Internal controls are a growth tool, not a burden
Internal controls are the routines that make sure transactions are authorised, recorded correctly and protected from misuse. For a growing business they are not paperwork for its own sake: they are what lets the owner step back from checking every voucher.
Where the law requires them
- Under section 134(5)(e) of the Companies Act, 2013, directors of listed companies state that internal financial controls are adequate and operating effectively.
- Under section 143(3)(i), the statutory auditor reports on the adequacy and operating effectiveness of internal financial controls over financial reporting, for companies other than the small private companies that are exempt.
- CARO 2020 asks the auditor about specific areas such as inventory, fixed assets, loans and fraud.
Five controls that matter most in a mid-sized business
- Approval limits. Written limits on who can approve purchases, payments and credit notes, applied in the accounting system.
- Segregation of duties. The person who creates a vendor or customer master does not approve payments to it.
- Monthly reconciliations. Bank, GST (books with GSTR-1, GSTR-3B and GSTR-2B), TDS (books with Form 26AS, now Form 168), and inter-company balances, reviewed and signed off.
- Inventory and asset checks. Periodic physical verification, with differences investigated and approved before adjustment.
- Access control. Individual user IDs, removal of access for staff who leave, and a log of changes to masters.
How to start
Map the key processes (purchase to pay, order to cash, payroll, inventory), list what can go wrong in each, and record the control that prevents or detects it. Test a few transactions to see whether the control actually operates. A controls review before a fundraise, a bank renewal or the statutory audit usually saves weeks of questions later.
See our internal audit page.