Internal Controls Checklist for Growing Businesses

As a business grows from a founder doing everything to a team of 20, 50 or 100 people, the owner can no longer see every transaction. That is when errors and fraud creep in: duplicate vendor payments, fake employees on payroll, discounts given without approval, stock that disappears. Internal controls are the simple routines that prevent this. They also make audits faster and banks more comfortable.

The five principles

Segregation of duties. No one person should initiate, approve, record and pay a transaction.
Authorisation limits. Clear approval levels by amount.
Documentation. Every transaction is backed by a document: PO, invoice, GRN, approval.
Reconciliation. Regular comparison of records with independent sources: the bank, suppliers, physical stock.
Review. The owner or management looks at reports and exceptions every month.

The checklist

Cash and bank

Two-person authorisation for bank payments above a limit (net banking maker-checker)
Bank reconciliation every month, reviewed by someone other than the person who records payments
Petty cash on an imprest system with a fixed float, counted and reconciled weekly
No cash payments above ₹10,000 to a person in a day (which also avoids income-tax disallowance)
Cheque books and net-banking credentials kept secure, with access removed promptly when staff leave

Purchases and payments

Vendor master changes (new vendor, bank account change) approved by a second person, and bank details verified by phone
Purchase orders for significant purchases, and goods received notes matched to invoices (three-way match)
Duplicate invoice check by vendor and invoice number before payment
Payments only against approved invoices, with TDS deducted
Vendor ledger confirmations at least yearly
GSTR-2B reconciliation monthly, so fake or missing invoices are caught

Sales and receivables

Credit limits for customers, approved by management
Every dispatch backed by an invoice (and an e-way bill or e-invoice where required)
Discounts and credit notes approved by someone other than the salesperson
Debtor ageing reviewed monthly, with follow-up on overdue amounts
Customer receipts go directly to the bank (UPI or bank transfer), not to personal accounts

Payroll

HR (not accounts) maintains the employee master. Additions and exits are approved
Attendance and leave approved by managers before payroll
Salary paid only by bank transfer to the employee’s own account
Monthly payroll variance review (headcount and amount vs last month)
PF, ESI, professional tax and TDS on salary deposited on time

Inventory and fixed assets

Physical stock counts at least quarterly (cycle counts for high-value items)
Stock movements recorded on the system, with godown-wise records
Write-offs of damaged or obsolete stock approved by management
Fixed asset register with tags and periodic physical verification

IT and data

User-wise access to the accounting software, with no shared passwords
Audit trail / edit log enabled (mandatory for companies since 1 April 2023)
Daily backups. Companies must keep backups on servers in India
Multi-factor authentication on bank, GST and income tax portal logins
Staff trained to spot phishing and fake “CEO” payment requests

Statutory compliance

A compliance calendar (GST, TDS, PF/ESI, ROC, income tax), with an owner for each item
Monthly sign-off that all statutory payments and returns are done

Common SME frauds these controls prevent

Vendor bank detail change scams (by email): stopped by phone verification
Ghost employees: stopped by an HR-maintained master and bank-only salary
Teeming and lading (using one customer’s receipt to cover another’s): stopped by direct bank receipts and debtor confirmations
Inflated or fake purchase bills: stopped by the three-way match and GSTR-2B reconciliation
Stock pilferage: stopped by regular counts and access control

Internal audit vs statutory audit

	Internal audit	Statutory audit
Purpose	Evaluate and improve controls, processes and risk management	Opinion on the truth and fairness of financial statements
Scope	Set by management or the board	Set by law and auditing standards
Frequency	Ongoing, quarterly or half-yearly	Annual
Auditor	Employee or an outside CA firm	Independent CA, appointed by shareholders
Report goes to	Management / audit committee	Shareholders (and filed with the ROC)

When internal audit is mandatory (section 138, Companies Act)

A private company must appoint an internal auditor if, in the previous financial year, it had:

turnover of ₹200 crore or more, or
outstanding loans or borrowings from banks or financial institutions above ₹100 crore at any time.

Listed companies and specified unlisted public companies have their own limits. Below these limits, internal audit is optional but valuable, especially for businesses with multiple locations, high cash handling or inventory.

Frequently asked questions

We’re a 10-person business. Isn’t this overkill?
Start with the basics: bank reconciliation, maker-checker on payments, verified vendor bank changes, and a monthly review of P&L and debtors. These four alone prevent most losses.

Who should own internal controls?
The owner or CFO. Accountants run the routines, but someone senior must review the exceptions.

How often should controls be tested?
At least once a year, by an independent person such as an internal auditor or your CA.

Growing fast and worried about leakages? Garvita Jain & Co. reviews your processes, designs practical controls for your size, and carries out internal audits that focus on real risks, not paperwork. Contact us here, or at contact@garvitajainandco.com or +91 98678 16597.

This article is general information based on the law as of November 2026 and is not professional advice.

Sources

Official

Professional / CA publications