Institutional & Financial Due Diligence (Continued); Risks & Controls: Areas of Internal Controls

Layout of Presentation

Institutional & Financial Due Diligence. Continued from Session 1.
Risks & Controls. Understanding the risk-control tangle.
Internal Controls. Areas of internal controls that donors examine closely.

Part 1: Institutional & Financial Due Diligence (Continued)

Two Pillars of Pre-Grant Due Diligence

Institutional Due Diligence

Is the organisation legitimate, well governed, and capable of delivering the programme?

Constitutional: legal registration & regulatory compliance
Statutory registrations & regulatory compliance
Governance
Mission fit
Policies & procedures
Programmatic track record & M&E systems
Visibility
Past donor relationships and references

Financial Due Diligence

Can the organisation be trusted to receive, manage and report on donor funds accurately?

Annual financial statements: state of financial health & progress
Audit and assurance
Internal financial controls
Budgeting
Grant management
Banking arrangements
Accounting systems
Risk management

Institutional Due Diligence 2A: The 3 Labour Codes: Compliance Checklist

Comp structure as per definition of "Wage" (Code on Wages) aligned with SS benefits. Revisit and revise existing comp structure
Applicability of Minimum Wages, Payment of Wages provisions to NGOs
Mandatory coverage of NGOs under ESI provisions
Mandatory registration and insurance for gratuity, if covered
A new flexi-hiring category: Fixed Term Employment (FTE); only regular/permanent and FTE are permitted HR-engagement categories
Engagement of contract labour in 'core activity' is prohibited
Employee vs. worker classification: EL, overtime and comp-off applicable to "worker" category
Mandatory appointment letter, wage slip as per template in state rules
Labour Identification No. (LIN) registration
Annual leave provisions for workers
PT registration and S&E licence continue as per state Acts; they co-exist
Health, safety and welfare provisions as per OSH standards

Institutional Due Diligence 2A: Statutory & Regulatory Registration (Continued)

PAN, TAN

TAN: deduction/collection and deposit of tax at source
Incorporation date on PAN and registration certificate must match
For a Section 8 company, the CIN, PAN and TAN are allotted on issue of the COI

GSTIN

Registration required for making 'taxable supply' beyond threshold
Notification 12/2017 exempts an org registered under Section 12A undertaking a charitable activity as defined under GST
Understanding what constitutes a taxable supply matters: it can jeopardise charitable status itself
CSR funders need not set up service contracts or insist on GST/TDS since grants are not a taxable supply under the GST Act

NITI Aayog's NGO Darpan

UIN and updating information on the Darpan portal. Mandatory for seeking government grants, FCRA registration and reporting, opening/updating local and FC bank accounts (bank/FI to conform under PMLA), and 80G approval.

DPDP Act, 2023

Prepare a policy on digital personal data protection as per the DPDP Act and Rules; full rollout of Act and Rules from 1st May 2027
Map personal data collected: beneficiaries, donors, volunteers, staff
Prepare a privacy notice and consent form as Data Fiduciary
Use technology to handle access, correction and erasure requests from the Data Principal
Identify a contact person for grievances and data-protection queries
Review contracts with vendors: payment gateways, CRMs, cloud hosts
Put basic security measures in place: access control, backups, encryption
Prepare a data-breach response plan with reporting timelines as per DPDP
Train staff who handle personal data: compliance, programme, finance

Registration with Social Stock Exchange (SSE)

To register and list securities of NPOs on the SSE
Valid for 3 years, extendable by 1 more year by the SSE

Institutional Due Diligence 2B(i): Statutory & Regulatory Reporting Compliance

Income Tax: Annual Filing

Form 112: audit report (earlier 10B / 10BB), by 30th Sep
Form ITR-7: income tax return, by 31st Oct
Form 113: statement of donation (earlier 10BD), by 31st May
Form 114: donation receipt / certificate (earlier 10BE), by 31st May
Form 108, 109: deemed application / accumulation (9A, 10 earlier) for shortfall in 85% utilisation, before filing ITR-7
Form 145, 146: for remittance abroad (Form 15CA, 15CB earlier), before remittance

Income Tax Proceedings

IT assessment: Section 270

FCRA

Annual Return in Form FC-4 with increased disclosures: digital footprints, detailed activity report, publication details, etc.
Changes via Forms FC-6A to 6F: name, objects, FC bank, key functionary, scope of registration (new Form FC-6F)
New Form FC-3BB for subsequent instalment under Prior Permission

GST

Monthly or quarterly statement of outward supply: GSTR-1
Monthly or quarterly return: GSTR-3B, Annual GST Return

TDS, SSE, Labour Codes

TDS/TCS: monthly challan, quarterly return; new form numbers under ITR 2026
SSE: Annual disclosure (within 60 days) and Social Impact Report (31st Oct) per SEBI's LODR, for registered and listed NPOs
Labour Codes: Annual Return under OSHWC Code by 31st Jan for a CY; EPF ECR filing & Annual Return; ESIC challan by 15th of following month & six-monthly return; PT and S&E Act reporting as per state requirement

Institutional Due Diligence 2B(ii): Constitution-Related Compliance Reporting

Annual reporting to the registration authority differs by legal form:

Trust

To Charity Commissioner as per the Trust Act for the specific state
Where there is no separate state trust act, there is no annual reporting requirement

Society

Differs by state but generally requires annual reporting of the Governing Body list as at the AGM
Audited financials as approved by the general body to the RoS/designated officer in the respective state

Section 8 Company

e-Form AOC-4 (audited financial statement, within 30 days of AGM)
MGT-7 (Annual Return, within 60 days of AGM; AGM on or before 30 Sept)
ADT-1 (auditor appointment, 15 days from AGM)
Director KYC DIR-3: once every 3 years (by 30 June)

Institutional Due Diligence 3: Governance

Governance is about fiduciary duty (trust) and risk management.

Constitution documents lay down governance structure (general body/governing body). These must align with byelaws for a society, trust deed for a trust, and AOA for a Section 8 company
Understanding and compliance with rules & regulations relating to:
- Memberships, tenure, re-election for general & governing bodies
- Meetings, quorum, notice, minutes
- Conflict of interest: diluting fiduciary duty
Clear roles and responsibilities (powers and duties) of General Body, Governing Body and executive management to ensure:
- Governance oversight: activities aligned with established frameworks
- Organogram and reporting lines
- Delegation: sub-committees and reporting

Institutional Due Diligence 4: Mission, Vision & Core Values

These state the purpose of an organisation's existence, its culture and direction. This helps donors assess mission alignment with their funding priorities and goals.

Mission

The organisation's purpose, and how it differentiates itself from others. A mission statement should be specific and indicate how the organisation will meet the needs of its stakeholders.

Vision

The organisation's future goals and what it hopes to achieve. A vision statement sets the direction for the organisation to meet its mission.

Core Values

The organisation's core principles and ethics, and how people should behave. Core values define the organisation's defining features and shape its culture.

Where donors find mission alignment: constitutional documents, strategic plan, logical frameworks/theory of change, operational geographies, themes/objects, Annual Reports.

Institutional Due Diligence 5: Policies & Procedures

Statutory

PoSH: The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013
Apprentices Act, 1961
Child protection: Protection of Children from Sexual Offences (POCSO) Act, 2012
Vulnerable Adults Act, 2018

Others

Finance & admin: travel, procurement
HR
DE&I (diversity, equity and inclusion) policy
Code of business conduct / ethics, Whistleblower
Conflict of interest
Risk management
IT
Personal Digital Data Protection policy
Anti-bribery, anti-corruption, lobbying, Terrorism financing: for US grants, Blocked Persons List

Formulation, revision, implementation in letter and spirit to demonstrate a robust internal-controls framework. Policies should facilitate action and are therefore dynamic documents as the organisation evolves. Policies & Procedures must be in simple language, easy to understand and followed by all staff categories. That is key.

Institutional Due Diligence 6: Visibility & Reputational

Website: place statutory registrations, AFS (both conso and FC) and AR for 3 years
Social media presence for demonstrating scale and delivery of services
Partnerships and collaboration: strategic
Awards
Accreditations
Publications
Testimonials
Intellectual property: trademarks, patents, etc.
Address and contact details including registered office: does it match statutory documents?
Name and contact details of Chief Functionary or point of contact
IEC demonstrating ecosystem engagement and innovation in approach and interventions

FC Annual reporting now requires detailing visibility and publications annually.

Institutional Due Diligence 7: Programmatic Capacity & Track Record

Donors look for demonstrated delivery experience of a similar scale and nature: evidence that the NGO can execute, not just plan, the proposed intervention.

Documents / evidence reviewed

Past project reports and completion certificates
Technical expertise / sectoral specialisation
Existing infrastructure and field presence

What donors assess

Beneficiary reach and outcome data over past 3 to 5 years
Third-party evaluations or case studies

Institutional Due Diligence 8: Monitoring, Evaluation & Learning (MEL)

A credible MEL system shows the NGO can track its own performance and course-correct, giving donors confidence that outcomes will be measured and reported accurately and reliably.

Documents / evidence reviewed

MEL framework and indicator tracking tools
Data collection and quality-assurance processes
Reporting formats used for past donors

What donors assess

Baseline / midline / endline study practices
Grievance redressal for beneficiaries: DPDP Act

Institutional Due Diligence 9: Past Donor Relationships & References

A track record of well-managed grants, and donors willing to vouch for the NGO, is one of the strongest institutional signals available in due diligence.

Documents / evidence reviewed

List of current and past donors / grant sizes
History of grant compliance / any past red flags
Media coverage or public reputation review

What donors assess

Donor reference checks and recommendation letters
Co-funding and partnership arrangements

Financial Due Diligence 1: Annual Financial Statements

Provide insights and assurance on the state of financial health and financial progress, spending patterns and credibility of accounting practices.

Trust and Society to use format of financial statements prescribed by ASB, ICAI from 1.4.2025
Annual financials are top-level disclosure to various stakeholders on the pulse (present) and direction (future) of an org
Donors generally insist on 3 financial years' FS to understand build-up and observe trends/progression
Separate financial statements for FC operations
Understand your annual audited financials. At times leadership struggles to read and interpret them although they are signatories

Key Components of Audited Financial Statements

Balance Sheet: liabilities and assets of an org as at a point in time

Unrestricted / own funds: corpus, reserves & surplus / net asset (excess of income over expenditure)
Restricted funds: unutilised grants
Loans and borrowings
Current liabilities and provisions
Investments: corpus, accumulation
Fixed assets
Cash and bank
Deposits and debtors (receivables): grants receivable

I&E Statement (during a time period)

Grants and donations: trend, expansion of donor base, excessive cash donations/subscriptions
Other income: interest, rent, business incidental
Expenditure heads: presentation based on functional (why) and not natural (what) heads
Surplus / deficit

R&P (Cash) Statement

Movement of inflow and outflow of cash

Accounting Policies and Notes to Accounts

Most organisations do not pay attention; very often it is not included in financial statements. Accounting policy exhibits the standards followed for arriving at and presenting items of financial statements (ICAI-prescribed) so they are standard, comparable and consistent. Notes to accounts are management's explanatory notes for important items, for clarifying to the reader.

What Donors Look for in Audited Financials

Size and trend of organisation
How much net assets or free reserves are available
Level of investments
Fixed assets, particularly land and building
Level of cash
Unutilised grant or grant receivable amounts and trends
Proportion of grant and other income
Breakdown of expenses: programme vs admin
Current assets other than cash vs current liabilities
Donors now demand a 3-year projected fund-flow statement for visibility

Financial Due Diligence 2: Audit & Assurance

Type of audit conducted for NPOs: Statutory (as required by Income Tax law); Internal (depending on size and stage of evolution); Donor (as per grant contract conditions); FCRA (undertaken by MHA); C&AG (mainly for govt and semi-govt entities)
Formal appointment of statutory auditors by General Body with a formal engagement contract
Audit process: periodicity, MRL, ML, ATR, independent auditor's report and qualifications if any, UDIN no. from ICAI's UDIN portal
Red flags, adverse observations, litigations, etc. pointed out in audit reports
Assurance undertaken: broader range of subjects
Audit and assurance are proxy indicators for donors on red flags for taking funding decisions
Period of association of auditor: rotation once every 3 to 5 years is critical