# Startup Financial Controls: Approvals, Duties, Review cycle Published: 13 Oct 2026 Author: Treelife Practice area: Finance Tags: approval matrix, audit trail, internal financial controls, month end reconciliation, review cycle, segregation of duties, startup financial controls Source: https://treelife.in/finance/startup-financial-controls/ ## Summary - A written approval matrix tying spending authority to transaction value is a core financial control every Indian startup needs. - Segregation of duties requires that no single person can initiate, approve and record the same payment. - Accounting software used by companies must maintain a non-disableable audit trail under the proviso to Rule 3(1) of the Companies (Accounts) Rules 2014, effective from 01/04/2023. - A fixed review cycle should include weekly cash checks, monthly close and reconciliation, and a quarterly compliance check. - Control gaps typically widen by company stage: up to 10 employees often means a single bank login and no vendor master, while 10 to 40 employees often lacks an approval matrix and role-based software access. - At 40 to 100 employees, close commonly slips past the 15th with no reconciliation sign-off, requiring a close calendar with a named reviewer and cut-off dates. - Investor diligence typically probes three control questions: who can release a payment without dual authorisation, when each bank account was last reconciled and signed off, and where approvals exist for the largest vendor payments. - The Companies Act 2013 places responsibility for internal financial controls on both the board and the statutory auditor. - Startups should build preventive, detective and corrective controls together, underpinned by a control environment set by the founder and board. --- Blog Content Overview - [0.1 What are the essential financial controls for a startup?](#What_are_the_essential_financial_controls_for_a_startup) - [1 Why startup financial controls break before the audit does](#Why_startup_financial_controls_break_before_the_audit_does) [1.1 What types of financial controls does a startup need?](#What_types_of_financial_controls_does_a_startup_need) - [2 How do you build an approval matrix for a startup?](#How_do_you_build_an_approval_matrix_for_a_startup) [2.1 Which bank controls back up the matrix?](#Which_bank_controls_back_up_the_matrix) - [2.2 What should happen when a payment is urgent?](#What_should_happen_when_a_payment_is_urgent) - [2.3 How should corporate cards, reimbursements and petty cash be controlled?](#How_should_corporate_cards_reimbursements_and_petty_cash_be_controlled) - [2.4 Who approves contracts, hiring and investor reserved matters?](#Who_approves_contracts_hiring_and_investor_reserved_matters) - [2.5 Who holds the keys: DSC tokens, portal logins and bank concentration?](#Who_holds_the_keys_DSC_tokens_portal_logins_and_bank_concentration) - [3 How do you set up segregation of duties when the finance team is two people?](#How_do_you_set_up_segregation_of_duties_when_the_finance_team_is_two_people) [3.1 Which master data and system access controls matter most?](#Which_master_data_and_system_access_controls_matter_most) - [4 What review cycle should a startup run, from daily checks to the board pack?](#What_review_cycle_should_a_startup_run_from_daily_checks_to_the_board_pack) [4.1 Which control checks sit inside the monthly close?](#Which_control_checks_sit_inside_the_monthly_close) - [4.2 How should the board use the numbers?](#How_should_the_board_use_the_numbers) - [5 What does Indian law expect from startup financial controls?](#What_does_Indian_law_expect_from_startup_financial_controls) [5.1 Does the controls exemption mean a small startup can skip internal financial controls?](#Does_the_controls_exemption_mean_a_small_startup_can_skip_internal_financial_controls) - [5.2 How do you document and test controls for an auditor or an investor?](#How_do_you_document_and_test_controls_for_an_auditor_or_an_investor) - [6 How do you implement startup financial controls in 90 days?](#How_do_you_implement_startup_financial_controls_in_90_days) [6.1 Days 1 to 30: map the current state and lock access](#Days_1_to_30_map_the_current_state_and_lock_access) - [6.2 Days 31 to 60: write and enforce the matrix](#Days_31_to_60_write_and_enforce_the_matrix) - [6.3 Days 61 to 90: run the cycle and test it](#Days_61_to_90_run_the_cycle_and_test_it) - [6.4 How much control is too much for a startup?](#How_much_control_is_too_much_for_a_startup) - [7 Common mistakes that cost founders time and money](#Common_mistakes_that_cost_founders_time_and_money) - [8 Frequently asked questions](#Frequently_asked_questions) Startup financial controls decide whether a founder learns about a wrong payment, a duplicate vendor or a missed TDS deposit within a day or only at the statutory audit. In India the question is no longer optional. Investors ask for control evidence in diligence, the Companies Act 2013 puts internal financial controls on the board and the auditor, and accounting software has had to keep a non-disableable edit log since 01/04/2023. This guide covers an approval matrix, segregation of duties for small teams and a review calendar you can start next month. ### What are the essential financial controls for a startup? The essential financial controls for a startup are a written approval matrix that ties spending authority to value, segregation of duties so that no one person initiates, approves and records the same payment, and a fixed review cycle (weekly cash, monthly close and reconciliation, quarterly compliance check). Companies using accounting software must also keep a non-disableable audit trail under the proviso to Rule 3(1), Companies (Accounts) Rules 2014. ## Why startup financial controls break before the audit does Controls break at startups because the person who builds the company also approves, pays and records its spending, and nobody is paid to notice. The gap is rarely fraud. It is usually a founder approving on WhatsApp, one net banking login shared across the team, and a month end that waits for the CA. Each gap costs little to close at 10 people and a great deal at 60. The pattern repeats across the engagements we see. A company starts with one accountant on Tally or Zoho Books, a CA who files returns, and a founder who clears payments. That setup works until the first diligence request, the first statutory audit or the first employee who leaves with an unreconciled advance. The failure is then discovered by someone outside the company, which is the most expensive way to discover it. **Typical control gaps by stage (stage bands are indicative, not a regulatory classification)** StageWhat usually existsGap that surfacesFirst fixUp to 10 peopleFounder holds net banking, reimbursements settled on chatSingle login, no vendor master, no payment evidenceDual authorisation at the bank, vendor master kept by the accountant10 to 40 peopleOne accountant, CA on retainer, accounting softwareSame person creates vendors, posts bills and releases paymentsApproval matrix, role-based access in the software40 to 100 peopleFinance manager, expense tool, monthly MISClose slips past the 15th, no reconciliation sign-offClose calendar with named reviewer and cut-off datesAudit scaleStatutory audit, board packAuditor asks for documented internal financial controlsWritten control framework tested quarterly Three questions from investor diligence expose most of these gaps within an hour: - Who can release a payment from the bank account without a second person? - When was each bank account last reconciled, and who signed it off? - Where is the approval for the five largest vendor payments of last quarter? A company that cannot answer these from system records, rather than from memory, has a controls problem that no amount of clean MIS will hide. The rest of this guide builds the answers in order: who approves what, who is kept apart from whom, and when each layer is reviewed. The wider checklist an investor’s accountant works through is in our [financial due diligence checklist for startups](https://treelife.in/finance/financial-due-diligence-checklist-for-startups/) and our note on [investor due diligence readiness](https://treelife.in/startups/investor-due-diligence-readiness-and-checklist/). ### What types of financial controls does a startup need? A startup needs three types of control working together: preventive controls that stop a wrong transaction, detective controls that find one quickly, and corrective controls that fix the cause. A fourth layer, the control environment set by the founder and the board, decides whether the other three are followed or overridden. **Control types mapped to this guide** Control typePurposeStartup examplesWhere it appears in this guidePreventiveStop an unauthorised or wrong transactionApproval matrix, maker and checker bank roles, role-based software access, vendor master lockApproval matrix and segregation of dutiesDetectiveFind an error or fraud quicklyBank reconciliation, daily debit alerts, audit trail review, vendor-wise payment totalsReview cycleCorrectiveFix the cause and recoverReversal of wrong payments, access removal, policy change after an exception, board reportingCommon mistakes and the fraud FAQControl environmentSet the tone and make overrides visibleWritten policies, override log, whistleblower channel, board review of exceptions90-day plan Auditors read the same structure through the COSO framework, which names five components: control environment, risk assessment, control activities, information and communication, and monitoring. The Institute of Chartered Accountants of India (ICAI) Guidance Note on Audit of Internal Financial Controls Over Financial Reporting draws on COSO-style criteria, so a startup that documents its controls in these terms gives the auditor less to rebuild. In the ACFE sample, 43 percent of frauds were first detected by a tip, which is why a simple channel for employees to raise a concern with a director belongs in the control environment. ## How do you build an approval matrix for a startup? An approval matrix is a one-page table that states who may approve each type of spend at each value band, and who may never approve their own request. Build it from three inputs: the category of spend, the rupee value, and the role of the requester. Then enforce it in the accounting or payments software, not on chat. The matrix below is a starting template. The thresholds are illustrative and must be set against your monthly burn, so that most payments by count sit in the first band and the founder sees only the largest few. **Illustrative approval matrix (thresholds are examples, calibrate to monthly burn)** Spend typeUp to ₹50,000₹50,001 to ₹5 lakhAbove ₹5 lakhVendor invoices within budgetBudget ownerBudget owner and finance leadFinance lead and CEOUnbudgeted spendFinance leadCEOCEO with board intimationEmployee reimbursementsReporting managerReporting manager and finance leadProcessed as a vendor payment, not a reimbursementCapex and annual software subscriptionsFinance leadCEOCEO with board approvalRefunds, credit notes, write-offsFinance leadCEOCEO with board approval Five rules make the matrix work in practice: - The approver is never the requester and never the person who releases the payment. - Approval is recorded in the system against the bill or request, so the audit trail shows who approved and when. - Invoices split to stay under a band are treated as one spend. The finance lead checks vendor-wise totals weekly. - Any change to a vendor’s bank account needs a call-back to a number already on file, by someone other than the requester. - Loans, advances or payments to directors and related entities sit outside the matrix. They go to the board, because Sections 185, 186 and 188 of the Companies Act 2013 may require board and shareholder approval depending on the transaction. Payroll deserves its own line because it is usually the largest monthly outflow. HR prepares the payroll sheet, finance reviews the variance against the previous month, and the CEO or a second director releases the payment. Any change to salary, bank details or headcount in the sheet needs a written approval that predates the run. ### Which bank controls back up the matrix? A matrix on paper means little if one person can log in, add a beneficiary and release the money. The bank mandate must mirror the matrix, with a board resolution naming the authorised signatories and their limits. - Maker and checker roles on corporate net banking, with the initiator unable to authorise. - Per-transaction and daily limits by user, set lower for the maker than for the checker. - A cooling period or second approval for any new beneficiary. - Separate credentials per person, with no shared logins and no OTPs forwarded to a colleague. - A monthly review of user access, removing leavers the same week they exit. ### What should happen when a payment is urgent? Urgency is the most common reason controls are overridden, and override accounted for 19 percent of the frauds in the ACFE sample cited earlier. Give urgent payments a faster path, not an exemption. - Two approvers are still required, and one may approve by recorded call or message that the finance lead files the same day. - A hard cap applies per emergency payment, set by the CEO. Anything above it waits for the normal path. - Every override is logged with the reason, approvers and amount, and ratified at the next weekly payment review. - The count and value of overrides go into the quarterly board pack. A rising count means the matrix needs fixing, not the people. ### How should corporate cards, reimbursements and petty cash be controlled? Cards, reimbursements and petty cash are small-value, high-count channels that sit outside the vendor payment flow, so they need their own limits. - Cards: individual limits by role, merchant category blocks where the card supports them, receipts uploaded within a fixed window, and statements reviewed by someone other than the cardholder. - Reimbursements: a written policy with category limits, mandatory bills, a claim window and no self-approval. Founder expenses follow the same policy. - GST credit: input tax credit needs a valid tax invoice in the company’s name and GSTIN (Section 16, Central Goods and Services Tax Act 2017), so a reimbursement backed only by a retail receipt can cost the company the credit. Our guide to [GST compliance for startups](https://treelife.in/compliance/gst-compliance-for-startups/) covers the credit conditions. - Petty cash: a fixed imprest, a weekly count by a second person, and replenishment only against vouchers. - Personal spends: none paid from the company account. They turn into director advance questions under Sections 185 and 186 of the Companies Act 2013, and our note on [related party transactions under Section 188](https://treelife.in/compliance/related-party-transactions-section-188/) covers the neighbouring rules. ### Who approves contracts, hiring and investor reserved matters? Payments are one part of delegated authority. A full delegation of authority also states who may sign contracts, approve hires and grant ESOPs, and which decisions go to the board or to an investor. - Contracts: signing authority by contract value and term, with finance sign-off on payment terms and auto-renewal clauses. - Hiring: headcount approved in the budget, with offers above a set band approved by the CEO and the finance lead. - ESOP grants: approved by the board or its compensation committee, never by a manager. Many shareholders’ agreements give investors affirmative rights over items such as budget deviations, borrowings, related party transactions and large capex. The list differs by deal, so read your agreement and add one row to the matrix for each reserved matter, with a rule that written investor consent comes before board or management approval. A breach of a reserved matter is a breach of the shareholders’ agreement, not only of an internal policy. Record board decisions as resolutions in the proper form, and see our guide to [board resolution formats](https://treelife.in/compliance/board-resolution-formats-for-company/). ### Who holds the keys: DSC tokens, portal logins and bank concentration? Control over cash is only part of control over the company. Three Indian specifics are often missed. - Digital signature certificate (DSC) tokens of directors are used for filings with the Ministry of Corporate Affairs and for some tax filings. Keep a custody register, do not leave tokens with one accountant, and collect them when anyone leaves. - Statutory portal logins for MCA, GST, income tax and TRACES should sit on company-owned email addresses and phone numbers that a director can reach, not on an employee’s personal ones. Change credentials and recovery details when a user with access exits. - Bank concentration: deposit insurance from the [Deposit Insurance and Credit Guarantee Corporation (DICGC)](https://www.dicgc.org.in) covers up to ₹5 lakh per depositor per bank, so a company that keeps its whole runway in one bank carries uninsured exposure. A short treasury policy should set a minimum of two banks, a cap per bank and the permitted instruments. ## How do you set up segregation of duties when the finance team is two people? Segregation of duties means no single person controls authorisation, custody, recording and reconciliation of the same transaction. A two-person team cannot separate all four, so separate the riskiest pair first, which is releasing payments and creating or editing vendors, and cover the rest with compensating controls that a founder or outside reviewer operates. Start by listing the four functions for each cycle: purchase to pay, order to cash, payroll, and treasury. Then mark every case where one login can perform two functions in the same cycle. Those are your conflicts. Both Tally Prime and Zoho Books let you create user roles with restricted permissions, so the first fix is usually configuration, not hiring. **Conflict matrix for a small finance team** Duty pair that should not sit togetherWhy it is a riskFix for a team of two or threeCreate or edit vendor and release paymentA fictitious or altered vendor can be paid without a second pair of eyesAccountant maintains the vendor master, a different user releases payments, founder gets a monthly new-vendor listPost bills and reconcile the bankErrors and diversions are hidden by the same person who recorded themReconciliation prepared by the accountant, reviewed and signed by the finance lead or outsourced CFOPrepare payroll and release payrollGhost employees and inflated salariesHR prepares, finance reviews variance, a director releasesHold petty cash and record petty cashCash shortfalls booked as expensesImprest limit, weekly count by a second person, no petty cash above a fixed capRaise sales invoices and collect or adjust receiptsCredit notes used to cover diverted collectionsCredit notes approved by the finance lead, collections go to a bank account the invoicer cannot operate When true separation is impossible, document the compensating control next to the conflict. The usual set is short: - The founder holds a read-only bank login and checks every debit above a set value against an approval. - Bank alerts for all debits go to a second person’s phone and email. - An independent person, often an outsourced accountant or a [virtual CFO](https://treelife.in/services/virtual-cfo/), prepares or reviews the monthly bank reconciliation. - Duties rotate, and each processor takes at least one continuous leave a year so that someone else sees the work. - The audit trail report from the accounting software is reviewed monthly, not only when the auditor asks. Do not claim separation you do not have. A written matrix that says two people are kept apart, when one of them also holds the other’s password, is worse than an honest note that a compensating control applies. Auditors and diligence teams test the access list, not the policy document. ### Which master data and system access controls matter most? Segregation on paper fails if one person can change the master data that drives payments, so treat vendor, employee and customer master changes as controlled events. - Every change to a vendor or employee bank account is logged, approved by a second person and confirmed by a call-back to a number already on file. - A new vendor needs a GST registration check, a PAN and a cancelled cheque or bank letter before the first payment. - Admin rights on the accounting, payroll and banking tools sit with one named person who has no transaction authority. - Multi-factor authentication is on for banking, accounting, payroll and email, and leavers lose access on their last day. - A quarterly access review compares the user list in each tool with the current staff list and the approval matrix. The invoice compliance side of payables, including three-way match, invoice management system review, e-invoice IRN validation, reverse charge and MSME ageing, is covered in our guide to [vendor and client invoice management](https://treelife.in/finance/vendor-and-client-invoice-management-as-part-of-a-cfo-retainer/). This guide stays on who may approve and release. If you suspect that segregation has already failed, our overview of [forensic accounting in India](https://treelife.in/finance/forensic-accounting-in-india/) explains when an independent review is warranted. ## What review cycle should a startup run, from daily checks to the board pack? A workable review cycle has five layers: daily cash visibility, a weekly payment run, a monthly close with reconciliation, a quarterly compliance and access review, and an annual audit and board cycle. Each layer needs a named owner and a dated sign-off, because a review that leaves no evidence cannot be shown to an investor or an auditor. **Review calendar for a 10 to 40 person company (owners and close targets are suggestions, statutory dates are cited)** FrequencyReviewOwnerEvidence keptDailyBank balances and debit alerts matched to approved paymentsFinance leadAlert log, exceptions noteWeeklyPayment run approved, vendor-wise totals, 13-week cash forecastFinance lead, CEOApproved payment file, forecast versionMonthlyBank, wallet and payment gateway reconciliations, close by working day 5, budget versus actualAccountant prepares, finance lead signsSigned reconciliations, MIS packMonthlyTDS deposit by the 7th (Rule 218, Income-tax Rules 2026), GST returns under Section 39 of the CGST Act 2017, PF and ESI by the 15thFinance leadChallans and filing acknowledgementsQuarterlyTDS returns, user access review on bank and software, approval exceptions, aged payables and receivablesFinance lead, CEOReturn acknowledgements, access list with sign-offAnnualStatutory audit, AOC-4 and MGT-7 filing, budget approval, matrix refreshBoard, CEO, auditorBoard minutes, filed forms The statutory entries in this calendar follow the due dates in force as of 13/10/2026. GST due dates differ for taxpayers under the quarterly return scheme, and PF and ESI dates should be confirmed against current EPFO and ESIC circulars before you adopt the calendar. The 13-week forecast in the weekly row is built step by step in our [cash flow forecasting guide](https://treelife.in/finance/cash-flow-forecasting-for-startups/), and TDS deposit and return mechanics are in our guide to [TDS and TCS compliance](https://treelife.in/compliance/tds-and-tcs-compliance-in-india/). This guide covers only who reviews each item and what evidence they keep. ### Which control checks sit inside the monthly close? The day-by-day accounting close is covered in our [month end close checklist for startups](https://treelife.in/startups/month-end-close-checklist-for-startups/). This guide adds only the control layer that sits on top of it: - Lock the prior period after the reviewer signs, so back-dated entries need an approval. - Have bank, gateway and wallet reconciliations prepared and reviewed by different people, with differences explained line by line. - Review the audit trail report for edits to closed periods and to approved bills. - Log the month’s exceptions and overrides and share the log with the CEO. The reviewer in steps 1 and 2 must differ from the preparer. If that is not possible, the sign-off moves up to a director or an outsourced reviewer. ### How should the board use the numbers? A quarterly board pack should carry five control items next to the financials: cash runway, budget versus actual, approvals above the top band, statutory dues paid or overdue, and open audit or reconciliation points. Boards that see only revenue and burn miss the control signals, and the directors carry the responsibility under Section 166(3) of the Companies Act 2013 to act with due care. Related reading: [MIS reports for startups](https://treelife.in/finance/mis-reports-for-startups/) shows how to turn the monthly close into a board-ready pack. ## What does Indian law expect from startup financial controls? Indian law expects a private company to keep books with a non-disableable audit trail, to report on the adequacy of internal financial controls in the board report, to meet tax deposit deadlines, and, once past a size threshold, to have the statutory auditor give an opinion on those controls. No single statute prescribes an approval matrix, so the matrix is how you evidence compliance with several provisions at once. **Statutory hooks for startup financial controls (as of 13/10/2026)** ProvisionApplies toWhat it requiresWhat it means in practiceSection 143(3)(i), Companies Act 2013Statutory auditor of every company, unless exemptAuditor reports on adequacy and operating effectiveness of internal financial controls over financial reportingNeeds a documented control framework and test evidenceMCA notification dated 13/06/2017One person company, small company, private company with turnover below ₹50 crore and borrowings below ₹25 croreExempts them from the auditor’s controls opinion, if no default in filing under Sections 137 and 92Exemption is lost in the year either limit is crossedRule 8(5)(viii), Companies (Accounts) Rules 2014Board report of companiesBoard report states details of internal financial controls and their adequacyDirectors need evidence behind the sentence they signProviso to Rule 3(1), Companies (Accounts) Rules 2014Every company using accounting software, FY commencing on or after 01/04/2023Audit trail of each transaction, edit log with dates, audit trail cannot be disabledSwitch on and protect the edit log in the accounting systemRule 11(g), Companies (Audit and Auditors) Rules 2014Statutory auditorAuditor reports whether the audit trail operated throughout the yearEvidence that nobody disabled or tampered with itSection 143(12) with Rule 13, Audit RulesStatutory auditorFraud of ₹1 crore or more reported to the Central Government, smaller frauds reported to the board or audit committeeFraud discovered by the auditor becomes a board matterSection 393, Income-tax Act 2025 with Rule 218, Income-tax Rules 2026Every deductor, from 01/04/2026TDS deposited by the 7th of the following month, March deductions by 30 AprilPolicies citing old Section 194C or 194J need renumbering Section 134(5)(e) of the Companies Act 2013, which requires a director’s responsibility statement on internal financial controls, applies to listed companies and is not a direct obligation for most private startups. The Companies (Accounts) Rules 2014 also require daily back-up of electronic books on servers located in India (Rule 3(5)), which matters if your accounting tool is hosted abroad. ### Does the controls exemption mean a small startup can skip internal financial controls? No. The exemption removes only the auditor’s separate opinion under Section 143(3)(i). It does not remove the board’s reporting duty, the audit trail rule, TDS and GST discipline, or a director’s duty of care under Section 166(3) of the Companies Act 2013. Two points need care before you rely on the exemption. First, the sources we reviewed state that the turnover and borrowings conditions are cumulative, and MCA clarified this in July 2017. Confirm the position against the notification text on the [MCA portal](https://www.mca.gov.in) before you file, because secondary summaries disagree. Second, classification of venture debt, convertible instruments and loans from non-bank lenders as borrowings from banks or financial institutions is a judgement call. Agree the treatment with your statutory auditor early in the year, not at sign-off. The Companies (Auditor’s Report) Order 2020 (CARO 2020), issued under Section 143(11), adds reporting on matters including fraud (clause 3(xi)) and the internal audit system (clause 3(xiv)). Private companies below the prescribed size limits are exempt, so confirm applicability for your balance sheet in the current year. Where the accounting system is a SaaS product, ask the vendor for written confirmation that the audit trail is on and cannot be switched off. Auditors will ask for it, and a vendor answer that arrives in week one of the audit costs time. ### How do you document and test controls for an auditor or an investor? Document each control as one row in a risk and control matrix, then test a sample every quarter and record the result. The matrix is what an auditor asks for first when the Section 143(3)(i) opinion applies, and what an investor’s accountant reads first when it does not. **Sample risk and control matrix rows (extend to every cycle)** Control IDRiskControlFrequencyOwnerEvidencePTP-01Payment released without approvalMaker and checker roles at the bank, release only against an approved payment fileEach payment runFinance leadBank approval log, approved filePTP-02Fictitious or altered vendorVendor master changes approved by a second person and confirmed by call-backEach changeFinance leadChange log, call-back noteFCR-01Errors hidden in the booksBank reconciliation prepared and reviewed by different peopleMonthlyAccountant, finance leadSigned reconciliationSTAT-01TDS or GST deposited lateStatutory calendar with owner and backup, challans matched to booksMonthlyFinance leadChallans, filing acknowledgements Auditors test both design and operation. A control that is well designed but was not run for the year fails the second test. To test operation, pick a sample from the period (all payments above the top band, plus a random set below it), trace each to its approval, and record exceptions with a remediation owner. Sample sizes are a practice choice and the auditor will set their own. Grade findings as control deficiencies, significant deficiencies or material weaknesses, which are the terms used in auditing standards and the ICAI guidance, so that the board sees severity and not just a list. For how this differs from the work of an internal auditor, see our note on the [difference between internal audit and statutory audit](https://treelife.in/finance/difference-between-internal-audit-and-statutory-audit/). ## How do you implement startup financial controls in 90 days? Implement in three blocks of 30 days: first map the current state and lock access, then write and switch on the approval matrix and role design, then start the review cycle and test it once. The order matters because access and bank controls remove the largest risk quickly, while policy documents on their own change nothing. ### Days 1 to 30: map the current state and lock access - List every bank account, payment gateway, wallet, corporate card and accounting or payroll login, with the name of each user. - Remove shared logins, leavers and unused users. Move every bank account to maker and checker roles with separate credentials. - Pass a board resolution on the bank mandate, signatories and limits. - Turn on the audit trail or edit log in the accounting software and confirm it cannot be disabled by ordinary users. - Clean the vendor master: remove duplicates, verify bank details against invoices, and mark who last changed each record. ### Days 31 to 60: write and enforce the matrix - Draft the approval matrix with the CEO, using last year’s payments to set value bands. - Configure approval workflows and user roles in the accounting or expense software so the matrix is enforced by the system. - Write the conflict matrix for purchase to pay, order to cash, payroll and treasury, with a compensating control beside each conflict you cannot remove. - Issue a short expense and reimbursement policy that states what is claimable and what proof is needed. - Update tax and compliance policies for the Income-tax Act 2025 section numbering that applies from 01/04/2026. ### Days 61 to 90: run the cycle and test it - Run the first full monthly close using the checklist, with signed reconciliations. - Hold the first weekly payment run with documented approvals. - Test a sample of 25 payments from the last quarter against the matrix and record exceptions. The sample size is a practical suggestion, not a statutory figure. - Present the first control items to the board, including exceptions found and fixes agreed. - Set the next review dates: quarterly access review, six-monthly matrix refresh, annual framework test before the audit. Ownership should be explicit. The CEO sponsors the framework and approves the matrix. The finance lead owns operation and evidence. The board receives exceptions each quarter. An outsourced finance partner can prepare the first draft and run the independent review in the first two cycles, after which an internal reviewer can take over. ### How much control is too much for a startup? The test is whether a control stops a loss you could actually suffer at your size. A 15-person company does not need a purchase order for every subscription or three levels of approval on a ₹10,000 payment, and copying a large-company control set is the quickest way to make teams route around the system. Three signs show that controls have outgrown the company: - Approvers cannot respond within one working day, so requests move to chat. - Urgent overrides run past a handful each month. - A control has no named owner and no evidence. The remedy is to cut back to the controls that guard cash, master data, payroll and statutory dues, then add the rest as headcount and spend grow. The cost of the first layer is mostly configuration time on tools you already pay for, such as your accounting software and banking portal, so fix the design before you buy anything new. ## Common mistakes that cost founders time and money Most control failures at growth-stage companies come from five habits, all of which are cheaper to fix in the first year than after a diligence finding or an audit qualification. - **Approving on chat or by phone.** It happens because it is fast. The approval then exists only in a message thread, which is not linked to the bill, cannot be queried and disappears when a phone is replaced. Approve inside the accounting or expense tool, or forward the approval email to a dedicated mailbox that the finance lead files against the transaction. - **One person holds every bank credential.** It happens because the founder opened the accounts and never delegated. The risk is both fraud and key-person failure when that person is travelling or unwell. Move to maker and checker roles, with a board resolution that names signatories and limits. - **Reading the controls exemption as permission to skip controls.** The exemption under the MCA notification of 13/06/2017 covers only the auditor’s opinion on internal financial controls. The board report, the audit trail rule and investor diligence still ask for evidence. Plan the controls before turnover nears ₹50 crore or borrowings near ₹25 crore, so that the first audited year with an opinion is not the first year of design. - **Leaving TDS and GST deposits to one person’s memory.** It happens because the dates feel routine. A late TDS deposit carries interest from the date of deduction, not from the due date (Section 398(3)(a), Income-tax Act 2025). Put the 7th and the GST dates in the weekly payment run, with the finance lead as owner and the CEO as backup. - **Copying a foreign controls template.** Templates written for other markets assume cheques, ACH and their own reporting rules. An Indian company needs the Companies Act hooks, UPI and NEFT or RTGS payment controls, TDS and GST checkpoints, and the audit trail rule in the same document. Adapt any template to your own cycle before adopting it. ## Frequently asked questions **Q: What is the minimum approval matrix a 10-person startup needs?** A: Two value bands and two approvers. Below a set value (₹50,000 is an illustrative figure) the budget owner approves, and above it the budget owner and the finance lead or CEO approve. Add one rule that nobody approves their own request or releases a payment they approved, and record every approval in the system. **Q: Can the founder approve and release the same payment?** A: Only as a documented exception. A founder who approves and releases the same payment removes the second pair of eyes. If this is unavoidable in a two-person team, a second director should receive the bank alert and review all such payments each month. **Q: How long does it take to implement startup financial controls?** A: About 90 days for a company of 10 to 40 people, which is our working estimate and not a regulatory timeline. Access and bank controls take the first 30 days, the matrix and roles the next 30, and the first monthly close and test the last 30. A longer timeline usually reflects untidy books, not complex controls. **Q: Which documents should be ready for investor diligence on controls?** A: Six items cover most requests: the board resolution on bank mandate and signatories, the signed approval matrix, 12 months of bank reconciliations, the vendor master with its change log, TDS challans and returns, and an export of the accounting software audit trail. GST returns and payroll statutory filings usually follow. **Q: Is a private company required to have internal financial controls under the Companies Act 2013?** A: Directors are answerable for adequate controls, and the board report must address them under Rule 8(5)(viii) of the Companies (Accounts) Rules 2014. The explicit director’s statement in Section 134(5)(e) applies to listed companies. The auditor’s separate opinion under Section 143(3)(i) may be exempt for smaller private companies. **Q: When does the auditor’s internal financial controls opinion become mandatory for a private company?** A: When turnover is ₹50 crore or more, or borrowings from banks or financial institutions reach ₹25 crore or more at any time in the year, or when the company has defaulted in filing under Section 137 or Section 92. The exemption comes from the MCA notification of 13/06/2017. Confirm the conditions against the notification text. **Q: Is the audit trail mandatory in Tally or Zoho Books?** A: Yes, for any company that keeps books in accounting software, for financial years commencing on or after 01/04/2023 (proviso to Rule 3(1), Companies (Accounts) Rules 2014). The edit log must record each change with its date and must not be capable of being disabled. The auditor reports on this under Rule 11(g) of the Companies (Audit and Auditors) Rules 2014. Books kept manually are outside the rule. **Q: Which tax dates belong in the control calendar?** A: TDS deposit by the 7th of the following month, with March deductions due by 30 April (Rule 218, Income-tax Rules 2026). Add quarterly TDS returns, which fall due on 31/10/2026 for the July to September quarter, GST returns under Section 39 of the CGST Act 2017, and PF and ESI contributions. Confirm GST, PF and ESI dates on the official portals before you adopt them. **Q: Do payments to overseas vendors need extra controls?** A: Yes. Add a withholding check under Section 393 of the Income-tax Act 2025 where it applies, the remittance documents your authorised dealer bank requires under the Foreign Exchange Management Act 1999, and a second approval before release. Remittance form numbers changed with the Income-tax Rules 2026, so confirm current forms with your bank. **Q: How do two co-founders share bank authority safely?** A: Make both authorised signatories under a board resolution, and require each to approve the other’s requests. Neither approves their own expenses. Any advance or loan to a founder goes to the board, because Sections 185 and 186 of the Companies Act 2013 may apply. **Q: Does DPIIT recognition change the controls a startup needs?** A: No. Recognition under the Startup India framework carries its own benefits and filings, but it does not relax the audit trail rule, TDS deposit dates or board reporting. Keep the records that support any recognition-linked claim in the same evidence folder as your monthly close. **Q: What should we do if we suspect fraud or misappropriation?** A: Freeze the relevant access first, preserve the audit trail and bank records, and inform the board the same day. Then appoint an independent reviewer. Where the statutory auditor identifies fraud, Section 143(12) of the Companies Act 2013 requires reporting to the board or the Central Government depending on the amount, with ₹1 crore as the line. Settle the employment and criminal law position before any action against an employee. **Q: What do acquirers look for in controls before a share purchase?** A: Whether reported numbers can be traced to bank and approval evidence. Expect questions on revenue cut-off, related party balances, TDS and GST compliance, and control over cash. A clean reconciliation history and locked closed periods shorten this part of diligence. **Q: How should a single-founder or NRI-founder company set up approvals?** A: A private company needs at least two directors (Section 149(1), Companies Act 2013), so the second director is the natural second approver. For an NRI founder abroad, use digital approvals with an India-based finance lead as maker and the founder as checker, subject to the bank’s mandate rules. **Q: How do ESOP exercises fit into financial controls?** A: Treat each exercise as a controlled event. The board approves the allotment, finance confirms the exercise money has been received and reconciled, the allotment is made, and Form PAS-3 is filed within 30 days (Rule 12, Companies (Prospectus and Allotment of Securities) Rules 2014). Perquisite tax is processed through payroll. ### Related posts: - [What Is An Income Statement?](https://treelife.in/finance/what-is-an-income-statement/) - [The Rise & Fall Of Indian IPO’s](https://treelife.in/finance/the-rise-fall-of-indian-ipo/) - [Tyke’s CSOPs: Bridging Startups with Investors or Crossing Regulatory Boundaries?](https://treelife.in/finance/tykes-csops-bridging-startups-with-investors-or-crossing-regulatory-boundaries/) - [Revised Valuation Rules for Angel Tax](https://treelife.in/finance/revised-valuation-rules-for-angel-tax/) --- This is informational content from Treelife. For advice specific to your situation, contact support@treelife.in