals travel across every border: how the auditor behaves, how the regulator behaves, how leveraged the insiders are.

Now watch the same plays in Indian dress, where the disclosure arsenal is richer and the promoter ecosystem gives the money somewhere particular to go.

4.3 The India files: case files I1–I13

Satyam first, India's Enron moment and the origin of much of today's disclosure arsenal. Then the extraordinary 2018–2020 cluster, when one wholesale-funding freeze stress-tested every promoter balance sheet at once.

I1 · Satyam (2009): the cash that wasn't, confessed

The business and the story told. India's fourth-largest IT services exporter, with 50,000+ employees, marquee clients, NYSE-listed ADRs and governance awards on the shelf. B. Ramalinga Raju founded and ran it. His family held a small and heavily pledged stake, ~8% by late 2008.

The mechanics. This is the one case where the perpetrator wrote the mechanics down. Raju's confession letter of 7 January 2009 was corroborated by the CBI investigation and by the 2015 convictions. Investigators found ~7,561 fake invoices generated through a doctored invoice-management system, along with forged bank confirmations and fixed-deposit receipts. The letter listed:

• inflated (non-existent) cash and bank balances of ₹5,040 crore, against ₹5,361 crore reported
• accrued interest of ₹376 crore that did not exist
• an understated liability of ₹1,230 crore, funds Raju said he had arranged personally
• overstated debtors of ₹490 crore.

Take the September 2008 quarter alone. Satyam reported revenue of ₹2,700 crore and an operating margin of ₹649 crore (24%). Actual revenue was ₹2,112 crore, with a margin of ₹61 crore (3%). The entries are ones you already know: Dr Trade receivables (fictitious) / Cr Revenue (fictitious), settled into Dr Cash (fictitious), garnished with Dr Accrued interest / Cr Interest income on deposits that only existed on paper.

His letter's last line belongs in every analyst's head: "It was like riding a tiger, not knowing how to get off without being eaten."

Visible in advance. (1) The cash-yield test, and this is the model case for it. Interest income implied ~3% yields on enormous "cash and deposits" while one-year deposit rates ran 8–9%. So either the cash wasn't there, or it wasn't the company's, or management had left hundreds of crores on the table for years. You could compute that from any annual report. (2) The idle-cash paradox. Billions sat sterile at a company supposedly minting free cash. There were no buybacks, just token dividends. (3) DSO ran above tier-one peers like Infosys and TCS, while margins ran mysteriously below them on the same labour-arbitrage model. No cross-section would reconcile that.

(4) The Maytas tell, 16 December 2008. The board approved a $1.6bn acquisition of Maytas Properties and Maytas Infra, promoter-family real-estate and construction firms. It was an attempt to turn fictitious cash into real assets through a related-party deal. An institutional revolt reversed it within twelve hours, and the stock cratered. That a board could approve it at all was the governance verdict. (5) Then the meta-signals bunched up in the final weeks. A World Bank ban was disclosed on 23 December. Independent directors resigned. Margin calls unwound the promoter pledge.

Tests that fire. Cash-yield test. DSO and margin cross-section. The related-party lens on Maytas, which section 4.4b of the earnings-games taxonomy uses as its worked case. Pledge screen. Board and audit-committee conduct. And the auditor question. PW's Satyam audits accepted cash confirmations that management supplied. Two partners were arrested and later convicted with the promoters. PW network firms paid a $6m SEC penalty (2011) and faced SEBI proceedings. The ban was largely set aside on appeal, and that litigation shows you how far gatekeeper accountability really reaches.

Aftermath and lesson. The government superseded the board within 48 hours, the first time it had ever done so. A supervised auction delivered the company to Tech Mahindra (April 2009) and saved the operating business. Like Luckin, the business was real; the accounts were not. A CBI special court convicted Raju and nine others in 2015, with seven years' RI. Appeals followed. The scandal gave birth to the Companies Act 2013's regimes for audit rotation, independent directors and fraud reporting. Eventually it gave birth to NFRA too.

Lesson: audit the safest-looking line first, and that's cash. A related-party rescue deal is the fraud confessing in the form of a corporate action. And a promoter with a small, pledged stake has the motive (margin calls) and the means (board control) that the fraud triangle requires.

I2 · IL&FS (2018): 347 entities, AAA to D in six weeks

The business and the story told. Infrastructure Leasing & Financial Services was an unlisted infrastructure-financing conglomerate. It spanned roads, tunnels, funds and an NBFC lending arm, IFIN. It had institutional parents (LIC ~25%, ORIX ~23%, with SBI and HDFC among the shareholders), AAA ratings and a technocrat halo. The story was India's infrastructure builder-financier, too pedigreed to question. Underneath sat roughly 347 group entities, stacked three and four layers deep, carrying about ₹94,000–99,000 crore of debt by the new board's tally.

The mechanics. The sources are the disclosures of the new, government-appointed board, SFIO chargesheets (allegations, with prosecutions ongoing), RBI inspection findings and NFRA audit-quality orders. The group borrowed short at the holding and financing entities and lent long into project SPVs. Its short money was commercial paper and short NCDs. The SPVs' receivables kept slipping as costs overran and government annuities were disputed. IFIN lent heavily to group entities, and investigators allege it got round exposure norms by layering. It refinanced stressed group loans in evergreening patterns. Dividends and fees streamed up to the holdco to keep the AAA story fed. RBI inspections had privately flagged IFIN's negative net owned funds and capital breaches years earlier (reported). Auditors signed anyway. NFRA later penalised and debarred partners of the IFIN auditors, in orders of 2023–24.

Visible in advance. Less than in the listed cases, and that's why it's here. IL&FS itself, the holdco, was unlisted. What disclosure there was lived in subsidiary filings, NCD offer documents, MCA filings, and rating rationales. A determined reader could still compute plenty. Listed ITNL's leverage was ratcheting toward ~3× debt/equity, interest cover was sliding below 1.5×, and receivables from group and government counterparties were swelling. The group's consolidated MCA accounts showed leverage near 10×+ with operating cash flow negative by design. The gap between standalone and consolidated debt kept widening, which means dark debt in unlisted SPVs (see practice problem P12).

And then the master flag, complexity itself. Spread across 347 entities, problems have plenty of places to live. The ALM profile, CP funding twenty-year road assets, sat in the fixed-income documents all along. In NBFC-panel terms, this is the classic negative-gap failure.

Ratings went from AAA (early August 2018) to default (September). ICRA, CARE and India Ratings compressed the entire alphabet into six weeks after group entities began missing inter-corporate deposits and CP repayments in August–September.

Tests that fire. The NBFC and ALM panel: negative gaps in the short buckets, reliance on CP, gearing. The signatures of group exposure and evergreening, meaning interest accrued but not received, and loans to related parties in CARO and the RPT note. Reconciling standalone against consolidated. A meta-flag for complexity and opacity. And the dynamics of a rating cliff. A AAA that needs rollover measures confidence, and that's all it measures.

Aftermath and lesson. The defaults froze India's commercial-paper market. That was the "IL&FS moment". Every NBFC got repriced, and DHFL blew up a year later. The government superseded the board in October 2018, with Uday Kotak as chair, the first supersession since Satyam. Founder-chairman Ravi Parthasarathy and senior executives were arrested in 2019. Trials are ongoing, so treat these as allegations except where adjudicated. Resolution has ground on for years. The new board targeted resolving roughly ₹61,000 crore of the ~₹99,000 crore (~62%; as of mid-2026, check progress). RBI rebuilt NBFC regulation around the corpse. Liquidity-coverage rules and scale-based regulation came out of it.

Lesson: your exposure to an unlisted horror usually arrives through what you do hold: the debt funds, the banks, the listed subsidiaries. When disclosure is thin, complexity is the risk metric. And a rating is an opinion with a refinancing assumption inside it, so read the ALM ladder yourself.

I3 · Yes Bank (2015–2020): the divergence disclosures that graded management's homework

The business and the story told. India's fastest-growing large private bank, co-founded and run by Rana Kapoor. It was a corporate-lending machine reporting sector-best growth with near-zero bad loans, the "zero-NPA" swagger. And it was lending to India's most stressed borrower groups. You know the names by now: IL&FS, DHFL, Essel/Zee, Cox & Kings, CG Power, ADAG, Jet Airways.

The mechanics. The core distortion was under-provisioning, the failure-to-impair branch of cost parked in banking dress. The bank kept stressed loans classified as standard and accrued interest on them. Its reported GNPA was a fraction of reality. We know because the RBI's asset-quality reviews forced the bank to print the gap.

Those are the divergence disclosures. For FY2016, RBI-assessed gross NPAs exceeded the reported figure by ₹4,177 crore. For FY2017, the bank reported GNPA of ₹2,019 crore against RBI's assessment of ₹8,374 crore. That's a ₹6,355 crore divergence, so reported profits stood on provisions never taken. A further ₹3,277 crore divergence surfaced for FY2019.

The ED and CBI go further than the adjudicated under-reporting. They allege a quid pro quo. Yes Bank invested ₹3,700 crore in DHFL debentures, and entities linked to Kapoor's family allegedly received a ₹600 crore facility from DHFL. Charges have been filed. Kapoor spent over four years in custody before bail in 2024. Trials are ongoing and these remain allegations (as of mid-2026).

Visible in advance. (1) The divergence disclosures themselves: public, quantified and repeated. The regulator was telling you, in a mandated table, that management's numbers had failed its audit. One divergence is a dispute. Two is a pattern. Yes printed three. (2) The growth arithmetic. The loan book compounded at ~30%+, from roughly ₹55,000 crore in FY14 to ~₹2.4 lakh crore in FY19, while system credit grew ~10%. In lending, growing 3× the system means winning the borrowers everyone else declined. In banking, market-share gains are a risk signal until the loans season. (3) A 2015 UBS analysis flagged exposures to stressed groups near 2× net worth, against reported GNPA under 1%. It was published, and the bank contested it.

Notice how consistently the loudest denials came before the largest write-offs.

(4) The regulator voted with its feet. RBI refused Kapoor a full new term in September 2018, with exit by January 2019. When a supervisor with inspection access fires the CEO, that's public information. Markets priced it as gossip. (5) The promoter's behaviour. In September 2018 Kapoor tweeted "diamonds are forever", promising never to sell. His holding companies' pledged positions were unwound to near zero within fourteen months. (6) The balance sheet's texture. Its CD ratio was stretched and it relied on bulk deposits. An AT1 stack (₹8,415 crore) fed the growth.

Tests that fire. The banks panel, starting with the divergence disclosure, the strongest single flag for an Indian bank. Then the cross-check of GNPA against the growth rate. Provision-coverage trend. CD ratio and funding mix. Cost parked for lenders, which means interest accruing on loans that should have been impaired. And the governance meta-signals: the regulator cutting the CEO's term, the promoter's pledge behaviour, churn among executives.

Aftermath and lesson. Deposits fled through 2019. On 5 March 2020 RBI imposed a moratorium, capping withdrawals at ₹50,000, and then reconstructed the bank. An SBI-led consortium recapitalised it, with SBI taking a 49% initial stake. Equity holders were massively diluted, and ₹8,415 crore of AT1 bonds were written to zero. Litigation over that write-off ran for years. The Bombay HC set it aside in January 2023, and the Supreme Court stayed that ruling (pending as of mid-2026). Yes Bank survived, rebuilt, and attracted a major foreign strategic investment (announced 2025).

Lesson: when the referee publishes the score, believe the referee. Divergence tables outrank investor-day slides. Lending growth is a choice of risk that you can only check in hindsight, so price in the time it takes loans to season. And read AT1 and hybrid documents before you reach for yield.

"Capital" instruments are built to absorb the very loss you're hoping won't happen.

I4 · DHFL (2019): Bandra Books: a quarter-million borrowers who didn't exist

The business and the story told. Dewan Housing Finance was the Wadhawan family's AAA-rated housing financier. Its ~₹1 lakh crore balance sheet was built, so the story went, on granular retail home loans to underserved India. The safest asset class in the country, levered up.

The mechanics. The sources are the administrator's disclosures, the findings that transaction auditor Grant Thornton submitted to NCLT, and the banks' fraud classifications. Criminal trials are ongoing, so anything about individuals is allegation. The famous "Bandra Books" was a fictitious ledger run as a virtual branch. It held roughly 2.6 lakh (260,000) fictitious retail loan accounts of about ₹14,000 crore, and it generated fictitious interest income. The entries were Dr Loans and advances / Cr Bank, with the cash routed onward to connected entities according to investigators, and Dr Interest accrued / Cr Interest income on the phantom book. GT's reports flagged fraudulent transactions well beyond ₹17,000 crore in aggregate. Large "retail" disbursements allegedly flowed to developers and entities connected to the promoters. The Cobrapost exposé of January 2019 alleged ~₹31,000 crore routed through shells. Treat that as journalism, though investigations later substantially tracked it. On the funding side, DHFL borrowed heavily at short tenors against long assets. It was the IL&FS failure, one year later.

Visible in advance. (1) On 21 September 2018 a debt mutual fund sold DHFL commercial paper at a distressed yield, and DHFL equity fell 42% in one session. That was the bond market publicly repricing rollover risk eight months before default. So watch the paper before you watch the equity. (2) The book didn't match the story. Disclosed developer and wholesale lending was large and growing, while the narrative said "granular retail". When segment notes and investor presentations disagree, the numbers have failed to reconcile. (3) The ALM and funding mix. Reliance on CP and short NCDs showed in every disclosure once IL&FS made everyone look. (4) The promoter's texture. There was the pledge and there were the group entities. After January 2019 there was also a public set of allegations from Cobrapost. Management answered them with a press conference and never gave a point-by-point rebuttal.

(5) Then the gatekeepers left. Deloitte resigned as joint statutory auditor in August 2019 amid disagreements. Ratings collapsed from AAA territory to D between February and June 2019 as payments were missed.

Tests that fire. The full NBFC panel: negative ALM gaps, CP reliance, gearing, unseasoned growth. Revenue that isn’t, in the form of fictitious interest income. Its test is the lending-book cousin of the cash-yield test: yield on advances against the stated product mix. Tracing related parties and ultimate beneficiaries. Rule 11(e) and the CARO fund-routing clauses exist because of this case and IL&FS. Pledge screen. Auditor-resignation meta-flag. And the signal you get when bonds and equity diverge.

Aftermath and lesson. DHFL was the first financial-services company RBI pushed into IBC, in November 2019. Admitted claims came to ~₹87,000 crore. Fixed-deposit holders and retail NCD investors took deep haircuts. Piramal acquired the shell through the process (2021), at an aggregate recovery for creditors of around 40–45% (approximate). The Wadhawan brothers were arrested across multiple proceedings, including a CBI case where a bank consortium put the exposure at ₹34,000+ crore. Trials are ongoing, so guilt remains alleged.

Lesson: you can test a claim of granularity. Look at loan counts and ticket sizes. Look at branch economics. Compare the yield on the book with the product mix. When the credit market reprices a lender's paper, the equity story is already dead and doesn't know it yet. And "retail housing finance" describes the collateral.

It tells you nothing about the governance.

I5 · Manpasand Beverages (2018–19): the revenue nobody could see

The business and the story told. A Vadodara fruit-juice company, maker of Mango Sip, that IPO'd in 2015. It reported revenue roughly tripling in four years, from ₹557 crore (FY16) toward ~₹960 crore (FY18). The story was a rural-distribution David outgrowing Parle Agro and Dabur. An IPO (~₹400 crore) and a QIP (~₹500 crore) paid for it.

The mechanics. No securities forum ever fully adjudicated this one, so watch your language. GST authorities arrested the MD and CFO in May 2019 over alleged fake invoicing through a web of paper companies that claimed input-tax credit. That's the tax shadow of bogus revenue. These are allegations, and proceedings followed. Here's what is fact. Deloitte resigned as auditor in May 2018, days before the board was due to approve results, citing non-receipt of information. Its stock collapsed. Later came insolvency proceedings. The alleged scheme maps to revenue that isn’t, through fictitious or circular sales to connected shells. Cost parked came as a chaser: relentless capex programmes whose asset turns never arrived.

Visible in advance. This is the neatest example of "revenue you can't see" in the course. 2Point2 Capital argued it publicly in a 2016 analysis, while the stock was still loved. Advertising spend ran at ~1–2% of revenue, against 8–15% for any beverage brand really fighting for shelf space. You couldn't find the distribution. Revenue per distributor was a multiple of established rivals', and the top "distributors" were tiny or untraceable entities. Inputs didn't match output: fruit-pulp purchases and power costs didn't scale with the claimed volumes.

Then the plants: capex ≫ D&A, cycle after cycle. Plant costs per unit were far above peers' and asset turns kept falling. And the promoter drew a token salary while equity raises kept arriving. Raising money despite all that "cash" is the Wirecard and Satyam paradox in miniature.

Tests that fire. The physical-verification battery for revenue that isn’t. Set the claimed output against ads, distribution, inputs. It's counting cups, Gujarat edition. Cost parked, through capex ÷ D&A and the asset-turnover trend, plus a hard look at CWIP. The Beneish M-Score, where SGI, AQI, DSRI all run hot (see worked example WE4). The auditor-resignation meta-flag, the single strongest signal in India. And the pace of equity raises against the cash the company claimed to generate.

Aftermath and lesson. From a ~₹3,000+ crore market cap to effectively zero for public holders: trading suspensions, insolvency.

Lesson: a consumer brand leaves physical evidence: shelves, ads, trucks, pulp, power bills. When the P&L claims a war the real world shows no signs of, the P&L is the fiction. And when an auditor walks out the week of results, don't average down. That's the fire alarm, and the one outsider who saw the books just pulled it.

I6 · Vakrangee (2018): the franchise empire priced at ₹53,000 crore, audited by nobody's eyes

The business and the story told. A "last-mile retail" network of Vakrangee Kendras, delivering banking, ATM, e-governance and e-commerce services across rural India. Its stock compounded ~100× into January 2018. At the peak the market capitalisation was around ₹50,000+ crore, and the company was in the MSCI index.

The mechanics. The adjudication was narrow, so mind your language. SEBI proceedings found disclosure misrepresentation, with bullion and jewellery trading revenue presented within technology/e-governance segment lines, and levied penalties (orders 2021–22; check details). The reported financials showed a large slab of revenue from bullion and jewellery trading, plus opaque system-integration work, through a few concentrated counterparties. Gross margins were razor-thin. The Kendra network itself had almost no unit economics you could verify. Cash conversion was chronically poor. Separately, the January 2018 crash followed reports questioning governance, including Vakrangee's unexplained purchases of PC Jeweller shares. Price-manipulation questions were investigated. Treat them as allegations except where SEBI's orders reached a conclusion.

Visible in advance. (1) The segment made no sense. Why does a rural-tech franchise trade gold? A commodity flow at near-zero margin inside a "technology" segment sets off the gross-up and round-trip alarm (revenue that isn’t, section 4.4d of the earnings-games taxonomy). Here it wore an index-stock costume. (2) CFO ÷ EBITDA stayed weak. Profits never became distributable cash at scale. (3) Nobody could inspect the unit economics. There were thousands of claimed Kendras and no per-outlet disclosure an analyst could tie to revenue. It's the Manpasand test at 100× the market cap. (4) The trading revenue came from a few concentrated counterparties. (5) Then the gatekeeper left. Price Waterhouse resigned (April 2018), saying it couldn't get information on the bullion and jewellery revenue or the franchise revenue.

The auditor was telling you which lines it couldn't verify.

Tests that fire. The segment test for a gross margin ≈ 0, the gross-up inside revenue that isn’t. CFO/EBITDA conversion. Revenue-you-can-see battery. Customer and vendor concentration. Auditor-resignation meta-flag. And the "what would have to be true" sizing test. At the peak price, each Kendra had to be worth more than a bank branch.

Aftermath and lesson. The stock fell over 95% across 2018, and the index dropped it. Vakrangee survives at a small fraction of its former scale. Call it the slow-fade archetype. There's no bankruptcy and no confession, just a repricing to whatever could be verified.

Lesson: a 100-bagger chart proves nothing. It's the reason people ignored the flags. When the auditor names the revenue lines it can't verify, those lines are your entire thesis risk. And if a segment has no business logic ("why gold?"), presume it exists to serve some other purpose until someone proves it's a real operation.

I7 · PC Jeweller (2018): the discipline case: flags without a verdict

The business and the story told. A Delhi-based jewellery retailer, listed in 2012. It had domestic showrooms plus a large export book, roughly a third of revenue, sold "wholesale" to Gulf buyers. It was growing fast, with headline margins better than its peers'.

The mechanics: deliberately, none asserted. No accounting-fraud adjudication exists against PC Jeweller to this day. A SEBI insider-trading proceeding that touched promoter-family trades around the buyback produced penalties (check the particulars). The bank accounts were later classified NPA, and a settlement with lenders followed. This case file is here to train the other skill. You manage exposure on flags alone, with no verdict. And you don't defame anyone.

Visible in advance (the flag cluster of January–July 2018). (1) The receivables didn't fit the business model. Jewellery went out on ~180-day unsecured credit to opaque Gulf wholesale buyers. Gold is near-money, so if you give half a year's credit on it, ask what is the receivable really? Export receivables were large and slow, while the domestic business collected at retail speed. Compare Titan, and the cross-section screams. (2) The Vakrangee association. Vakrangee's odd block purchase of PCJ shares (January 2018) put both tickers in the same governance question. (3) The promoters gifted shares to relatives. It was disclosed, and the timing was bad.

(4) The buyback that failed the cash test, July 2018. A ₹424 crore buyback announced in May was withdrawn because the working-capital bankers refused consent. The company presented itself as comfortably liquid, yet it couldn't get its own lenders to agree it had ₹424 crore to spare. That's the borrowing-despite-cash test turned inside out. The banks could see the drawing-power data, and they voted no. The stock fell more than 85% during 2018.

Tests that fire. DSO against the business model. The quality of export receivables, and how opaque the counterparties are. Signals from the consortium and drawing power, through the covenant lens of section 4.1 of the earnings-games taxonomy: how the lenders behave is disclosure. Screens on the pledge and on insider actions. And the meta-flag of contagion by association. Now note which tests don't fire. No divergence. No auditor exit. No adjudicated restatement. So the right move in 2018 was exposure control and demanded answers.

A fraud verdict was never on the table.

Aftermath and lesson. Years of debt restructuring followed, then an eventual one-time settlement with lenders (2023–24). And then a coda that should keep you humble: the stock recovered sharply afterwards (check the current state). If you'd screamed "fraud" in 2018, no tribunal would ever have backed you. If you'd exited or refused to enter on the receivable cluster, you'd have protected capital either way.

Lesson: the severity ladder exists because most flag clusters resolve without a courtroom. Write "I cannot get comfortable with export receivables at 6× the domestic collection cycle". That sentence needs no judge to be right. Then let position size express your conviction, and keep the adjectives out of it.

I8 · Cox & Kings (2019): a 260-year-old company that defaulted with ₹1,800 crore of "cash"

The business and the story told. One of the world's oldest travel brands (founded 1758), run by the Kerkar family. It ran global tours and sold forex and visa services. It looked like an asset-light services compounder. Its accounts showed ample cash and bank balances alongside its borrowings.

The mechanics. The sources are SEBI orders (2022–24), forensic audits commissioned by lenders (as reported and as reflected in SEBI's findings), and ED chargesheets. Criminal matters are ongoing, so anything about individuals is allegation. They describe fabricated sales and receivables concentrated in a handful of customers. They describe fabricated financial statements, and diversion of funds to promoter-linked entities. Names like Ezeego and Redkite recur in the orders. There's also alleged forgery of board minutes and bank statements. The defining public fact is this. In June 2019 the company defaulted on commercial paper of roughly ₹150 crore while its March 2019 accounts showed cash and equivalents above ₹1,800 crore. Either the cash wasn't there, or it couldn't be reached, or it wasn't the company's. You met that trilemma at Satyam and Wirecard, and it resolved the same way here.

Visible in advance. (1) DSO against the business model, and this is the killer flag. Tour operators collect in advance. Customers pay before they travel. C&K carried receivables of four-to-five months of revenue (see practice problem P4). If a travel company's customers apparently pay 150 days after the holiday, it's describing a lending book. Or it's describing nothing at all. (2) The cash-yield test: interest income implied ~2% on the reported pile. (3) Borrowing despite cash. ₹3,000+ crore of debt was rolled at high cost alongside the "idle" ₹1,800 crore. (4) The promoter pledge was high and rising. (5) Group complexity, and explanations about subsidiary cash being "in transit". You could compute every one of these from the FY2018 annual report.

Tests that fire. DSO against the model, benchmarked against Thomas Cook India. Cash-yield test. Borrowing despite cash. Revenue that isn’t, in the fictitious receivables SEBI later found. Tracing related parties and beneficiaries through the Rule 11(e) lens. Pledge screen. And the rating cliff: investment-grade CP fell to D within days in June 2019.

Aftermath and lesson. NCLT admitted the company in October 2019. ED arrests followed in 2020, and trials are ongoing. SEBI orders imposed bans and penalties on promoters and executives for fabricated financials (2022–24, check the specifics). Creditors recovered a fraction.

Lesson: every business model implies a working-capital sign. When the sign is wrong, with receivables where advances should live, the accounts contradict the physics of the business, and physics doesn't restate. Match the balance sheet to how money actually moves in the trade. What the P&L claims comes second.

I9 · CG Power (2019): the looted balance sheet, and the redemption arc

The business and the story told. CG Power & Industrial Solutions, once Crompton Greaves, was a storied franchise in transformers, motors and switchgear inside Gautam Thapar's leveraged Avantha Group. It was a real industrial company. Its factories were real. So were the customers and the order books.

The mechanics. Two sources matter here. The company made its own disclosure in August 2019, after a board-commissioned investigation. SEBI's order followed in September 2019, finding an "elaborate scheme" and restraining Thapar and others, with proceedings ongoing since. Together they identified:

• liabilities understated by roughly ₹1,054 crore (as at March 2018) and ₹1,608 crore (as at April 2017)
• advances of roughly ₹1,990 crore and ₹2,807 crore to related and connected parties
• company assets pledged as collateral for group borrowings without board authority.

In terms of entries, the company incurred obligations through guarantees drawn and borrowings routed. It never credited them to liabilities. And it pushed cash out to the ecosystem as "advances". That's the promoter-leak play from section 4.9 of the earnings-games taxonomy, run on a company whose operations were genuine.

Visible in advance. (1) Promoter pledge at ~100%. Essentially the whole promoter stake was pledged. It's the most mechanical screen in India, and it's printed every quarter in the shareholding pattern. (2) Contagion from the group. Avantha's leverage and asset sales had been public for years. Put a stressed promoter next to a cash-generative listed company and you have motive sitting beside opportunity. (3) The texture of receivables and advances, and working capital rising with no operational reason. (4) Friction with gatekeepers in real time: delayed results, auditor escalations and qualifications through 2019, directors leaving. (5) Links to Yes Bank exposure, which put it inside the stressed-credit web of 2018–19.

Tests that fire. Pledge screen. Related-party advances: loans and advances creeping up against revenue, the residue of revenue that isn’t. Liability completeness, the hardest test of all. Liabilities hide better than assets lie, so triangulate: interest cost against reported debt, the guarantee schedules, the CARO clauses on use of funds. A screen for contagion from a stressed group. And the meta-flag of auditor behaviour.

Aftermath and lesson. Thapar was removed. SEBI restrained him and others in 2019, and the ED arrested him in a linked matter in 2021 (trials ongoing, allegations). Then comes the part of the story you need most. The Murugappa Group's Tube Investments acquired control in 2020. It recapitalised the company and cleaned it up. The stock became one of India's great turnarounds, rising dozens-fold from the lows.

Lesson: tell fake-business frauds apart from real-business, looted-balance-sheet frauds. Satyam's invoices and Manpasand's distributors are the first kind. CG, and in part Zee, are the second. A change of control can rescue the second kind, because the operating asset is genuine. But be straight about the order of events: you could not know in August 2019 which kind it was. The pledge screen's job was to keep your position small or out before the disclosure. The turnaround only became a bet once the loot was quantified and the looters had gone.

I10 · Zee Entertainment (2019–2023): the ₹200 crore FD and the ecosystem's last ATM

The business and the story told. Zee was India's leading listed broadcaster, with real channels, real viewers and real advertising revenue. Subhash Chandra's Essel Group controlled it, and Essel's unlisted infrastructure bets in roads and power had soaked up debt through the 2010s. The listed company told a story about content and OTT. The group's reality was a promoter balance sheet that needed cash.

The mechanics. The anchor episode comes from SEBI's interim and confirmatory orders of 2023. Their findings are at the interim, prima-facie stage. Appellate and settlement proceedings followed (status as of mid-2026). In September 2019 Yes Bank appropriated a ₹200 crore fixed deposit of Zee/its subsidiary against loans of promoter-linked entities. The listed company's asset had quietly been serving as the family's collateral. Later the money was shown as "repaid". SEBI's orders traced those repayments through layered chains of entities over a matter of days. They concluded, prima facie, that funds from the group's own web had been round-tripped to look like a promoter repayment, and per the orders some of that money came from Zee itself.

Around that episode sat years of other signs. Related-party receivables swelled and were then provisioned. They were owed by Siti, Dish TV, associated entities. Content advances absorbed cash. CFO lagged EBITDA year after year while content inventory and advances grew. That's the capitalise-the-content dynamic, a close relative of cost parked, plus the ecosystem leak.

Visible in advance. (1) The pledge, a public countdown clock. The promoters held ~42%, and the overwhelming majority of it was pledged. On 25 January 2019 the stock fell 26% in one day on fears the pledges would be invoked, after adverse press (allegations). Next, the promoters negotiated a public standstill with lenders. That was an extraordinary disclosure in itself: mutual funds agreeing not to sell their collateral. Stake sales followed, taking promoter holding toward ~5% by 2020. Every step was printed quarterly in the shareholding pattern and in stock-exchange disclosures.

(2) Related-party receivables grew faster than the revenue they supposedly came from, and were then provisioned in lumps. FY20's exceptional provisions ran to four figures in crore, so read the exceptional-items note against the RPT note. (3) CFO ÷ EBITDA stayed weak for a broadcaster that claimed pricing power. (4) The auditors used emphasis-of-matter language, and the FD turned up in audit reports. Those were gatekeepers whispering. (5) Independent directors left in late 2019.

Tests that fire. The pledge screen and the mechanics of invocation. Section 4.9 of the earnings-games taxonomy uses Zee as its canonical case. The test of receivables as loans: a receivable from an associate that never collects is a loan wearing revenue's clothes. CFO/EBITDA conversion. Scrutiny of capitalised content: capex and amortisation set against the P&L. Reading exceptional items against the RPT note. And the meta-signals from the standstill and the stake sales.

Aftermath and lesson. Zee's promoters lost most of their equity. The company, a real business like CG, kept operating. An announced merger with Sony collapsed in January 2024, with governance questions prominent among the stated reasons. That's the market putting a direct price on unresolved promoter-governance risk. SEBI proceedings against promoter executives continued through settlements and appeals. Minority holders paid through years of derating.

Lesson: in a leveraged promoter group, the listed company is the lender of last resort whether it consents or not. So screen the whole group as well as the company. Treat the pledge percentage as the length of a fuse. And when receivables, FDs and guarantees keep drifting toward the ecosystem, the leak is the business model.

I11 · Gitanjali Gems (2018): circular trading, and credit taken in a bank's name

The business and the story told. One of India's largest listed jewellery groups, with a national retail brand portfolio and a large diamond and gold wholesale business, run by a promoter family. The story: a branded jewellery retailer scaling nationally on the back of a wholesale trading operation that supplied it.

The mechanics. In February 2018 Punjab National Bank disclosed to the exchanges that unauthorised letters of undertaking, a bank guarantee used to raise short-term foreign-currency credit from overseas branches of Indian banks, had been issued from a single Mumbai branch without being recorded in the bank's core system. The exposure was first put near ₹11,400 crore and later revised upward toward ₹14,000 crore. Two related promoter groups were named, one of them the Gitanjali promoter. The Central Bureau of Investigation and the Enforcement Directorate filed charge sheets alleging that group entities used the facilities to fund a rotating chain of transactions, and the Serious Fraud Investigation Office examined the group's trading pattern. The allegation central to the accounts is circular trading. Gold and diamond sales rotated among a ring of related and controlled entities, so revenue was recorded repeatedly on the same underlying stock. Each rotation added turnover and almost no margin, and the ring's trade receivables and payables cancelled economically while inflating both balance sheets.

No adjudication had established the company's own accounting fraud as a matter of final judicial record at the time of writing. The promoter was declared a fugitive economic offender under the 2018 Act in 2021 and extradition proceedings continued. Write it as alleged, and cite the order.

Visible in advance. The gross-up screen fires first, just as it did at Enron. The wholesale business reported enormous revenue at gross margins in the low single digits. So the turnover measured the rotation, and told you little about the business. Revenue per store and revenue per employee were multiples of every listed peer's, an impossibility test that needs no forensic skill. Working capital consumed everything the company earned. Receivables and inventory together ran to a large majority of revenue. Cumulative CFO over a decade was deeply negative against a decade of reported profits, and the cumulative conversion test returns a verdict on that by itself. The funding structure was the loudest signal of all. The borrowings note showed a company financing itself almost entirely on short-dated buyer's credit and letters of credit, rolled continuously. A company like that is one refusal away from stopping. Related-party sales were disclosed and were large. Promoter pledge was high. Exchanges had also flagged the stock under surveillance measures.

Tests that fire. The gross-up and margin screen on trading revenue, for revenue that isn't. Cumulative CFO against cumulative PAT. DSO and DIO against a peer set of listed jewellers. Related-party revenue as a share of total revenue.

Then the funding tests, and this case was decided there. Read the borrowings note for short-tenor trade credit and off-balance-sheet guarantees. Read the contingent-liability disclosure. Run the pledge screen. And watch for the meta-signal of an auditor resigning, or qualifications appearing anywhere in the group.

Aftermath and lesson. The company's operations collapsed within months of the disclosure, the shares were suspended and later delisted, and the banking system carried the loss. The episode drove the Reserve Bank of India to discontinue letters of undertaking and letters of comfort for trade credit in March 2018, and to require banks to integrate their SWIFT messaging with core banking systems. Both are dated public circulars, worth reading as an example of a control failure producing a rule. Lesson: when revenue is enormous and margin is tiny, measure the business by its cash and its capital, never by its turnover, and read the borrowings note before the profit and loss account. A company whose entire model depends on one renewable bank facility has handed a third party the decision about whether it continues to exist.

I12 · Ricoh India (2016): the auditor who would not sign, and the parent who paid

The business and the story told. The Indian listed subsidiary of a Japanese office-equipment manufacturer, majority-owned by the parent, which had pivoted from copiers into low-margin information-technology product distribution and services. The story: a global brand's Indian arm growing fast in a large market, with a parent standing behind it.

The mechanics. What makes this case worth a page is the sequence of events. The entries are ordinary. The company repeatedly delayed its quarterly results through 2015 and 2016. Its statutory auditor declined to complete the review, and the board commissioned an independent forensic examination. In 2016 the company disclosed accounting irregularities and restated its results: figures previously reported as profitable became a loss of roughly ₹1,100 crore for the year to March 2016, a swing larger than the company's market capitalisation had been. The mechanisms disclosed in the restatement and in the subsequent regulatory record were the familiar distribution-business set: revenue recognised on transactions that were not complete sales, understated liabilities and expenses, and circular arrangements with channel partners. The Securities and Exchange Board of India passed orders in 2018 against certain former officers and connected persons. In the same period the company was admitted to insolvency proceedings before the National Company Law Tribunal. Check the figures and dates here against the company's own restated accounts and SEBI's published orders before you use them in a memo, because the restatement came out in stages.

Visible in advance. The strongest signal cost nothing to observe and needed no accounting at all. A listed company that cannot file its results on time is telling you that its own auditor cannot agree with its numbers. Under the SEBI listing regulations quarterly results carry a hard deadline and a limited review. A delay, an extension request, or a review that is not completed is a public event on the exchange website, and Ricoh India delayed repeatedly before anything else surfaced.

Behind that sat the ordinary distribution-business tells. Revenue grew far faster than the industry in a business with structurally thin margins. Receivables and inventory built against that revenue, cash conversion was poor, and the company relied heavily on channel financing. The parent's letters of support were themselves informative, because a subsidiary that has to disclose parental support is a subsidiary that cannot fund itself.

Tests that fire. The screen for filing timeliness and auditor behaviour, the gatekeeper layer in section 4.4 below. Revenue growth against sector growth, with a margin check. DSO and DIO trends, and CFO ÷ PAT. Related-party and channel-partner disclosure. And two readings of the notes: the auditor's report for scope limitations, and the going-concern and parental-support language.

Aftermath and lesson. The minority shareholders were largely wiped out. The parent absorbed the write-down and exited. Former officers faced regulatory proceedings.

Lesson: a strong parent is no substitute for accounting controls, and a famous brand won't audit anything. Here the gatekeeper signals arrived before any ratio moved: a delayed filing, and an auditor who wouldn't sign. They outranked every ratio. Section 4.4 asks you to make that hierarchy your own.

I13 · Gensol Engineering (2025): the promoter loan, the forged letters, and the pledge

The business and the story told. A listed Indian engineering, procurement and construction company in solar projects that had added an electric-vehicle leasing arm, supplying vehicles to a ride-hailing venture founded by the same promoters. The story: a clean-energy compounder with a fast-growing order book and an adjacent mobility business.

The mechanics. On 15 April 2025 the Securities and Exchange Board of India passed an interim order restraining the promoters from the securities market and from holding directorships, and ordering a forensic audit. The order's findings were prima facie, and that's how you should describe them. Term loans raised from state lending institutions for the stated purpose of buying electric vehicles had, on those findings, been substantially diverted. A large portion of the funds drawn was routed through a related supplier and onward to promoter-linked entities and to personal uses, and the number of vehicles actually purchased fell far short of the number funded.

The order also recorded that documents submitted to credit rating agencies purporting to confirm timely debt servicing appeared to have been fabricated. SEBI additionally halted a proposed stock split. The rating agencies had already downgraded the company's instruments to default grade in March 2025, citing delays in servicing and the submission of falsified conduct letters. These are findings at the interim stage, so verify what has happened since. Write "alleged" until a final order or a court says otherwise.

Visible in advance. Everything the pledge and related-party machinery teaches, and one thing more. Promoter pledge was extreme and rising, disclosed quarterly in the shareholding pattern. Related-party exposure to the affiliated mobility venture was disclosed and material, and the arrangement had the structure that should always draw attention: the listed company raised the debt and bought the assets, and a privately held affiliate operated them. Loans and advances grew faster than the revenue they were supposed to support. Receivables in the engineering business stretched. Capital work in progress and advances to suppliers absorbed cash that the reported profit implied should have been available. And the credit market moved first, in public. A downgrade to default grade is an exchange disclosure, and the rating rationale named the reason. The credit market's opinion of a company outranks the equity market's, and it is published.

Tests that fire. The pledge screen and the group screen from section 4.9 of the earnings-games taxonomy. The related-party test on an operating counterparty affiliated with the promoter. And a use-of-proceeds reconciliation. It sets the funds raised for a stated asset against the assets that actually appear on the balance sheet, and the fixed-asset schedule in the annual report gives you what you need.

Then loans-and-advances growth against revenue, CFO ÷ PAT, and the gatekeeper layer: rating actions, the rationales published with them, and any auditor or independent-director resignation.

Aftermath and lesson. The share price fell heavily through 2025. Trading restrictions and insolvency-related proceedings followed, and the forensic audit SEBI ordered went ahead alongside the regulatory case. Verify where things stand against SEBI's own orders and the exchanges' disclosures.

Lesson: say a listed company borrows to buy assets that a private company affiliated with the promoter will operate. Then the reconciliation you have to do is the simplest in all these cases. Count the assets. Money raised for a stated purpose either shows up as that asset in the fixed-asset schedule or it doesn't, and the schedule is published every year.

A note on these four files. The pattern layer below was written on the first seventeen cases, before Steinhoff, Gitanjali, Ricoh India and Gensol were added to the set. Read the four as an out-of-sample test of it. Each one lands inside the existing seven plays with nothing left over: Steinhoff on plays 1 and 7, Gitanjali on plays 1 and 7 with the funding mismatch of play 6, Ricoh India on plays 1 and 3, Gensol on plays 6 and 7. The timing hierarchy holds too, and in three of the four the gatekeeper signal (a criminal investigation disclosed, a delayed filing, a rating downgrade) arrived ahead of anything a ratio would have told you.

4.4 The pattern layer: what seventeen cases compress into

The seven plays. Strip out the names and dates, and nearly everything you've just read comes down to seven mechanics. You now own tests for all of them:

Timing and the hierarchy of tells. Look at when things showed up across the seventeen. Quantitative residue, ratios drifting, typically appeared 2–4 years before collapse. Signals in the documents (RPT notes, divergence tables, absurd segments) came 1–3 years before. Gatekeeper behaviour came months to a year before: auditors resigning, regulators acting, lenders refusing. The confession or default came days before.

Rank your tells to match. An auditor's mid-tenure resignation, or a divergence the regulator has published, outranks any ratio. A routine corporate action that fails (PCJ's buyback, a pulled dividend) outranks a presentation. And the credit market's pricing of the company's paper outranks the equity market's pricing of its story. Think of DSP selling DHFL's paper, or the C&K CP cliff.

Ratios are your early-warning radar because they fire earliest. They also throw up the most false positives.

The false-positive ledger. Burn this one in. For every genuine Manpasand there are dozens of honest companies that showed one or two of the same flags. DSO rises because the customer mix shifts to enterprise. Capex runs ≫ D&A during a disclosed capacity build. A promoter pledges shares for benign estate planning. The auditor changes because rotation is mandatory. Since the 2013 Companies Act, scheduled changes are routine, and it's the mid-tenure exits that signal something. Or CFO lags because the company really is in hypergrowth. The M3 exam scores false positives against you, because the working method is clusters, severity, and convergence (section 4.10 of the earnings-games taxonomy).

One flag is a question.

Three aligned flags across independent categories, say a ratio plus a note plus a gatekeeper action, call for a decision about your position.

The position-response ladder. Flags map to actions. Adjectives don't come into it.

• L1–L2 findings: question management and adjust your numbers. Dock the quality score. Note how good the answer is, too. A Tesco-era "we don't disclose that" is data.
• L3: cap the position size, demand a margin of safety wide enough to survive being wrong about intent, and set tripwires, such as next quarter's DSO, whether the auditor stays on, the pledge %.
• L4 evidence cluster: don't own it at any price you'd call attractive. If short-side work is your mandate, describe evidence. Never write verdicts.

Write the tripwires down. Your decision journal turns the cases you almost owned into calibration data.

The gatekeeper scoreboard: the ethics synthesis. Tally the seventeen. Auditors failed through conflict, as with Andersen's consulting fees. They failed through proximity: a decade of unqualified Wirecard opinions with no cash confirmed at source. And they failed through deference, like PW relying on confirmations that Satyam's management supplied. They were sanctioned across four jurisdictions. Andersen was destroyed, ShinNihon fined, EY Germany barred from new mandates, PW hit with an SEC penalty, and IFIN's auditors debarred by NFRA. Auditors also succeeded. Every resignation in the India files was the system working, expensively late, but working.

Boards failed as fiduciaries through waivers, like Enron's exceptions to its ethics code. They failed through capture, like Satyam's board approving Maytas and the promoter-dominated boards right across the India ten. And IL&FS's board had eminence without engagement. Regulators failed too, with BaFin shooting the messengers. But they also supplied the best public data in all these cases: RBI's divergence tables, SEBI's orders, the supersessions.

Your takeaways as a professional: (1) independence comes from structure, so always ask who pays the gatekeeper and what they'd lose by dissenting. (2) In promoter-controlled markets, fiduciary duty is enforced mostly by disclosure plus your arithmetic, so do the arithmetic. (3) Your own standards: a reasonable basis, fair language, no MNPI, verdicts only where adjudicated. They make your work usable by people who have to rely on it, and that's what makes you worth paying.

Common mistakes & how experts think differently

1. Hindsight arrogance: "it was obvious." After seventeen case files, everything looks obvious. That feeling is the most dangerous thing case studies produce. The expert asks the three calibration questions from section 4.1 and keeps a ledger of when each signal became public and what action it justified at that moment. Chanos was right about Enron within a year. The FT was right about Wirecard for five years. In that time the stock quadrupled and BaFin investigated the journalists.

Being early is expensive. So the expert never concludes "I would have seen it". The conclusion is "my process would have kept me small, out, or demanding answers."

2. Narrative pattern-matching instead of mechanical diagnosis. The novice says "this feels like the next Satyam" because the company is an IT firm from Hyderabad. The expert runs ratio → residue → family → severity and lets the mechanics speak. A cash-yield anomaly is a cash-yield anomaly whether the company sells software, coffee, or payment processing.

Surface resemblance gives you false positives. Mechanical evidence gives you findings.

3. Binary thinking: fraud or fine. Most flag clusters resolve without a courtroom, and that's why PC Jeweller is in these files. The novice needs a verdict. The expert needs a position response (question, discount, limit, avoid) and a severity grade (L1–L4) that admits uncertainty. Remember the false-positive ledger. For every Manpasand there are dozens of honest companies with one or two identical flags.

4. Treating the screens as oracles. Beneish and Sloan measure the accrual wedge. Luckin and Wirecard fabricated both legs, so the wedge never appeared and the screens stayed silent. The expert puts verification logic on top of accrual logic. Does the asset backing the profit demonstrably exist? Check the yield on the cash, the receipts on the sidewalk, the confirmations at source. And the expert knows which cases each layer catches.

5. Reading the P&L first and the notes never. Every fraud in these files showed up on the balance sheet and in the notes years before the P&L confessed. Think of Enron's related-party note, Satyam's interest line, Zee's FD disclosure, CG's guarantee schedule. The expert reads in this order: cash-flow statement → balance-sheet deltas → the four notes → then the P&L. The P&L is the story.

Everything else is the evidence.

6. Discounting gatekeeper behaviour as noise. Take a mid-tenure auditor resignation (Manpasand, Vakrangee, DHFL), a published RBI divergence table (Yes Bank), lenders refusing a buyback (PC Jeweller), or a regulator cutting a CEO's term. The novice treats these as headlines to trade around. The expert treats them as the highest-conviction tier of public information, above any ratio. Each comes from someone with inspection access who is putting their franchise on the line.

7. Grading rebuttals on confidence instead of arithmetic. Yes Bank rebutted the UBS note on stressed exposure. Wirecard sued the FT. Manpasand held a press conference. The loudest denials in these files came before the largest write-offs. The expert tests a rebuttal on one dimension only: does it reconcile the number? "We don't disclose that" and "the analyst doesn't understand our model" are data points, and they score against management.

8. Waiting for adjudication to act, or asserting fraud before it. These failures mirror each other. Wait for the SEBI order and you're waiting for the default. Exposure decisions run on evidence, and verdicts come too late to help. But writing "fraud" before a tribunal has found it is a defamation risk and sloppy analysis. The language protocol ("I cannot reconcile X with Y") is safer than the accusation, and more precise too. Experts act early and write carefully.

The novice does the reverse.

9. Conflating the accounts verdict with the business verdict. Luckin's coffee was real. So were Satyam's engineers and CG's factories. A company with fake accounts can house a viable business, and a company with clean accounts can be a terrible one. The expert keeps two separate scorecards. Think of CG after Murugappa, or Satyam after Tech Mahindra. That turnaround trade only exists after the loot is quantified and the looters are gone.

10. Misreading the pledge screen in both directions. One novice treats any promoter pledge as damning, though a pledge can fund a benign estate settlement and sit stable for a decade. Another ignores pledges entirely. The expert reads level + trend + stated purpose + group context. A stable, explained 20% is worth a note. 75% and rising beside a leveraged group with swelling RPT advances is a fuse. Its length is printed quarterly in the shareholding pattern.

11. Diligence theatre: forty ratios, zero notes. Computing a lot doesn't mean you've verified much. The experts in these files won with five numbers and three notes. The numbers: cash yield, DSO against the model, capex/D&A, CFO/EBITDA, and one cross-sectional cost ratio. The notes: related parties, contingencies with guarantees, and the auditor's report.

The forty-ratio spreadsheet is what you build after the five-number pass says dig.

12. Forgetting the base rate. Roughly 2% of listed companies are committing material fraud at any time. That's an order of magnitude, and nobody knows the real figure. Flags are common and frauds are rare, so most flags are innocent. That's why the M3 exam scores your false positives as heavily as your catches. And it's why the expert's default response to a single flag is a question.

Not a thesis.

Worked examples

Four workups, done the way the capstone demands. Every number is shown and every step named. Figures for the real companies are round approximations, labelled illustrative, modelled on the actual filing's scale. Pull the filing and recompute them as your drill. Adjudicated findings are stated as facts with their source, as the language protocol requires.

WE1: Satyam: reading the FY2008 annual report in mid-2008, six months before the confession

You are an analyst in June 2008. Satyam's FY2008 annual report is on your desk. Illustrative numbers, modelled on ~FY08 scale: revenue ₹8,400 crore; PAT ₹1,700 crore; cash, bank balances and deposits ₹4,500 crore (average balance over the year ≈ ₹4,000 crore); interest income ₹120 crore; trade receivables ₹2,220 crore; dividend payout ~15% of PAT; no buyback in issue.

Step 1: the cash-yield test. Implied yield = interest income ÷ average cash = 120 ÷ 4,000 = 3.0%. One-year bank deposit rates in FY08 ran roughly 8–9%. Even at 8.5%, the forgone income is (8.5% − 3.0%) × 4,000 = ₹220 crore. That's about 220 ÷ 1,700 = 13% of reported PAT, quietly missing every year. You can reconcile it three ways. The cash isn't there. Or it's there but encumbered, or not the company's. Or treasury has been incompetent for years at a company otherwise obsessed with margins.

Any of the three is an analytical emergency.

Step 2: the idle-cash paradox. Cash is ~30% of the balance sheet, earning 3%, and the company neither buys back stock nor lifts the dividend above a token payout. If management really held ₹4,500 crore of shareholder money in deposits yielding less than inflation, the board would press it to hand the money back. Nobody presses. Why?

Step 3: the cross-section. DSO = 2,220 ÷ 8,400 × 365 = 96 days, against tier-one peers at around 60–78 days. Those peer figures are illustrative at FY08 scale, so compute the actuals from the Infosys and TCS annual reports. Meanwhile Satyam's operating margin runs below Infosys and TCS on the identical offshore labour-arbitrage model. Slower collection plus lower margins plus enormous idle cash won't fit together into one honest company. Put together, they describe a business less profitable and less liquid than reported, with the gap parked in receivables and "cash."

Step 4: the verdict memo paragraph (language protocol). "Reported cash of ~₹4,500 crore yields ~3% against deposit rates near 8.5%, forgoing ~₹220 crore (~13% of PAT) annually; I cannot reconcile this with the cash being both real and unencumbered. DSO of ~96 days runs 20–35 days above tier-one peers while margins run below them, which is inconsistent with the reported quality of the book. Severity L3 on the ladder: earnings and asset quality cannot be verified from the filing. Action: do not own beyond a token position; demand the deposit break-up, bank-wise, and the auditor's confirmation procedure; tripwires: any related-party acquisition proposal, any pledge increase, the next deposit-note disclosure."

Step 5: what happened. On 16 December 2008 the board approved the $1.6bn Maytas acquisition. It was a related-party deal with the promoter family that would have turned the fictitious cash into real assets, and it set off the tripwire just as written. On 7 January 2009 Raju's letter confessed ₹5,040 crore of non-existent cash, ₹376 crore of non-existent accrued interest, and a September-quarter margin of 3% against the reported 24%. Those are facts. They come from the confession and the CBI findings, and from the 2015 convictions. You could have run the yield test on public filings for years.

WE2: WorldCom: one benchmarked ratio against the FY2000 10-K

You are an analyst in mid-2001, comparing long-distance carriers. Illustrative numbers, modelled on ~2000–01 scale: WorldCom revenue $35bn; reported line costs $14.7bn; capex $10.5bn; D&A $4.9bn; CFO $7.0bn. Peer line-cost ratios (AT&T, Sprint long-distance divisions): 50–52% of revenue, in a market where transport prices are falling 20%+ a year.

Step 1: the cross-sectional cost ratio. WorldCom's line-cost ratio = 14.7 ÷ 35.0 = 42.0%. Peer median ≈ 50%. If WorldCom's true economics matched its peers', line costs would be 50% × 35.0 = $17.5bn. That's a gap of 17.5 − 14.7 = $2.8bn per year. Either WorldCom has network economics that defy physics and that it can't explain, or ~$2.8bn of annual cost is going somewhere other than the expense line. When the fraud was found, it was ~$3.8bn over five quarters.

The ratio had sized it almost exactly.

Step 2: where would it hide? Capex ÷ D&A. 10.5 ÷ 4.9 = 2.1×. That's an enormous investment against how fast the existing assets are being used up, and it's going into an industry drowning in surplus capacity while peers cut capex. High capex/D&A is the residue improper capitalisation leaves behind (cost parked), because the parked expense has to land in PP&E.

Step 3: the scissor test. Build the two-column table:

Capitalisation inflates EBITDA (+$2.8bn) and CFO, because the cash moves into investing. Now look at the bottom row. FCF is identical in both columns: −$3.5bn. It's the one metric the game can't fool, which is the law in section 4.6 of the earnings-games taxonomy. A company reporting 29% EBITDA margins while burning $3.5bn of free cash, and funding itself with acquisitions and debt, is telling two stories that can't both be true.

Step 4: the stability tell. Quarter after quarter, the line-cost ratio printed 42% ± a rounding error while industry prices collapsed. In a volatile industry, a too-stable ratio is a flag in itself. Honest numbers wobble.

Step 5: the verdict. "Line costs at 42% of revenue against peers' ~50% imply ~$2.8bn/yr of costs I cannot locate in the P&L; capex/D&A of 2.1× into a glutted market is consistent with cost capitalisation; FCF is deeply negative against reported EBITDA margins. Severity L3–L4 evidence pattern. Avoid; short-side research mandate justified; tripwire: any SEC inquiry into capitalisation policy, capex guidance vs D&A convergence." Cynthia Cooper's team found the entries (Dr PP&E / Cr Line cost expense) in June 2002, and the restatement reached ~$11bn. Those are facts. The SEC action and the Beresford report established them, along with the convictions.

WE3: Yes Bank: computing what the divergence table actually said

The RBI's asset-quality review disclosures are mandatory, quantified, and public. For FY2017 Yes Bank reported gross NPAs of ₹2,019 crore. The RBI's assessment was ₹8,374 crore, a divergence of ₹6,355 crore. Those are facts, from the bank's own mandated disclosure. For the arithmetic, use these illustrative scale figures: gross advances ~₹1,32,000 crore, reported PAT ~₹3,300 crore, marginal tax ~34%.

Step 1: restate the headline ratio. Reported GNPA = 2,019 ÷ 132,000 = 1.5%, the best in the sector. RBI-assessed GNPA = 8,374 ÷ 132,000 = 6.3%, among the worst of the large private banks. The whole "zero-NPA machine" premium rested on the gap between those two numbers. And the regulator had just published which one it believed.

Step 2: what the missing provisions do to profit. Provision the incremental GNPA of ₹6,355 crore at even 40% coverage and you get 0.40 × 6,355 = ₹2,542 crore pre-tax → 2,542 × (1 − 0.34) = ₹1,678 crore post-tax ≈ 1,678 ÷ 3,300 = 51% of reported PAT. At 60% coverage it's 3,813 pre-tax → ₹2,517 crore post-tax ≈ 76% of PAT. So between half and three-quarters of the year's reported profit existed only because loans the regulator judged non-performing were still accruing interest with no provision against them. That's the failure-to-impair branch of cost parked, in banking dress.

Step 3: the growth arithmetic. Loan book ~₹55,000 crore (FY14) → ~₹1,32,000 crore (FY17): CAGR = (132/55)^(1/3) − 1 ≈ 34%, against system credit growth of ~10%. A bank growing 3× the system must, by arithmetic, be winning more than its share of the marginal borrower, including the borrowers every other bank declined. Growth in lending is a choice of risk, and the risk shows up with a lag as the loans season. The divergence table shows you what that seasoning looked like once someone inspected it.

Step 4: the pattern rule. One divergence is a dispute with the inspector. Yes Bank printed divergences for FY16 (₹4,177 crore), FY17 (₹6,355 crore), and later FY19 (₹3,277 crore), all facts from the mandated disclosures. By the second table you can stop asking "who is right?". The referee publishes the score.

Your question now is "what else fails inspection?"

Step 5: the verdict. "RBI-assessed GNPA of 6.3% vs reported 1.5% implies 51–76% of FY17 PAT rests on provisions not taken; loan growth at ~3× system implies unseasoned risk concentration; severity L3 minimum with the regulator as the finder of fact. Do not own through the seasoning; tripwires: the next divergence table, PCR trend, CEO reappointment decision (RBI's call, and it cut the term in September 2018), promoter pledge behaviour." The moratorium, reconstruction, and AT1 write-down of March 2020 are in case file I3.

WE4: Manpasand Beverages: the full Beneish M-Score, computed

Referenced from case file I5. The inputs are synthetic, modelled on Manpasand's FY16 to FY17 scale and the texture that was publicly reported: revenue from ₹557 crore to ₹709 crore, heavy capex, equity raises, thin advertising. For the drill, pull the actual annual reports and recompute. All figures ₹ crore.

The eight indices. Each sits ≈1.0 for a clean company. Beneish's means for his sample of manipulators are in section 4.10 of the cash-flow lessons.

The score.

M = −4.84 + 0.920(1.397) + 0.528(1.054) + 0.404(1.203) + 0.892(1.273)
    + 0.115(1.115) − 0.172(0.887) + 4.679(0.0563) − 0.327(0.882)
  = −4.84 + 1.285 + 0.557 + 0.486 + 1.135 + 0.128 − 0.153 + 0.263 − 0.288
  = −1.43

M = −1.43 > −1.78 → flagged. The drivers tell the story. DSRI is 1.40, so receivables far outran even 27% sales growth. SGI is 1.27, the treadmill. AQI is 1.20, as soft assets like those capital advances swelled. TATA is 0.056: ₹72 crore of profit against ₹5 crore of operating cash. It's the SGI-AQI-DSRI-TATA profile case file I5 describes.

The overlay that tells them apart. The M-Score on its own is only triage. A genuine high-growth juice company could print similar indices. What set Manpasand apart was the physical-verification battery. Advertising ran at 10 ÷ 709 = 1.4% of revenue, against 8–15% for every beverage brand really fighting for shelf space. Nobody could find distributors doing the revenue attributed to them. Pulp and power purchases didn't scale with the claimed volumes. And capex/D&A = 144 ÷ 44 ≈ 3.3× (synthetic, matching the texture), cycle after cycle, with falling asset turns.

The screen said "read". The sidewalk said "sell." Deloitte's resignation (May 2018) and the GST arrests (May 2019; allegations; see I5) followed, in that order.

WE5: Sundar Ceramics (synthetic): a full multi-flag quality-of-earnings teardown (₹)

The capstone in miniature: three independent instruments pointed at one company, landing on a single restated number. Sundar Ceramics (synthetic) is a fast-growing Indian tile maker. All figures are ₹ crore, and every one is computed below. Peer ceramic and tile makers run net margins around 6%.

Step 1: the CFO/NI divergence. CFO ÷ PAT fell from 200 ÷ 240 = 0.83 to 90 ÷ 360 = 0.25. Only 25 paise of every reported rupee of FY25 profit arrived as operating cash. Over a cycle a manufacturer should convert near 1.0. A fall this steep says the profit is being built on the accrual side.

Step 2: Sloan total accruals. Total accruals = (PAT − CFO) ÷ average total assets = (360 − 90) ÷ 2,700 = 10.0% of assets. That's squarely in Sloan's danger decile, which predicts below-average future earnings. The ₹270 crore wedge has to live somewhere on the balance sheet.

Step 3: the margin cross-section. FY25 net margin = 360 ÷ 3,000 = 12.0%, twice the ~6% peer median in the same tile market. Either Sundar has a cost or pricing moat it can name, or ~6 points of margin are an accrual nobody can see. It's the impossibility test from Tesco and Toshiba.

Step 4: locate the residue. DSO walked 470 ÷ 2,400 × 365 = 71.5 → 730 ÷ 3,000 × 365 = 88.8 days (+17.3). DIO walked 380 ÷ 1,500 × 365 = 92.5 → 560 ÷ 1,800 × 365 = 113.6 days (+21.1). The operating working-capital build = ΔRecv 260 + ΔInv 180 − ΔPay 30 = ₹410 crore, and it reconciles the wedge to the crore: PAT 360 + D&A 140 − ΔWC 410 = ₹90 crore = CFO. Capex/D&A of 520 ÷ 140 = 3.7× sits alongside it. Still, this story is about working capital. Capitalisation is a side issue here.

Step 5: the core-earnings bridge. Apply FY24's collection and stocking habits to FY25 volumes. Expected receivables = 71.5 ÷ 365 × 3,000 = ₹588 crore. Actual receivables are 730, so that's ₹142 crore of excess. Expected inventory = 92.5 ÷ 365 × 1,800 = ₹456 crore. Actual is 560, so ₹104 crore of excess. Treat the ₹246 crore of excess build as a pre-tax overstatement of profit, with revenue pulled into receivables and cost deferred into stock. Tax-effect it at 25% and you get a ₹185 crore haircut, so core PAT ≈ ₹175 crore. That lands within ₹5 crore of the ₹180 crore the 6% peer margin implies. Three instruments, one answer.

If you carry full precision, 142.5 + 104.0 = 246.5, times 0.75 = 184.9. Core PAT is then ₹175.1 crore and the gap to 180 is ₹4.9 crore. The rounded chain and the exact one agree, and that agreement is your check.

Step 6: the verdict (language protocol). "CFO/NI has collapsed to 0.25, Sloan accruals are 10% of assets, and the 12% net margin is double the peer median; the ₹410 crore working-capital build fully explains the profit-to-cash gap, and normalising the excess portion brings core earnings to ~₹175 crore, under half of reported PAT. I cannot verify the reported margin as cash-generative. Severity L3: earnings quality graded D pending the receivable-ageing and inventory break-up, dealer sell-through data, and the next two quarters' DSO/DIO. Position capped; tripwires: any provision for slow-moving stock, any related party appearing among the debtors, CFO/NI below 0.4 again in FY26."

WE6: Helios Pay (synthetic): when the accrual screens stay silent (US$)

The mirror image of WE5. Helios Pay (synthetic) is a US-listed payments processor booking high-margin fees through Asian partner banks, with the matching cash "held with partner banks." All figures are $m. Short-term US rates are near 5% (as of mid-2026). Watch which tests fire, and which can't.

Step 1: run the accrual screens first, and watch them fail. Sloan total accruals = (210 − 205) ÷ 1,450 = 0.3%, essentially zero. Beneish comes back benign. On accrual logic alone, Helios looks pristine. But fabricated revenue that settles into fabricated cash leaves no accrual wedge. The "cash" reconciles to the "profit" by construction. So the silence doesn't clear Helios. It's what you'd expect if both legs were fabricated. That's the Wirecard and Luckin blind spot from Common Mistake #4.

Step 2: switch to verification logic with the cash-yield test. Implied yield = 8 ÷ 1,050 = 0.76% against short rates near 5%. Forgone income = (5.0% − 0.76%) × 1,050 = $44.5m, about 44.5 ÷ 210 = 21% of net income quietly missing every year. Wirecard ran in a zero-rate era. With rates at 5%, the yield test has full power, because real cash earns the policy rate.

Step 3: borrowing-despite-cash. Helios raised $650m of debt at ~6% while still carrying roughly half a billion of net cash (1,050 + ~80 operating − 650 ≈ $480m). Servicing that debt against "cash" yielding 0.76% is a negative carry of (6% − 0.76%) × 650 = $34m/yr. No rational treasury runs that. Management's own financing is a vote that the reported cash can't be reached.

Step 4: the segment-of-convenience concentration. The Asian partner-bank segment supplies ~62% of revenue and ~90% of EBITDA. Its cash is confirmed only through statements the partners supply, never at source. When profit lives in the one place the auditor can't independently confirm, someone put it there.

Step 5: the verdict. "Accrual screens are silent, which on these facts is itself informative: revenue and its settling cash appear fabricated together. Cash yields 0.76% against ~5% (forgoing ~21% of net income); the company borrowed $650m at 6% while claiming net cash; and ~90% of EBITDA sits in a segment confirmed only by furnished documents. Severity L3–L4 evidence pattern on verification logic alone. Do not own pending source-level bank confirmations. The lesson of case file G6: verify the asset that backs the profit, cash most of all, because the screens have a known blind spot exactly here."

Practice set

Twelve problems, ramped from guided (P1–P4, ~15 minutes each, with the method prompted) to independent (P5–P9, ~20 minutes, you choose the tools) to timed (P10–P12, 8 minutes each, exam conditions). All companies are synthetic unless named. Work each one fully before you read the solution. The timed spot-the-shenanigan exam (capstone Part B) follows in section 7.1.

P1 (guided). Deccan Agrotech reports average cash and deposits of ₹3,200 crore, interest income of ₹70 crore, PAT of ₹820 crore, and gross debt of ₹1,100 crore carrying finance costs of ₹103 crore. One-year deposit rates are 7.5%. (a) Run the cash-yield test. (b) Run the borrowing-despite-cash test. (c) Name the family, severity, and the two disclosures you would read next.

Solution. (a) Implied yield = 70 ÷ 3,200 = 2.2% vs 7.5% available → forgone income = (7.5% − 2.2%) × 3,200 = ₹170 crore ≈ 170 ÷ 820 = 21% of PAT, every year. (b) Borrowing cost = 103 ÷ 1,100 = 9.4%. The company pays 9.4% on ₹1,100 crore while ₹3,200 crore of its own money supposedly earns 2.2%. That's a negative carry of ~(9.4% − 2.2%) × 1,100 = ₹79 crore, and no rational treasury would run it. Either the cash can't be touched or it isn't there. (c) Family: an asset-verification failure next door to revenue that isn’t, with fictitious or encumbered cash. It's the Satyam, C&K and Wirecard pattern. Severity: L3 pending answers. Read next: the cash-and-bank note, for the break-up by bank and by deposit and any liens. Then the auditor's report and CARO, for how balances were confirmed and any remarks under Rule 11(e) or on fund routing.

P2 (guided). Bharat Telelinks (telecom) reports revenue ₹9,000 crore; network lease costs ₹3,150 crore; EBITDA ₹2,850 crore; CFO ₹2,300 crore; capex ₹2,600 crore; D&A ₹1,050 crore. Three comparable carriers report network lease costs at 44%, 46%, and 45% of revenue. (a) Benchmark the cost line. (b) Compute capex ÷ D&A. (c) Show what EBITDA and FCF look like if the peer-median ratio is the truth and the difference has been capitalised.

Solution. (a) Reported ratio = 3,150 ÷ 9,000 = 35% vs peer median 45% → implied honest cost = 45% × 9,000 = ₹4,050 crore → gap = ₹900 crore/year unaccounted for. (b) 2,600 ÷ 1,050 = 2.5×. That's heavy investment against how fast the assets are used up, and it's where a parked expense would land. (c) Corrected EBITDA = 2,850 − 900 = ₹1,950 crore (margin 31.7% → 21.7%). Corrected CFO = 2,300 − 900 = 1,400. Corrected capex = 2,600 − 900 = 1,700. FCF reported = 2,300 − 2,600 = −300, and FCF corrected = 1,400 − 1,700 = −300. They're identical. It's the WorldCom scissor again: capitalisation fools EBITDA and CFO, and it never fools FCF. Family cost parked / operating outflow shifted to investing, severity L3. The tests that tell you: the schedule of fixed-asset additions (what was capitalised, item by item?), the depreciation rate on new additions, and the capitalisation criteria in the accounting-policy note.

P3 (guided). Greenline Grocers (retail) books ₹210 crore of supplier commercial income in H1 as a reduction of COGS; the notes reveal only ₹95 crore has been received in cash, with the balance accrued against full-year volume targets. Your channel work suggests only ~55% of the accrued targets will be met. H1 PBT is ₹260 crore. (a) Estimate the overstatement. (b) Name the family and the Tesco lesson that applies.

Solution. (a) Defensible income = cash received + achievable accruals = 95 + 0.55 × (210 − 95) = 95 + 63 = ₹158 crore → overstatement = 210 − 158 = ₹52 crore = 52 ÷ 260 = 20% of H1 PBT. (b) Family: a cost hidden / revenue too soon hybrid, with income accrued before conditions are met and costs effectively understated inside COGS. Tesco lesson: the number management most depends on and least discloses is where stress concentrates. Demand quantified commercial-income disclosure, and treat margins that defy the trading environment as an accrual you can't see until proven otherwise. Severity L2–L3; test: post-period credit notes, supplier-side checks, the H2 true-up.

P4 (guided: the Cox & Kings computation from case file I8). A tour operator (illustrative, modelled on C&K's FY18 scale) reports revenue ₹5,800 crore; trade receivables ₹2,250 crore; cash ₹1,800 crore; interest income ₹40 crore; gross debt ₹3,200 crore; finance costs ₹290 crore. Thomas Cook India-type peers run DSO near 35 days. (a) Compute DSO in days and months. (b) State the business-model working-capital sign and the contradiction. (c) Run the cash-yield and borrowing-despite-cash tests. (d) Write the two-sentence verdict per the language protocol.

Solution. (a) DSO = 2,250 ÷ 5,800 × 365 = 142 days ≈ 4.7 months. (b) Tour operators collect in advance, because customers pay before they travel. So the model's natural receivable is near zero, and advances, a liability, should dominate. If a travel company's customers apparently pay ~5 months after the holiday, it's describing a lending book or a fiction. With the peer at 35 days, the cross-section settles it. (c) Cash yield = 40 ÷ 1,800 = 2.2% vs ~7% deposits. Borrowing cost = 290 ÷ 3,200 = 9.1%, expensive debt rolled alongside "idle" cash. Negative carry ≈ (9.1% − 2.2%) × 1,800 = ₹124 crore/yr. (d) "Receivables at 4.7 months of revenue in an advance-collection business, cash yielding 2.2% against 9.1% borrowing costs, and rising promoter pledge form three independent flags I cannot reconcile with the accounts as presented; severity L3–L4 evidence pattern: do not own pending granular receivable ageing and deposit confirmation." C&K defaulted on ~₹150 crore of CP in June 2019 while reporting ₹1,800+ crore of cash. That's fact, from case file I8.

P5 (independent). Meridian Bank reports gross advances ₹80,000 crore; GNPA ₹1,000 crore; PCR 60%; PAT ₹1,900 crore; marginal tax 34%. The RBI divergence table adds ₹3,800 crore of GNPA. Divergent loans were accruing interest at ~10%. (a) Restate GNPA%. (b) Compute the post-tax profit impact of provisioning the divergence at 50% coverage plus derecognizing one year of accrued interest. (c) What does the existence of the table imply, and what is your response on the ladder?

Solution. (a) Reported 1,000 ÷ 80,000 = 1.25%. Assessed (1,000 + 3,800) ÷ 80,000 = 6.0%. (b) Provisions: 0.50 × 3,800 = 1,900 pre-tax → 1,900 × 0.66 = ₹1,254 crore post-tax. Interest derecognition: 10% × 3,800 = 380 pre-tax → ₹251 crore post-tax. Total ≈ 1,505 ÷ 1,900 = 79% of reported PAT rests on how the loans are classified. (c) The regulator, with inspection access, has published that management's numbers failed its audit. That's gatekeeper-tier information, and it outranks every ratio. On the ladder it's L3 at minimum. Don't own it through the seasoning. Tripwires: the next divergence disclosure, the PCR trend, the slippage run-rate, the stability of the funding mix. Yes Bank printed three such tables (case file I3).

P6 (independent). Sunrise Media bills an associate broadcaster ₹450 crore/year for three years (₹1,350 crore cumulative). Receivables from the associate grow from ₹120 to ₹310 to ₹640 crore over the same period. In Year 4 the company provisions ₹640 crore as "exceptional." The associate segment contributed cumulative PBT of ₹520 crore in Years 1–3. (a) Compute Year-3 and cumulative cash collection. (b) What was the "revenue," economically? (c) Which disclosures decide it, and under what India rule does a large RPT need shareholder approval?

Solution. (a) Year 3: the receivable rose 640 − 310 = 330 against 450 billed, so the company collected 450 − 330 = ₹120 crore, 27% of billings. Cumulative: collected = 1,350 − (640 − 120) = ₹830 crore = 61%. (b) The Year-4 provision (₹640 crore) is bigger than the segment's entire cumulative PBT (₹520 crore). Economically, the "revenue" was an unsecured, interest-free loan to a related party wearing revenue's clothes. It was booked as sales and never collected. Then it was written off as exceptional. That's the Zee pattern, so read the exceptional-items note against the RPT note. Family revenue that isn’t (arm's-length failure) / play 7. (c) The RPT note (terms, interest, ageing), the audit-committee approvals, and SEBI LODR Reg 23. Material RPTs (≥₹1,000 crore or ≥10% of consolidated turnover, whichever is lower) need prior shareholder approval, with related parties abstaining. If a revenue relationship is structured to stay just under the materiality thresholds, that's a finding in itself.

P7 (independent). A mid-cap's Beneish indices: DSRI 1.42, GMI 1.11, AQI 1.31, SGI 1.48, DEPI 1.02, SGAI 0.91, LVGI 1.06, TATA 0.041. (a) Compute M. (b) Flag or not? (c) Which two variables do you interrogate first, and what innocent explanations must you eliminate before escalating past L2?

Solution. (a) M = −4.84 + 0.920(1.42) + 0.528(1.11) + 0.404(1.31) + 0.892(1.48) + 0.115(1.02) − 0.172(0.91) + 4.679(0.041) − 0.327(1.06) = −4.84 + 1.306 + 0.586 + 0.529 + 1.320 + 0.117 − 0.157 + 0.192 − 0.347 = −1.29. (b) −1.29 > −1.78 → flagged. (c) DSRI 1.42, with receivables outrunning even 48% growth, and TATA 0.041, the accrual wedge. Those two have the most direct fraud readings. Rule out the innocent explanations first. Maybe there's a disclosed shift to enterprise or government customers on longer terms. Then read the terms and the ageing. Maybe a mid-year acquisition distorts both receivables and accruals, so restate organically. Or maybe it's real hypergrowth eating working capital. Then check whether gross margin and asset quality moved too. GMI 1.11 and AQI 1.31 say they did, and that's why this cluster reads worse than a clean growth story. The M-Score tells you where to read. It never convicts (section 4.10 of the cash-flow lessons).

P8 (independent). PayEuro AG (payments, Eurozone) reports net cash of €1.6bn: €2.1bn cash (most of it "held with trustees in escrow accounts" for its Asian partner business) less €0.5bn debt. During the year it raises a €900m convertible and a €500m bond. Euro deposit rates are ~0%. (a) Why is the cash-yield test weak here, and what replaces it? (b) State the trilemma. (c) Name the three meta-signals you would weight most, per case file G6.

Solution. (a) At ~0% policy rates, a low yield on cash proves little. The yield test loses its power when rates are at zero. Two things replace it. First, borrowing-despite-cash. Why pay coupons and fees to raise €1.4bn while claiming €1.6bn of net cash? The act of borrowing is management's own vote on whether the cash can be reached. Second, asset-verification logic. You need to know where the cash is and who controls the trustee. Has the auditor confirmed the balances at source, or only through documents someone handed over? Under IAS 7, read the disclosure on what cash and equivalents consist of and any restrictions on them. Escrow with a third-party trustee in another jurisdiction isn't operating liquidity, wherever it's presented. (b) The cash isn't there. Or it's there but out of reach, or it isn't the company's. Or management is irrational. (c) The meta-signals: the special auditor couldn't verify (KPMG's April 2020 report, published two months before the end). There were years of investigative reporting with documents, from the FT. And the regulator attacked the messengers. BaFin banned short sales and filed complaints against journalists. A captured gatekeeper is a signal you can trade on. Wirecard's €1.9bn "likely never existed", EY refused its opinion, and insolvency came in June 2020. Those are facts (case file G6).

P9 (independent). Kurobe Heavy (EPC) has a fixed-price contract: price ¥80bn. Costs incurred to date ¥36bn. Management's estimate of total cost: ¥60bn. Your engineering check suggests ¥75bn is realistic, and a stress case says ¥82bn. (a) Compute booked vs honest cumulative revenue and margin under percentage-of-completion. (b) Compute the overstatement. (c) What happens in the stress case, and which disclosures catch this game?

Solution. (a) Management: % complete = 36 ÷ 60 = 60% → revenue 0.60 × 80 = ¥48bn, margin 48 − 36 = ¥12bn. Honest: 36 ÷ 75 = 48% → revenue 0.48 × 80 = ¥38.4bn, margin 38.4 − 36 = ¥2.4bn. (b) Revenue is overstated by 48 − 38.4 = ¥9.6bn, and profit by 12 − 2.4 = ¥9.6bn. Understating the cost estimate inflates progress and total margin together. That was Toshiba's core move (case file G4). (c) At ¥82bn total cost the contract is onerous. The expected loss of 82 − 80 = ¥2bn has to be provided in full immediately, so the honest swing against management's books is 12 − (−2) = ¥14bn. What catches it: the note on cost-estimate revisions (do estimates only ever move in the company's favour?), the provision roll-forward (where are the contract-loss provisions peers carry?), unbilled contract assets ballooning against billings, and segment margins benchmarked against peers in the same end-markets.

P10 (timed, 8 minutes). Bloom Beverage Co. claims 380 items sold per store per day at an average realisation of ₹165. Your team's 60-store, 900-store-day observation sample counts an average of 232 items at receipts averaging ₹146. (a) Quantify the claimed-vs-observed gap in revenue run-rate. (b) State the two caveats a professional attaches before acting. (c) Which case is the template, and what broke that company?

Solution. (a) Volume inflation = 380 ÷ 232 − 1 = 64%. Price inflation = 165 ÷ 146 − 1 = 13%. Combined claimed-vs-observed revenue = (380 × 165) ÷ (232 × 146) = 62,700 ÷ 33,872 = 1.85, so the claimed run-rate is ~85% above what the sidewalk supports. (b) Two caveats. Sampling error: do 60 stores represent the network's mix of city tiers, times of day, seasons? And whether the observation holds up: are app and delivery orders invisible at the counter? Widen the sample and triangulate with third-party app-order sequence data before you publish anything. (c) Luckin Coffee (G7): 11,260 hours of video and 25,843 receipts. Revenue of ~RMB 2.12bn was fabricated, with fabricated costs as camouflage. Those are facts. They come from the company's findings and the SEC settlement. When the ledger and the sidewalk disagree, trust the sidewalk.

P11 (timed, 8 minutes). Meghdoot Electricals reports interest expense of ₹216 crore against reported average gross debt of ₹1,030 crore; its disclosed marginal borrowing cost is 10.2–10.8%. (a) Compute the implied borrowing rate and the implied true average debt at 10.5%. (b) List the innocent explanations to eliminate. (c) Name the play and the India disclosures that catch it.

Solution. (a) Implied rate = 216 ÷ 1,030 = 21.0%, double the disclosed cost. Implied average debt at 10.5% = 216 ÷ 0.105 = ₹2,057 crore, which leaves roughly ₹1,030 crore of borrowings the balance sheet doesn't show. Liabilities hide better than assets lie. It's the CG Power pattern, where the company's own disclosure showed understated liabilities of ~₹1,054 crore as at March 2018 (case file I9). (b) Run the innocent checks first. Look for prepayment penalties and FX losses classified in finance costs. Look for interest on customer advances or leases. Commitment and processing fees count too. Read the break-up in the finance-cost note before you conclude. (c) Play 7 / liability completeness. What catches it: the finance-cost note, guarantee schedules and contingent liabilities, CARO's clauses on guarantees and fund routing, Rule 11(e) representations, and peak debt during the year against closing debt, which shows up quarter-end window dressing.

P12 (timed, 8 minutes; the IL&FS computation from case file I2). Trunkline Infra Group: holdco standalone borrowings ₹16,000 crore; consolidated borrowings ₹92,000 crore; its two listed subsidiaries disclose ₹24,000 crore combined. Group CP outstanding averages ₹7,500 crore (average maturity ~60 days); consolidated CFO is ₹3,100 crore against consolidated interest obligations of ₹8,700 crore. (a) Compute the debt living in unlisted entities. (b) Compute cash interest cover and state what keeps the group alive. (c) Name the play and the three document sets that reveal it.

Solution. (a) Dark debt = 92,000 − 16,000 − 24,000 = ₹52,000 crore. That's 57% of consolidated borrowings, sitting in unlisted SPVs whose only public disclosure is MCA filings. (b) Interest cover = 3,100 ÷ 8,700 = 0.36×. Operations fund barely a third of the interest. The group lives on rollover. ₹7,500 crore of 60-day paper against 15–22-year road assets has to be refinanced ~6× a year. So the solvency story is really a bet on liquidity, and a AAA that needs rollover measures confidence and nothing more. (c) Play 6 (funding mismatch) plus complexity as opacity. The documents: consolidated and entity-level MCA filings, to reconcile standalone debt to consolidated. NCD and CP offer documents, because the ALM ladder lives there. And rating rationales, for what the agency assumed about group support. When it stops assuming that, you get the cliff: AAA to D in six weeks (case file I2).

P13 (guided). Kaveri Consumer Durables (synthetic) reports FY24 PAT ₹150 crore against CFO ₹130 crore, and FY25 PAT ₹225 crore against CFO ₹75 crore; average total assets ₹1,500 crore; FY25 D&A ₹95 crore and capex ₹340 crore; FY25 revenue ₹1,500 crore against a ~7% peer net margin. (a) CFO/NI for both years. (b) Sloan total accruals and capex ÷ D&A. (c) Benchmark the margin, then state the severity and the two disclosures you read next.

Solution. (a) 130 ÷ 150 = 0.87 → 75 ÷ 225 = 0.33: cash conversion halved as profit grew. (b) Sloan = (225 − 75) ÷ 1,500 = 10.0% of assets (danger decile); capex ÷ D&A = 340 ÷ 95 = 3.6×. (c) Net margin = 225 ÷ 1,500 = 15.0% vs peer 7%, more than double. With CFO/NI at 0.33 and accruals at 10%, there's no cash behind the excess margin. A conservative core-earnings read pulls the margin toward the peer 7%, so core PAT ≈ 0.07 × 1,500 = ₹105 crore, under half of reported. Family: an accrual build of the revenue too soon / cost parked kind. Severity L3 pending answers. Read next: the receivables ageing and inventory break-up (where did the ~₹150 crore wedge land?), and the related-party note (are the new debtors arm's-length?).

P14 (guided). Northwind Software (synthetic, US) reports revenue $800m, EBITDA $240m, CFO $210m, capex $150m, D&A $70m, interest $10m; this year it began capitalising $60m of platform-development cost that peers expense. (a) Re-expense it: corrected EBITDA and margin. (b) Show the effect on CFO, capex, and FCF. (c) Compute the capitalised amount as a share of reported PBT, and name the family.

Solution. (a) Corrected EBITDA = 240 − 60 = $180m → margin 180 ÷ 800 = 22.5%, down from a reported 30.0%. (b) Corrected CFO = 210 − 60 = $150m, because the $60m moves from investing back to operating. Corrected capex = 150 − 60 = $90m. FCF = 210 − 150 = $60m reported and 150 − 90 = $60m corrected. They're identical. Same WorldCom scissor: capitalisation moves EBITDA and CFO and never FCF. (c) Reported PBT = 240 − 70 − 10 = $160m, so the capitalised development is 60 ÷ 160 = 37.5% of PBT (corrected PBT $100m). Family cost parked / operating outflow shifted to investing, severity L2–L3. The test that tells you: the capitalisation-policy note and the additions register, set against peer policy.

P15 (independent). Sahyadri Finance (synthetic) is sold as a granular retail home-loan NBFC. Average advances ₹20,000 crore; interest income ₹2,600 crore; commercial paper is 35% of borrowings; the one-year cumulative ALM gap is −25%. Retail home loans of this type yield ~9.5%. (a) Implied yield on advances and the gap to the stated product. (b) What does the gap imply, and what is the funding flag? (c) Name the plays and the tests.

Solution. (a) Implied yield = 2,600 ÷ 20,000 = 13.0% vs a stated ~9.5% → a 350 bps gap; interest at the stated yield would be 9.5% × 20,000 = ₹1,900 crore, leaving ₹700 crore of interest income unexplained by the described book. (b) A book yielding 13% can't be retail home loans. It's higher-risk developer or unsecured lending, or fictitious high-yield accounts like DHFL's "Bandra Books". The yield-on-advances test is the lending cousin of the cash-yield test. The funding flag: 35% CP against long-tenor mortgages, with a −25% one-year ALM gap, is the negative-gap failure of IL&FS and DHFL. It's a solvency story that can die of illiquidity. (c) Plays 1 (fake or misdescribed asset) and 6 (funding mismatch). Tests: yield on the book against the product mix. Vintage and static-pool data on the loan book. The ALM ladder with the CP rollover calendar. The Rule 11(e) and CARO fund-routing clauses.

P16 (independent). Cascade Diagnostics (synthetic, US) posts Beneish indices: DSRI 1.35, GMI 1.08, AQI 1.22, SGI 1.40, DEPI 1.05, SGAI 0.95, LVGI 1.10, TATA 0.052. (a) Compute M. (b) Flag or not, and which two variables drive it? (c) The same M comes back clean on a peer you separately suspect of fabricating revenue with matching fake cash. Why, and what do you run instead?

Solution. (a) M = −4.84 + 0.920(1.35) + 0.528(1.08) + 0.404(1.22) + 0.892(1.40) + 0.115(1.05) − 0.172(0.95) + 4.679(0.052) − 0.327(1.10) = −4.84 + 1.242 + 0.570 + 0.493 + 1.249 + 0.121 − 0.163 + 0.243 − 0.360 = −1.45. (b) −1.45 > −1.78 → flagged; drivers are DSRI 1.35 (receivables outrunning sales) and SGI 1.40 (the growth treadmill), with TATA 0.052 confirming the accrual wedge. (c) At the peer, revenue is fabricated and so is the cash it settles into, so no accrual wedge opens and M stays benign. That's the screen's blind spot. Run verification logic instead. That means the cash-yield test and borrowing-despite-cash. It also means confirmation at source, the routine from WE6.

P17 (independent). Orbit Industrials (synthetic) has real factories but a stressed promoter. "Loans and advances to related parties" have grown from 8% to 22% of a ₹3,000 crore net worth; interest expense is ₹340 crore on reported average debt of ₹2,200 crore, while the disclosed marginal borrowing cost is ~10.5%; promoter pledge is 82%. (a) The RPT advances in ₹ crore at each date. (b) Run the liability-completeness test. (c) Name the play, the archetype, and the correct pre-disclosure action.

Solution. (a) 0.08 × 3,000 = ₹240 crore → 0.22 × 3,000 = ₹660 crore. Cash is migrating to the ecosystem. (b) Implied borrowing rate = 340 ÷ 2,200 = 15.5%, far above the disclosed 10.5%. Implied true debt = 340 ÷ 0.105 = ₹3,238 crore, which leaves roughly ₹1,038 crore of borrowings the balance sheet does not show. That's the CG Power pattern: liabilities hide better than assets lie. (c) Play 7 (ecosystem leak) plus liability completeness. The archetype is a real-business, looted-balance-sheet case. A change of control could rescue it, as with CG Power, but only after the loot is quantified. The right action before any disclosure: a pledge at 82% beside rising RPT advances is a cluster bordering on L4. Keep the position small or out, because you can't yet know it's the rescuable kind. Tests: the RPT note and the creep in loans and advances. The guarantee and contingent schedules. CARO's fund-routing clauses. The break-up in the finance-cost note.

P18 (timed, 8 minutes). Deccan Foods (synthetic): the capstone in eight minutes. Revenue ₹1,800 crore; reported PAT ₹200 crore; CFO ₹55 crore; average total assets ₹1,600 crore; average cash and deposits ₹900 crore; interest income ₹27 crore; trade receivables ₹480 crore; peers collect at ~40 days; deposit rates ~7%. Run four tests, then call it. (a) CFO/NI. (b) Sloan accruals. (c) Cash-yield. (d) DSO vs peers. (e) One-line verdict and severity.

Solution. (a) CFO/NI = 55 ÷ 200 = 0.28. (b) Sloan = (200 − 55) ÷ 1,600 = 9.1%, the danger decile. (c) Cash-yield = 27 ÷ 900 = 3.0% vs ~7% → cash fake, encumbered, or idle. (d) DSO = 480 ÷ 1,800 × 365 = 97 days vs peers' 40, more than double. (e) "Four independent flags converge, namely soft cash conversion, top-decile accruals, a cash-yield anomaly and DSO at ~2.4× peers, which I cannot reconcile with the reported profit; severity L3–L4, do not own pending the deposit break-up and receivable ageing." When flags converge across independent categories (cash, accruals, receivables), you're making a decision about the position. A single flag would only raise a question.

P13 (the four extension files, in one company). Marwar Bullion (synthetic, India, ₹ crore) is a listed gold and jewellery trading group. FY26: revenue 12,000; gross profit 300; profit after tax 90; trade receivables 3,600; inventory 2,800; trade payables 1,900; short-term borrowings, almost all buyer's credit and letters of credit rolled continuously, 4,100; total assets 7,600. Related-party sales were 4,800. Cumulative CFO across FY22 to FY26 was −1,450 against cumulative PAT of 380. The company raised ₹900 crore of term debt in FY26, stated in the offer document to be for a new refinery; gross block moved from 1,200 to 1,420, capital work in progress from 60 to 150, and loans and advances to related parties from 180 to 760. Listed jewellery peers run gross margins of 11% to 14% and DSO of 25 to 45 days. (a) Run the gross-up screen and the working-capital screen. (b) Run the cumulative conversion test. (c) Run the funding-structure test. (d) Run the use-of-proceeds reconciliation. (e) Write the verdict in the language protocol.

Solution. (a) Gross margin is 300 ÷ 12,000 = 2.5%, against a peer range of 11% to 14%. So the company books ₹40 of revenue for every ₹1 of gross profit, and its turnover measures stock going round in circles. DSO = 3,600 ÷ 12,000 × 365 = 109.5 days, against a peer range of 25 to 45. DIO = 2,800 ÷ 11,700 × 365 = 87.4 days. DPO = 1,900 ÷ 11,700 × 365 = 59.3 days. The cash conversion cycle is 137.6 days, and receivables plus inventory are 84.2% of total assets. Related parties supply 40.0% of revenue. Every one of those is the Gitanjali signature (I11). (b) Cumulative CFO ÷ cumulative PAT = −1,450 ÷ 380 = −3.82×. Five years of reported profit produced five years of cash outflow. The cumulative test returns that verdict without any forensic work at all. (c) Short-term borrowings are 4,100 against 6,400 of receivables and inventory, so 64.1% of the working-capital book is funded by facilities that have to be renewed continuously. One lender's refusal ends the company, and the lender doesn't need a view on the accounts to refuse. (d) Capitalised spend in FY26 = (1,420 − 1,200) + (150 − 60) = 220 + 90 = ₹310 crore, against ₹900 crore raised for the refinery. That leaves ₹590 crore the fixed-asset schedule doesn't explain. Loans and advances to related parties rose by ₹580 crore in the same year, which accounts for 98.3% of the gap. That's the Gensol test (I13), and it's arithmetic on two published schedules. (e) "Gross margin of 2.5% against a peer range of 11% to 14% means reported revenue measures stock rotation rather than sales; five-year cumulative CFO is −1,450 against cumulative PAT of 380; 64% of the working-capital book is funded on continuously rolled short-tenor bank credit; and ₹590 crore of the ₹900 crore raised for a stated refinery does not appear in the fixed-asset schedule, while related-party advances rose ₹580 crore in the same year. I cannot verify that the reported revenue represents third-party sales or that the debt raised was applied to its stated purpose. Severity L3 to L4 on the disclosed figures alone. Do not own pending the related-party schedule, the use-of-proceeds monitoring report, and confirmation of the buyer's-credit lines. Tripwires: any non-renewal of a bank facility, any auditor qualification or resignation, any further advance to a related party."

7.1 The timed spot-the-shenanigan exam (capstone Part B)

Rules. Ten vignettes, all synthetic. 60 minutes total (~6 per vignette), closed book. No checklist and no notes, because you're building automatic responses. For each vignette write four lines: Call (flag / clean) · Family or play (one of the seven moves, a CF game, play 1–7, or meta) · The first discriminating test you would run · Severity (L1–L4, or "clean — monitor X"). Some vignettes are clean by design. The exam scores restraint as heavily as detection. Sit it under exam conditions before you read the key, then score yourself with the table that follows.

V1 — Kaveri Consumer Appliances. Revenue +24% YoY. Receivables +58%; DSO has walked from 54 to 68 to 89 days over eight quarters. Dealer scheme discounts have risen every quarter; the rebate/returns provision is flat at 0.8% of sales. Q4 alone contributed 38% of the year's revenue. Distributor checks report "warehouses full."

V2 — Arjun Polymers. Capex ÷ D&A has run 3.1× for two years; CWIP stands at ₹640 crore. The AR discloses a named brownfield expansion doubling capacity, with commissioning dates; the Schedule III CWIP ageing table shows all balances under two years. Asset turns on commissioned capacity are steady; CFO/EBITDA is 0.84; the auditor's report is clean with a routine KAM on capitalisation.

V3 — Cirrus Softworks. This year the company began capitalising "platform development" — ₹180 crore that was previously expensed. The blended depreciation/amortisation rate falls from 9.1% to 6.8% of gross block. EBITDA margin improves 610bp; FCF is flat. Peers expense comparable work.

V4 — Nalanda Exports. Cash and deposits ₹2,400 crore; interest income ₹38 crore. New working-capital borrowings of ₹900 crore taken at 9.8%. Promoter pledge has risen from 12% to 41% in four quarters. The deposit break-up note has quietly disappeared from this year's annual report.

V5 — Tristar Infotech. DSO up from 71 to 94 days. The MD&A discloses two large new government e-governance contracts (45% of incremental revenue) carrying contractual 90-day payment terms. Unbilled revenue is flat; 92% of receivables sit in the 0–90-day bucket; CFO/EBITDA steady at 0.78; no other anomalies.

V6 — Belmont Industrials. Has beaten consensus EPS by 1–3% for eleven straight quarters. The provisions note shows "unused amounts reversed" of ₹45, ₹62, and ₹78 crore in the last three years. A restructuring reserve booked at a 2023 acquisition remains 40% unutilized and is being released "as integration completes."

V7 — Swift Capital Finance (NBFC). AUM +52% YoY; commercial paper is 38% of borrowings; the one-year cumulative ALM gap is −28%. GNPA prints 0.9%, but 60% of the book has under 18 months of seasoning and the unsecured mix has gone from 18% to 41%. Yields on the book are rising.

V8 — Orchid Agro & Realty. "Loans and advances to business associates" have grown from 6% to 19% of net worth. The notes disclose two fixed deposits (₹150 crore) "lien-marked against facilities availed by group companies." Promoter pledge: 78%. The RPT note lists a corporate guarantee extended to a promoter-owned SPV.

V9 — Deepak Wires. Promoter pledge has stood at 24% for six years, disclosed as security for a family estate settlement. No related-party loans or guarantees; RPT volumes trivial and stable; CFO/EBITDA 0.90; auditor unmodified, in year three of a fresh mandatory-rotation term; no divergence between growth and cash.

V10 — Vertex Digital Services. A "platform services" segment supplies 71% of revenue at a 1.1% gross margin, transacted through two counterparties; the original SaaS segment earns 68% gross margins. Consolidated revenue has tripled in two years. CFO/EBITDA: 0.31. Management describes platform services as "strategic volume."

Answer key. Read it only after you've sat the exam.

Scoring (the C2 gate standard). Seeded shenanigans: 7 (V1, V3, V4, V6, V7, V8, V10). Clean: 3 (V2, V5, V9). A catch means flagging a seeded vignette with the correct family or play and a workable test to tell it apart (severity within one notch). A false positive means flagging a clean vignette at L2+. Pass = at least 6 of 7 catches (≥80%) AND a false-positive rate under 20%, where FP rate = clean vignettes flagged ÷ total vignettes you flagged. In practice, flag two or more of the clean three and you fail whatever you caught. Log your score in the decision journal. Log each miss and each false alarm too. This number is your forensic calibration baseline, and the app's timed mode will keep re-testing it with fresh seeded vignettes.

Applied mini-project: THE PHASE 2 CAPSTONE (the M3 milestone)

The heading says mini-project, but this is really the milestone that certifies competency C2 and closes Phase 2. Budget ~7.5 hours. Part A: two complete 10-step QoE workups, following the protocol in section 4.5, on live companies, one Indian and one American, chosen from the candidate lists below. Part B: the timed spot-the-shenanigan exam (section 7.1), sat closed-book under exam conditions. Part C (30 minutes): finalise your permanent artifact.

A note before you begin, and it is not optional. The candidate companies below are teaching specimens, not accusations and not recommendations. None of them stands accused of accounting fraud as these files are written. They're here because their filings carry legal, disclosed, analytically interesting accounting texture, the kind a working analyst grades every week. Expect most verdicts to land at B or C with specific docked points, and maybe a clean A. If your workup produces an L4 finding on one of these names, by far the likeliest explanation is an error in your work. Check it, then check it again, and either way apply the language protocol. Statuses change, so before you start, spend ten minutes confirming that nothing material has happened since (an auditor change, a regulatory order, a restatement). If something has, that company just became more instructive.

Candidate list, India (pick one; pull the last two annual reports from the company site or BSE/NSE, the latest two investor presentations and earnings-call transcripts, and a screener.in export for speed, tying totals back to the filing):

1. Eternal (Zomato): adjusted-EBITDA policing, ESOP/SBC costs, segment disclosure across food delivery/quick commerce, acquisition accounting.
2. Dixon Technologies: wafer-thin EMS margins, working-capital intensity, customer concentration, ROCE quality vs growth narrative.
3. InterGlobe Aviation (IndiGo): Ind AS 116 lease capitalisation, supplementary rentals and maintenance provisions, the negative-net-worth history, other income's role.
4. Tata Motors: capitalised development spend at JLR (IFRS/Ind AS capitalisation of R&D; compute the P&L effect of expensing it), segment complexity, one-offs history.
5. Trent, high-growth retail: lease-heavy economics, inventory build vs store rollout, operating cash conversion through expansion.
6. Titan, the control specimen: famously clean, but with real texture in gold-on-lease financing, jewellery working capital, franchisee vs owned mix. Grading a clean company accurately is part of calibration.

Candidate list, US (pick one; pull the last two 10-Ks and the latest proxy/DEF 14A from SEC EDGAR, plus two earnings-call transcripts):

1. Boeing, program accounting: deferred production costs, estimates-at-completion, charge history; the gap between program margins and cash economics.
2. Salesforce: SBC add-backs and non-GAAP operating margin, serial acquisitions and goodwill, RPO vs revenue growth.
3. Netflix: content-asset capitalisation and amortisation policy vs cash content spend; compute FCF vs net income across the investment cycle.
4. IBM: divestiture-shaped comparability, one-time items history, pension accounting, tax-rate contribution to EPS.
5. Tesla: regulatory-credit revenue, warranty provisions, deferred revenue on software features; separate contested-narrative debates from accounting facts, evenhandedly.
6. Costco, the control specimen: membership deferred revenue, negative working capital, famously conservative. Grade it and see what an A looks like.

Part A deliverables (per company; the 10-step protocol in section 4.5 produces these):

1. The spread (five years, standalone and consolidated for the Indian name), totals tied to filing pages.
2. The ratio panel with five-year trends and two named peers.
3. The findings register, minimum eight findings per company, each row: finding → page-cited evidence → family (one of the seven moves/CF/meta) → severity (L1–L4) → the innocent explanation → the discriminating test. (On these names most rows will and should be L1–L2.)
4. The quant screens: Beneish M (state your TATA method), Sloan accruals (both methods), Altman variant chosen correctly (skip for any financial), Piotroski F, with each screen's failure mode noted beside its output.
5. The core-earnings bridge: reported PAT/net income → your sustainable owner-earnings estimate, every adjustment a labeled line.
6. The two-page verdict memo, Minto-style, conclusion first: EQ grade (A–F), the three findings that matter, the core-vs-reported gap, what would change your mind, tripwires with dates.
7. The calibration log entry: confidence, the strongest innocent explanation you might be wrong about, the re-check date.

Part C: finalise the artifact. Open your red-flags and quality-of-earnings checklist, the reusable Phase-2 checklist. Run both workups against it as a completeness audit, then make it your own. Add or sharpen at least two checks based on what your workups nearly missed. Initial and date the revision block. From Phase 3 onward, no valuation begins until you've run this checklist. It feeds the teardown you'll learn much later, and it's yours now.

Grading rubric (apply per workup; self-grade honestly or better, swap memos with a peer):

Pass standard for the M3 milestone: each workup scores ≥19/24 with no criterion at 0, AND Part B meets the exam standard (≥6/7 catches, FP rate <20%), AND you pass the Mastery check below at ≥85%. All three together certify C2 and unlock the time value of money, the start of Phase 3. If a workup falls short, fix just what failed. Redo the failed criteria on the same company before you switch targets. Rework builds the skill. A fresh target only rebuilds your hope.

Case Lab: run case CL-2.5 in the app's Cases tab for this week: a fresh multi-flag synthetic workup (CFO/NI divergence, Sloan accruals, and a margin cross-section, in the WE5/P18 mould) that auto-scores your findings register, core-earnings bridge, and severity calls against the seeded answer key, then logs the result to your forensic calibration baseline.

Reading & resources

• Schilit, Perler & Engelhart, Financial Shenanigans, 4th ed., Part One (Ch. 1–2) and each Part's case retrospectives. Re-read now that you know the cases; the book's Enron/WorldCom/Valeant discussions will read completely differently after these seventeen cases. [Paid] [Intermediate]
• Primary case documents, the real syllabus of the week (all free; read at least three in full): the Powers Report (Enron special committee, 2002); the Beresford Report (WorldCom special investigative committee, via SEC EDGAR); Ramalinga Raju's confession letter (7 January 2009; public record, widely archived); Toshiba's Independent Investigation Committee summary (English, 2015); the KPMG special investigation report on Wirecard (April 2020); the Muddy Waters/anonymous Luckin report (January 2020, muddywatersresearch.com); the SFO–Tesco DPA statement of facts (sfo.gov.uk). [Free] [Intermediate]
• SEBI enforcement orders (sebi.gov.in → Enforcement → Orders): read the Satyam-era orders, the Vakrangee orders, the Zee interim/confirmatory orders (2023), and the Cox & Kings orders; NFRA orders (nfra.gov.in) for the IL&FS/IFIN audit-quality actions; RBI divergence disclosures inside bank results (stock-exchange filings). India's adjudicated record, indexed and free. [Free] [Advanced]
• SEC Accounting and Auditing Enforcement Releases (AAERs), at sec.gov: the US adjudicated library; one per week, forever. Start with the Enron, WorldCom, Valeant, and Luckin releases. [Free] [Advanced]
• Bethany McLean & Peter Elkind, The Smartest Guys in the Room. The Enron narrative with the incentives and personalities the filings can't show; pair with the 2005 documentary of the same name. [Paid] [Beginner]
• Dan McCrum, Money Men (2022). Wirecard from the journalist who broke it: a masterclass in documentation discipline, legal pressure, and being right early. Pair with Netflix's Skandal! Bringing Down Wirecard (2022). [Paid] [Beginner–Intermediate]
• Tamal Bandyopadhyay, Pandemonium: The Great Indian Banking Tragedy (2020). The IL&FS/DHFL/Yes Bank-era credit cycle from inside Indian banking. [Paid] [Intermediate]
• David Einhorn, Fooling Some of the People All of the Time. A short seller's complete evidentiary record on Allied Capital, the standard of documentation your L4 write-ups should aspire to. [Paid] [Advanced]
• 2Point2 Capital's Manpasand Beverages analysis (2016, their blog): the pre-collapse forensic note treated here as a model; read it beside the FY16 annual report and score it with your checklist. [Free] [Intermediate]
• Cynthia Cooper, Extraordinary Circumstances: The Journey of a Corporate Whistleblower. The WorldCom internal-audit story: gatekeeper courage from the inside. [Paid] [Beginner]
• The four screen papers (Beneish 1999; Sloan 1996; Altman 1968/2000; Piotroski 2000), already assigned in M2.07; keep them beside the capstone as you compute. [Free] [Advanced]

Going deeper.

• The public activist-short report archives: Muddy Waters (muddywatersresearch.com) and the archived Hindenburg Research reports (availability shifting since the firm wound down in early 2025). Read three as evidentiary documents: each pairs a quantified accounting flag with primary field verification (WE6's discipline), then grade the language against the protocol: where does the report state fact, and where allegation? [Free] [Intermediate]
• ACFE, Fraud Examiners Manual (and the CFE body of knowledge). The practitioner's cross-reference for occupational-fraud schemes and the evidence each one leaves behind, a useful complement to the seven plays when you want the internal-auditor's catalogue of how rather than the outside analyst's read of whether. [Paid] [Advanced]

The Modern Analyst's Addendum

Everything above teaches this skill from first principles, by hand. That is how you learn it, and the mastery check still tests it that way. This addendum shows how a working analyst amplifies the same skill today. It adds; it never replaces. (R1/R10)

AI-Augment this skill

{
  "skill": "Working a forensic case file with hindsight discipline, the seven plays and the hierarchy of tells, the 10-step QoE workup, the language protocol and the position-response ladder",
  "use": "This is the module where an AI tool is most useful for *sources* and most dangerous for *language*, and both halves matter. (1) Use it to assemble the primary record: the SEC order or AAER, the SEBI order, the NFRA finding, the NCLT filing, the auditor's resignation letter, the RBI divergence table — with citations — so a case file is built on adjudicated documents rather than on journalism about journalism. That is the difference between a case file you can quote and one you cannot. (2) Use it to build the timeline: for each case, the date each signal became public. §4.1's calibration questions are unanswerable without that timeline and constructing it is pure document work. (3) Use it as a devil's advocate on your own findings register — hand it your rows and ask for the strongest innocent explanation of each, which is the sixth column the workup demands and the one analysts skimp. (4) Never let it write the verdict. §4.1's language protocol is precise: facts with attribution, allegations as allegations with their status, the word fraud reserved for adjudicated findings or the company's own admission, and your own analysis expressed as evidence rather than verdict. A model asked to summarise a fraud case will use the word fraud about everything in it, including the parts still in litigation, and that sentence in your memo is both a defamation risk and an analytical error.",
  "tools": ["Document/PDF AI — NotebookLM or Claude file upload for regulator orders, auditor resignation letters and the filings behind each case", "Chat assistants — Claude, ChatGPT for timeline construction and for the innocent-explanation column of the findings register", "Coding assistants — for the workup pipeline, the pattern dataset and the calibration arithmetic below"],
  "prompt": "For <CASE>, build a table [Date | Document (exact name and issuer) | What became publicly knowable on this date | Verbatim quote of at most 25 words | Citation]. Use only primary documents: regulator orders, court filings, exchange disclosures, audited filings, auditor letters. Mark every item that comes from press reporting rather than a primary document as SECONDARY. Do not characterise anyone's conduct, do not use the word fraud unless quoting an adjudicated finding, and do not include any allegation without its current status.",
  "verify": "Every date and quote is checked against the primary document, because a case file's whole value is that it is quotable — and a mis-dated signal destroys the calibration exercise, which depends entirely on what was knowable *when*. Apply the language protocol to the tool's output before it enters your notes, not after: convert every characterisation into either an attributed finding or your own reconciliation sentence. And hold the hindsight discipline the tool cannot: a model reading a completed case knows the ending, so its account of 'what was visible in advance' is contaminated by the outcome in a way that will flatter your process. The only honest test is to work an unresolved company forward from today's filings and journal the call (Guardrail 1-5).",
  "diy": "The gate is unaided and it scores false positives as heavily as catches: you run the 10-step workup on a live filing, and the timed vignettes with ratio → residue → family → severity, on paper. Saying 'clean' when clean is the correct answer is part of the standard. Nothing in this callout is admissible in that room."
}

Modern Data Analysis

By hand first. You worked seventeen case files with a calculator, ran the ten-step workup twice, and wrote the verdict memos. That's the core of the work. Code adds something case studies can't give you at all: a record of your own performance, truthful enough to calibrate against. It also gives you a pipeline that makes the twenty-minute passes repeatable, so the record can build up.

Today's workflow. Three artefacts are worth building and keeping for a whole career.

The first is the pattern layer as a dataset. Give it one row per case, with the play (one to seven), the tells that fired, the class of each tell (ratio, document, gatekeeper action, market price), and the lead time in months before collapse. Once it's data, you can ask it things a table can't answer: which tests cover which plays, and which plays have no test at all. You can also ask for the median lead time of each class of tell in your own sample, instead of a range you half remember.

The second is the workup as a pipeline. Steps 1, 2 and 4 of the workup in section 4.5 are deterministic once you have the input sheet. They cover the spread and the ratio panel, plus the quant screens. They should run in minutes, which leaves your three hours for steps 3, 6, 7 and 8. Those need a human.

The third is the decision journal as a table with probabilities in it. Step 10 asks for confidence, so write it as a number, with the resolution date and the resolution. You can't score a journal of adjectives. You can score a journal of probabilities, and the Quantitative lens shows it works faster than you'd guess.

Tools & sources (IN + US). pandas for the pattern dataset, the panel and the journal; numpy for the calibration arithmetic; the screen functions from section 4.14 of the cash-flow lessons, reused verbatim; India: SEBI orders and settlement schemes, NFRA inspection and debarment orders, NCLT and IBC filings, RBI's divergence disclosures and inspection findings for lenders, the exchanges' Reg 30 disclosures for auditor resignations and KMP exits, the quarterly shareholding pattern for pledge trajectories, MCA21 for the unlisted ecosystem entities, and the annual reports themselves (BSE/NSE); US: the SEC's AAER series and litigation releases, EDGAR full-text search across the whole filer universe for a phrase you have learned to fear, 8-K Item 4.01 for auditor changes, PCAOB inspection reports and enforcement orders, and the case's own 10-Ks read in sequence with the year-over-year text diff you learned with the earnings games.

# Calibration arithmetic for the capstone standard — R3: recomputed in-session
import numpy as np
prec = lambda prior, sens, fpr: prior*sens / (prior*sens + (1-prior)*fpr)
sens, fpr = 0.80, 0.20                               # the module's own >=80% / <20% standard
print([round(prec(p, sens, fpr)*100, 1) for p in (1.00, 0.50, 0.10, 0.02)])
#   [100.0, 80.0, 30.8, 7.5]  -> 80% on a 50/50 exam set becomes 7.5% at a 2% market base rate
n = lambda p, hw: np.ceil(1.96**2 * p*(1-p) / hw**2)
print(n(fpr, 0.05), n(sens, 0.10), n(sens, 0.10)/0.02)
#   246 clean assessments to know your FALSE-POSITIVE rate to +-5 points;
#   62 genuine frauds to know your CATCH rate to +-10 -> ~3,100 company-years of coverage
rng = np.random.default_rng(11)
y = rng.random((20_000, 40)) < 0.20                  # 40 journaled calls a year, true rate 20%
print(round(((0.20-y)**2).mean(), 3), round(((0.70-y)**2).mean(), 3))   # 0.160 vs 0.410 Brier

Verify. The pattern dataset is only as good as its dates, so trace every lead time to the document that made the signal public. If you found a signal in a retrospective article, it wasn't necessarily available at the time. That's the commonest way a case-study exercise flatters a process. Tie every workup panel to the filing itself as step 1 requires. Never tie it to an aggregator. And resolve the journal truthfully. A call that never got a resolution date doesn't count as a call. If you write the resolution after the fact in your own words, it'll drift toward whatever happened. So record the confidence and the resolution date before the outcome exists. Record the strongest innocent explanation then too.

Quantitative lens

The gate here is a calibration standard: catch at least 80% of the plants, with fewer than 20% false positives. The job demands that false positives count as heavily as catches. Two pieces of arithmetic make the standard usable, and neither is comfortable.

Your measured hit rate falls apart in a real universe. A detector with 80% sensitivity and a 20% false-positive rate has a precision that depends entirely on how common frauds are in the set you run it on. It's 100% on the seventeen case files, which are all frauds by construction. It's 80% on a balanced exam set of clean and dirty vignettes. At a 10% prevalence it drops to 30.8%. And at the roughly 2% base rate of a real market, it's 7.5%. Pass the capstone at 80% precision, expect 80% precision at work, and you're out by a factor of 10.6. All of that comes from prevalence. Your skill hasn't changed.

That has two consequences. First, the case files can teach you sensitivity, but they can't teach you specificity. A set with no clean companies in it tells you nothing about how often you cry wolf. That's why the exam mixes clean vignettes in, and why "clean" is a scored answer. Second, when you present a flag at work, talk about evidence and about exposure. Don't talk about the probability of fraud. The language protocol in section 4.1 was already telling you this. Now it has a number attached.

You can only ever measure half of the standard, and it's the half the exam scores hardest. To estimate your own false-positive rate to within ±5 percentage points, at a true rate of 20%, you need about 246 clean-company assessments. That's a few years of careful coverage, and entirely achievable. To estimate your catch rate to within ±10 percentage points at a true 80%, about 62 genuine frauds would have to pass through your coverage. At a 2% base rate that means roughly 3,100 company-years of it. Nobody has that.

For practical purposes you can't measure your catch rate in a whole career. You can measure your false-positive rate in a few years of journaling. That asymmetry is the strongest argument there is for weighting false positives the way the exam does. It also tells you what the decision journal is for. It won't prove you'd have caught Satyam. It measures how often you accused an honest company.

The journal works quickly, if you write numbers in it. Say you make 40 journaled calls a year on situations whose true resolution rate is 20%. If you say 20% and you're right about the rate, your mean Brier score is 0.160, with a 5th-to-95th-percentile range of 0.100 to 0.220. An overconfident analyst who says 70% about the same situations scores 0.410, with a range of 0.370 to 0.450. The two distributions don't overlap. One year of journaled probabilities is enough to tell calibration from mere confidence.

Adjectives cannot do that. "High conviction" has no Brier score.

And you can put a number on the cost of being early. Section 4.1 doesn't hide that flags came one to three years before collapse, or that the people who acted early were attacked and sometimes right too soon to profit. Now price it. Size a short at 5% of capital, and if the stock quadruples against you before it collapses, that position becomes a 20% liability. That's a 15% mark-to-market loss of capital, plus margin calls, plus borrow costs, plus the chance of being closed out at the top. At 10% sizing it's a 30% drawdown. The top rung of the position-response ladder, don't own it at any price you'd call attractive, costs 0% and needs no timing at all. That's why the ladder reads the way it does.

It is also why "would my process have kept me out, small, or demanding answers" is a better standard than "would I have called the fraud."

Now the limits. The 2% base rate is an order-of-magnitude assumption nobody can measure. It's also biased downward by construction, because undetected fraud is missing from every sample. If true prevalence is 5%, deployed precision rises to 17.4%. That's better, and still nothing like 80%. The 80/20 figures are the gate's standard, and they say nothing about where you actually stand. Your real operating point moves with the threshold you choose, the same trade-off you priced when you built the screening harness. The sample-size formulas assume independent assessments. A sector-focused analyst's calls are correlated, so the effective sample is smaller than the count. The Brier illustration assumes one true rate across all calls, and real situations differ. Scoring a mix of different forecasts properly means splitting the score into calibration and resolution, and a serious journal gets there in time.

None of this arithmetic touches the deepest point, though. Verification logic catches what accrual logic can't. No amount of calibration on ratios will help you against a company that fabricated both legs.

Do it in code: keep the journal as a table with a probability, a resolution date and a resolution; compute your Brier score and your false-positive rate annually; and recompute the deployed precision of your own operating point at your own assumed base rate before you ever quote a hit rate. See G1/QM1.01, G2/QD1.03 and G1/ES1.01.

Where this goes next: galaxy cross-links

• G1 · QM1.01 Probability, Distributions & Estimation: Bayes with prevalence, sample sizes for a rate, and proper scoring rules, which is the formal machinery behind the gate here.
• G1 · ES1.01 Code & Standards: the professional-conduct spine of the three duties in section 4.1: reasonable basis, fair dealing, no material non-public information, and language that distinguishes finding from allegation, stated as a code rather than as advice.
• G2 · QD1.03 Backtesting Engine: point-in-time data, survivorship control and look-ahead discipline: the three ways a retrospective case study lies to you about what was knowable when.
• G2 · DA2.01 Supervised Machine Learning: precision, recall and threshold choice under extreme class imbalance, and why a model's reported accuracy on a curated sample is the same prevalence illusion in a different vocabulary.
• G3 · CN1.03 The So-What: the verdict memo of step 9, conclusion first, evidence beneath, and the discipline of saying what would change your mind.

Teach it back & journal

Feynman prompt. Write a one-page explainer for a smart 15-year-old titled "How to tell when a company is lying about its money." You must use three of the stories above. Pick from the company whose "cash" earned less interest than a savings account (Satyam), the company whose biggest bill quietly moved to a different page (WorldCom), and the coffee chain caught by people counting cups (Luckin). End with your five-numbers-and-three-notes routine, in words a teenager could actually follow. No jargon allowed: if you can't explain the cash-yield test without the word "accrual," you don't own it yet.

Journal reflection. Open your decision journal and write the false-positive ledger entry for the week: (1) your timed-exam score, meaning catches, misses and false alarms, and what each false alarm reveals about your personal bias (perhaps you over-trust growth stories, over-punish promoters, or anchor on sectors); (2) the one case among the seventeen that would most likely have fooled you at the time, and the honest reason why; (3) the single check from your capstone workups that you came closest to skipping, and what it found; and (4) one sentence you commit to writing in every future memo when the evidence is L1–L2 aggression rather than fraud. Date it. Phase 8's rapid-analysis system will ask you to reread this entry before every teardown.

This module's flashcards and mastery quiz are wired into the app: see the node's Quiz and Reviews.