Institutional & Financial Due Diligence (Continued); Risks & Controls: Areas of Internal Controls

Layout of Presentation

1. Institutional & Financial Due Diligence. Continued from Session 1.
2. Risks & Controls. Understanding the risk-control tangle.
3. Internal Controls. Areas of internal controls that donors examine closely.

Part 1: Institutional & Financial Due Diligence (Continued)

Two Pillars of Pre-Grant Due Diligence

Institutional Due Diligence

Is the organisation legitimate, well governed, and capable of delivering the programme?

• Constitutional: legal registration & regulatory compliance
• Statutory registrations & regulatory compliance
• Governance
• Mission fit
• Policies & procedures
• Programmatic track record & M&E systems
• Visibility
• Past donor relationships and references

Financial Due Diligence

Can the organisation be trusted to receive, manage and report on donor funds accurately?

• Annual financial statements: state of financial health & progress
• Audit and assurance
• Internal financial controls
• Budgeting
• Grant management
• Banking arrangements
• Accounting systems
• Risk management

Institutional Due Diligence 2A: The 3 Labour Codes: Compliance Checklist

• Comp structure as per definition of "Wage" (Code on Wages) aligned with SS benefits. Revisit and revise existing comp structure
• Applicability of Minimum Wages, Payment of Wages provisions to NGOs
• Mandatory coverage of NGOs under ESI provisions
• Mandatory registration and insurance for gratuity, if covered
• A new flexi-hiring category: Fixed Term Employment (FTE); only regular/permanent and FTE are permitted HR-engagement categories
• Engagement of contract labour in 'core activity' is prohibited
• Employee vs. worker classification: EL, overtime and comp-off applicable to "worker" category
• Mandatory appointment letter, wage slip as per template in state rules
• Labour Identification No. (LIN) registration
• Annual leave provisions for workers
• PT registration and S&E licence continue as per state Acts; they co-exist
• Health, safety and welfare provisions as per OSH standards

Institutional Due Diligence 2A: Statutory & Regulatory Registration (Continued)

PAN, TAN

• TAN: deduction/collection and deposit of tax at source
• Incorporation date on PAN and registration certificate must match
• For a Section 8 company, the CIN, PAN and TAN are allotted on issue of the COI

GSTIN

• Registration required for making 'taxable supply' beyond threshold
• Notification 12/2017 exempts an org registered under Section 12A undertaking a charitable activity as defined under GST
• Understanding what constitutes a taxable supply matters: it can jeopardise charitable status itself
• CSR funders need not set up service contracts or insist on GST/TDS since grants are not a taxable supply under the GST Act

NITI Aayog's NGO Darpan

UIN and updating information on the Darpan portal. Mandatory for seeking government grants, FCRA registration and reporting, opening/updating local and FC bank accounts (bank/FI to conform under PMLA), and 80G approval.

DPDP Act, 2023

• Prepare a policy on digital personal data protection as per the DPDP Act and Rules; full rollout of Act and Rules from 1st May 2027
• Map personal data collected: beneficiaries, donors, volunteers, staff
• Prepare a privacy notice and consent form as Data Fiduciary
• Use technology to handle access, correction and erasure requests from the Data Principal
• Identify a contact person for grievances and data-protection queries
• Review contracts with vendors: payment gateways, CRMs, cloud hosts
• Put basic security measures in place: access control, backups, encryption
• Prepare a data-breach response plan with reporting timelines as per DPDP
• Train staff who handle personal data: compliance, programme, finance

Registration with Social Stock Exchange (SSE)

• To register and list securities of NPOs on the SSE
• Valid for 3 years, extendable by 1 more year by the SSE

Institutional Due Diligence 2B(i): Statutory & Regulatory Reporting Compliance

Income Tax: Annual Filing

• Form 112: audit report (earlier 10B / 10BB), by 30th Sep
• Form ITR-7: income tax return, by 31st Oct
• Form 113: statement of donation (earlier 10BD), by 31st May
• Form 114: donation receipt / certificate (earlier 10BE), by 31st May
• Form 108, 109: deemed application / accumulation (9A, 10 earlier) for shortfall in 85% utilisation, before filing ITR-7
• Form 145, 146: for remittance abroad (Form 15CA, 15CB earlier), before remittance

Income Tax Proceedings

• IT assessment: Section 270

FCRA

• Annual Return in Form FC-4 with increased disclosures: digital footprints, detailed activity report, publication details, etc.
• Changes via Forms FC-6A to 6F: name, objects, FC bank, key functionary, scope of registration (new Form FC-6F)
• New Form FC-3BB for subsequent instalment under Prior Permission

GST

• Monthly or quarterly statement of outward supply: GSTR-1
• Monthly or quarterly return: GSTR-3B, Annual GST Return

TDS, SSE, Labour Codes

• TDS/TCS: monthly challan, quarterly return; new form numbers under ITR 2026
• SSE: Annual disclosure (within 60 days) and Social Impact Report (31st Oct) per SEBI's LODR, for registered and listed NPOs
• Labour Codes: Annual Return under OSHWC Code by 31st Jan for a CY; EPF ECR filing & Annual Return; ESIC challan by 15th of following month & six-monthly return; PT and S&E Act reporting as per state requirement

Institutional Due Diligence 2B(ii): Constitution-Related Compliance Reporting

Annual reporting to the registration authority differs by legal form:

Trust

• To Charity Commissioner as per the Trust Act for the specific state
• Where there is no separate state trust act, there is no annual reporting requirement

Society

• Differs by state but generally requires annual reporting of the Governing Body list as at the AGM
• Audited financials as approved by the general body to the RoS/designated officer in the respective state

Section 8 Company

• e-Form AOC-4 (audited financial statement, within 30 days of AGM)
• MGT-7 (Annual Return, within 60 days of AGM; AGM on or before 30 Sept)
• ADT-1 (auditor appointment, 15 days from AGM)
• Director KYC DIR-3: once every 3 years (by 30 June)

Institutional Due Diligence 3: Governance

Governance is about fiduciary duty (trust) and risk management.

• Constitution documents lay down governance structure (general body/governing body). These must align with byelaws for a society, trust deed for a trust, and AOA for a Section 8 company
• Understanding and compliance with rules & regulations relating to:
  • Memberships, tenure, re-election for general & governing bodies
  • Meetings, quorum, notice, minutes
  • Conflict of interest: diluting fiduciary duty
• Clear roles and responsibilities (powers and duties) of General Body, Governing Body and executive management to ensure:
  • Governance oversight: activities aligned with established frameworks
  • Organogram and reporting lines
  • Delegation: sub-committees and reporting

Institutional Due Diligence 4: Mission, Vision & Core Values

These state the purpose of an organisation's existence, its culture and direction. This helps donors assess mission alignment with their funding priorities and goals.

Mission

The organisation's purpose, and how it differentiates itself from others. A mission statement should be specific and indicate how the organisation will meet the needs of its stakeholders.

Vision

The organisation's future goals and what it hopes to achieve. A vision statement sets the direction for the organisation to meet its mission.

Core Values

The organisation's core principles and ethics, and how people should behave. Core values define the organisation's defining features and shape its culture.

Where donors find mission alignment: constitutional documents, strategic plan, logical frameworks/theory of change, operational geographies, themes/objects, Annual Reports.

Institutional Due Diligence 5: Policies & Procedures

Statutory

• PoSH: The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013
• Apprentices Act, 1961
• Child protection: Protection of Children from Sexual Offences (POCSO) Act, 2012
• Vulnerable Adults Act, 2018

Others

• Finance & admin: travel, procurement
• HR
• DE&I (diversity, equity and inclusion) policy
• Code of business conduct / ethics, Whistleblower
• Conflict of interest
• Risk management
• IT
• Personal Digital Data Protection policy
• Anti-bribery, anti-corruption, lobbying, Terrorism financing: for US grants, Blocked Persons List

Formulation, revision, implementation in letter and spirit to demonstrate a robust internal-controls framework. Policies should facilitate action and are therefore dynamic documents as the organisation evolves. Policies & Procedures must be in simple language, easy to understand and followed by all staff categories. That is key.

Institutional Due Diligence 6: Visibility & Reputational

• Website: place statutory registrations, AFS (both conso and FC) and AR for 3 years
• Social media presence for demonstrating scale and delivery of services
• Partnerships and collaboration: strategic
• Awards
• Accreditations
• Publications
• Testimonials
• Intellectual property: trademarks, patents, etc.
• Address and contact details including registered office: does it match statutory documents?
• Name and contact details of Chief Functionary or point of contact
• IEC demonstrating ecosystem engagement and innovation in approach and interventions

FC Annual reporting now requires detailing visibility and publications annually.

Institutional Due Diligence 7: Programmatic Capacity & Track Record

Donors look for demonstrated delivery experience of a similar scale and nature: evidence that the NGO can execute, not just plan, the proposed intervention.

Documents / evidence reviewed

• Past project reports and completion certificates
• Technical expertise / sectoral specialisation
• Existing infrastructure and field presence

What donors assess

• Beneficiary reach and outcome data over past 3 to 5 years
• Third-party evaluations or case studies

Institutional Due Diligence 8: Monitoring, Evaluation & Learning (MEL)

A credible MEL system shows the NGO can track its own performance and course-correct, giving donors confidence that outcomes will be measured and reported accurately and reliably.

Documents / evidence reviewed

• MEL framework and indicator tracking tools
• Data collection and quality-assurance processes
• Reporting formats used for past donors

What donors assess

• Baseline / midline / endline study practices
• Grievance redressal for beneficiaries: DPDP Act

Institutional Due Diligence 9: Past Donor Relationships & References

A track record of well-managed grants, and donors willing to vouch for the NGO, is one of the strongest institutional signals available in due diligence.

Documents / evidence reviewed

• List of current and past donors / grant sizes
• History of grant compliance / any past red flags
• Media coverage or public reputation review

What donors assess

• Donor reference checks and recommendation letters
• Co-funding and partnership arrangements

Financial Due Diligence 1: Annual Financial Statements

Provide insights and assurance on the state of financial health and financial progress, spending patterns and credibility of accounting practices.

• Trust and Society to use format of financial statements prescribed by ASB, ICAI from 1.4.2025
• Annual financials are top-level disclosure to various stakeholders on the pulse (present) and direction (future) of an org
• Donors generally insist on 3 financial years' FS to understand build-up and observe trends/progression
• Separate financial statements for FC operations
• Understand your annual audited financials. At times leadership struggles to read and interpret them although they are signatories

Key Components of Audited Financial Statements

Balance Sheet: liabilities and assets of an org as at a point in time

• Unrestricted / own funds: corpus, reserves & surplus / net asset (excess of income over expenditure)
• Restricted funds: unutilised grants
• Loans and borrowings
• Current liabilities and provisions
• Investments: corpus, accumulation
• Fixed assets
• Cash and bank
• Deposits and debtors (receivables): grants receivable

I&E Statement (during a time period)

• Grants and donations: trend, expansion of donor base, excessive cash donations/subscriptions
• Other income: interest, rent, business incidental
• Expenditure heads: presentation based on functional (why) and not natural (what) heads
• Surplus / deficit

R&P (Cash) Statement

• Movement of inflow and outflow of cash

Accounting Policies and Notes to Accounts

• Most organisations do not pay attention; very often it is not included in financial statements. Accounting policy exhibits the standards followed for arriving at and presenting items of financial statements (ICAI-prescribed) so they are standard, comparable and consistent. Notes to accounts are management's explanatory notes for important items, for clarifying to the reader.

What Donors Look for in Audited Financials

• Size and trend of organisation
• How much net assets or free reserves are available
• Level of investments
• Fixed assets, particularly land and building
• Level of cash
• Unutilised grant or grant receivable amounts and trends
• Proportion of grant and other income
• Breakdown of expenses: programme vs admin
• Current assets other than cash vs current liabilities
• Donors now demand a 3-year projected fund-flow statement for visibility

Financial Due Diligence 2: Audit & Assurance

• Type of audit conducted for NPOs: Statutory (as required by Income Tax law); Internal (depending on size and stage of evolution); Donor (as per grant contract conditions); FCRA (undertaken by MHA); C&AG (mainly for govt and semi-govt entities)
• Formal appointment of statutory auditors by General Body with a formal engagement contract
• Audit process: periodicity, MRL, ML, ATR, independent auditor's report and qualifications if any, UDIN no. from ICAI's UDIN portal
• Red flags, adverse observations, litigations, etc. pointed out in audit reports
• Assurance undertaken: broader range of subjects
• Audit and assurance are proxy indicators for donors on red flags for taking funding decisions
• Period of association of auditor: rotation once every 3 to 5 years is critical