# Institutional & Financial Due Diligence (Continued); Risks & Controls: Areas of Internal Controls ## Layout of Presentation 1. **Institutional & Financial Due Diligence.** Continued from Session 1. 2. **Risks & Controls.** Understanding the risk-control tangle. 3. **Internal Controls.** Areas of internal controls that donors examine closely. ## Part 1: Institutional & Financial Due Diligence (Continued) ### Two Pillars of Pre-Grant Due Diligence #### Institutional Due Diligence *Is the organisation legitimate, well governed, and capable of delivering the programme?* - Constitutional: legal registration & regulatory compliance - Statutory registrations & regulatory compliance - Governance - Mission fit - Policies & procedures - Programmatic track record & M&E systems - Visibility - Past donor relationships and references #### Financial Due Diligence *Can the organisation be trusted to receive, manage and report on donor funds accurately?* - Annual financial statements: state of financial health & progress - Audit and assurance - Internal financial controls - Budgeting - Grant management - Banking arrangements - Accounting systems - Risk management ### Institutional Due Diligence 2A: The 3 Labour Codes: Compliance Checklist - Comp structure as per definition of "Wage" (Code on Wages) aligned with SS benefits. Revisit and revise existing comp structure - Applicability of Minimum Wages, Payment of Wages provisions to NGOs - Mandatory coverage of NGOs under ESI provisions - Mandatory registration and insurance for gratuity, if covered - A new flexi-hiring category: Fixed Term Employment (FTE); only regular/permanent and FTE are permitted HR-engagement categories - Engagement of contract labour in 'core activity' is prohibited - Employee vs. worker classification: EL, overtime and comp-off applicable to "worker" category - Mandatory appointment letter, wage slip as per template in state rules - Labour Identification No. (LIN) registration - Annual leave provisions for workers - PT registration and S&E licence continue as per state Acts; they co-exist - Health, safety and welfare provisions as per OSH standards ### Institutional Due Diligence 2A: Statutory & Regulatory Registration (Continued) #### PAN, TAN - TAN: deduction/collection and deposit of tax at source - Incorporation date on PAN and registration certificate must match - For a Section 8 company, the CIN, PAN and TAN are allotted on issue of the COI #### GSTIN - Registration required for making 'taxable supply' beyond threshold - Notification 12/2017 exempts an org registered under Section 12A undertaking a charitable activity as defined under GST - Understanding what constitutes a taxable supply matters: it can jeopardise charitable status itself - CSR funders need not set up service contracts or insist on GST/TDS since grants are not a taxable supply under the GST Act #### NITI Aayog's NGO Darpan UIN and updating information on the Darpan portal. Mandatory for seeking government grants, FCRA registration and reporting, opening/updating local and FC bank accounts (bank/FI to conform under PMLA), and 80G approval. #### DPDP Act, 2023 - Prepare a policy on digital personal data protection as per the DPDP Act and Rules; full rollout of Act and Rules from 1st May 2027 - Map personal data collected: beneficiaries, donors, volunteers, staff - Prepare a privacy notice and consent form as Data Fiduciary - Use technology to handle access, correction and erasure requests from the Data Principal - Identify a contact person for grievances and data-protection queries - Review contracts with vendors: payment gateways, CRMs, cloud hosts - Put basic security measures in place: access control, backups, encryption - Prepare a data-breach response plan with reporting timelines as per DPDP - Train staff who handle personal data: compliance, programme, finance #### Registration with Social Stock Exchange (SSE) - To register and list securities of NPOs on the SSE - Valid for 3 years, extendable by 1 more year by the SSE ### Institutional Due Diligence 2B(i): Statutory & Regulatory Reporting Compliance #### Income Tax: Annual Filing - Form 112: audit report (earlier 10B / 10BB), by 30th Sep - Form ITR-7: income tax return, by 31st Oct - Form 113: statement of donation (earlier 10BD), by 31st May - Form 114: donation receipt / certificate (earlier 10BE), by 31st May - Form 108, 109: deemed application / accumulation (9A, 10 earlier) for shortfall in 85% utilisation, before filing ITR-7 - Form 145, 146: for remittance abroad (Form 15CA, 15CB earlier), before remittance #### Income Tax Proceedings - IT assessment: Section 270 #### FCRA - Annual Return in Form FC-4 with increased disclosures: digital footprints, detailed activity report, publication details, etc. - Changes via Forms FC-6A to 6F: name, objects, FC bank, key functionary, scope of registration (new Form FC-6F) - New Form FC-3BB for subsequent instalment under Prior Permission #### GST - Monthly or quarterly statement of outward supply: GSTR-1 - Monthly or quarterly return: GSTR-3B, Annual GST Return #### TDS, SSE, Labour Codes - TDS/TCS: monthly challan, quarterly return; new form numbers under ITR 2026 - SSE: Annual disclosure (within 60 days) and Social Impact Report (31st Oct) per SEBI's LODR, for registered and listed NPOs - Labour Codes: Annual Return under OSHWC Code by 31st Jan for a CY; EPF ECR filing & Annual Return; ESIC challan by 15th of following month & six-monthly return; PT and S&E Act reporting as per state requirement ### Institutional Due Diligence 2B(ii): Constitution-Related Compliance Reporting *Annual reporting to the registration authority differs by legal form:* #### Trust - To Charity Commissioner as per the Trust Act for the specific state - Where there is no separate state trust act, there is no annual reporting requirement #### Society - Differs by state but generally requires annual reporting of the Governing Body list as at the AGM - Audited financials as approved by the general body to the RoS/designated officer in the respective state #### Section 8 Company - e-Form AOC-4 (audited financial statement, within 30 days of AGM) - MGT-7 (Annual Return, within 60 days of AGM; AGM on or before 30 Sept) - ADT-1 (auditor appointment, 15 days from AGM) - Director KYC DIR-3: once every 3 years (by 30 June) ### Institutional Due Diligence 3: Governance *Governance is about fiduciary duty (trust) and risk management.* - Constitution documents lay down governance structure (general body/governing body). These must align with byelaws for a society, trust deed for a trust, and AOA for a Section 8 company - Understanding and compliance with rules & regulations relating to: - Memberships, tenure, re-election for general & governing bodies - Meetings, quorum, notice, minutes - Conflict of interest: diluting fiduciary duty - Clear roles and responsibilities (powers and duties) of General Body, Governing Body and executive management to ensure: - Governance oversight: activities aligned with established frameworks - Organogram and reporting lines - Delegation: sub-committees and reporting ### Institutional Due Diligence 4: Mission, Vision & Core Values *These state the purpose of an organisation's existence, its culture and direction. This helps donors assess mission alignment with their funding priorities and goals.* #### Mission The organisation's purpose, and how it differentiates itself from others. A mission statement should be specific and indicate how the organisation will meet the needs of its stakeholders. #### Vision The organisation's future goals and what it hopes to achieve. A vision statement sets the direction for the organisation to meet its mission. #### Core Values The organisation's core principles and ethics, and how people should behave. Core values define the organisation's defining features and shape its culture. *Where donors find mission alignment: constitutional documents, strategic plan, logical frameworks/theory of change, operational geographies, themes/objects, Annual Reports.* ### Institutional Due Diligence 5: Policies & Procedures #### Statutory - PoSH: The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 - Apprentices Act, 1961 - Child protection: Protection of Children from Sexual Offences (POCSO) Act, 2012 - Vulnerable Adults Act, 2018 #### Others - Finance & admin: travel, procurement - HR - DE&I (diversity, equity and inclusion) policy - Code of business conduct / ethics, Whistleblower - Conflict of interest - Risk management - IT - Personal Digital Data Protection policy - Anti-bribery, anti-corruption, lobbying, Terrorism financing: for US grants, Blocked Persons List *Formulation, revision, implementation in letter and spirit to demonstrate a robust internal-controls framework. Policies should facilitate action and are therefore dynamic documents as the organisation evolves. Policies & Procedures must be in simple language, easy to understand and followed by all staff categories. That is key.* ### Institutional Due Diligence 6: Visibility & Reputational - Website: place statutory registrations, AFS (both conso and FC) and AR for 3 years - Social media presence for demonstrating scale and delivery of services - Partnerships and collaboration: strategic - Awards - Accreditations - Publications - Testimonials - Intellectual property: trademarks, patents, etc. - Address and contact details including registered office: does it match statutory documents? - Name and contact details of Chief Functionary or point of contact - IEC demonstrating ecosystem engagement and innovation in approach and interventions FC Annual reporting now requires detailing visibility and publications annually. ### Institutional Due Diligence 7: Programmatic Capacity & Track Record *Donors look for demonstrated delivery experience of a similar scale and nature: evidence that the NGO can execute, not just plan, the proposed intervention.* #### Documents / evidence reviewed - Past project reports and completion certificates - Technical expertise / sectoral specialisation - Existing infrastructure and field presence #### What donors assess - Beneficiary reach and outcome data over past 3 to 5 years - Third-party evaluations or case studies ### Institutional Due Diligence 8: Monitoring, Evaluation & Learning (MEL) *A credible MEL system shows the NGO can track its own performance and course-correct, giving donors confidence that outcomes will be measured and reported accurately and reliably.* #### Documents / evidence reviewed - MEL framework and indicator tracking tools - Data collection and quality-assurance processes - Reporting formats used for past donors #### What donors assess - Baseline / midline / endline study practices - Grievance redressal for beneficiaries: DPDP Act ### Institutional Due Diligence 9: Past Donor Relationships & References *A track record of well-managed grants, and donors willing to vouch for the NGO, is one of the strongest institutional signals available in due diligence.* #### Documents / evidence reviewed - List of current and past donors / grant sizes - History of grant compliance / any past red flags - Media coverage or public reputation review #### What donors assess - Donor reference checks and recommendation letters - Co-funding and partnership arrangements ### Financial Due Diligence 1: Annual Financial Statements *Provide insights and assurance on the state of financial health and financial progress, spending patterns and credibility of accounting practices.* - Trust and Society to use format of financial statements prescribed by ASB, ICAI from 1.4.2025 - Annual financials are top-level disclosure to various stakeholders on the pulse (present) and direction (future) of an org - Donors generally insist on 3 financial years' FS to understand build-up and observe trends/progression - Separate financial statements for FC operations - Understand your annual audited financials. At times leadership struggles to read and interpret them although they are signatories #### Key Components of Audited Financial Statements **Balance Sheet: liabilities and assets of an org as at a point in time** - Unrestricted / own funds: corpus, reserves & surplus / net asset (excess of income over expenditure) - Restricted funds: unutilised grants - Loans and borrowings - Current liabilities and provisions - Investments: corpus, accumulation - Fixed assets - Cash and bank - Deposits and debtors (receivables): grants receivable **I&E Statement (during a time period)** - Grants and donations: trend, expansion of donor base, excessive cash donations/subscriptions - Other income: interest, rent, business incidental - Expenditure heads: presentation based on functional (why) and not natural (what) heads - Surplus / deficit **R&P (Cash) Statement** - Movement of inflow and outflow of cash **Accounting Policies and Notes to Accounts** - Most organisations do not pay attention; very often it is not included in financial statements. Accounting policy exhibits the standards followed for arriving at and presenting items of financial statements (ICAI-prescribed) so they are standard, comparable and consistent. Notes to accounts are management's explanatory notes for important items, for clarifying to the reader. #### What Donors Look for in Audited Financials - Size and trend of organisation - How much net assets or free reserves are available - Level of investments - Fixed assets, particularly land and building - Level of cash - Unutilised grant or grant receivable amounts and trends - Proportion of grant and other income - Breakdown of expenses: programme vs admin - Current assets other than cash vs current liabilities - Donors now demand a 3-year projected fund-flow statement for visibility ### Financial Due Diligence 2: Audit & Assurance - Type of audit conducted for NPOs: Statutory (as required by Income Tax law); Internal (depending on size and stage of evolution); Donor (as per grant contract conditions); FCRA (undertaken by MHA); C&AG (mainly for govt and semi-govt entities) - Formal appointment of statutory auditors by General Body with a formal engagement contract - Audit process: periodicity, MRL, ML, ATR, independent auditor's report and qualifications if any, UDIN no. from ICAI's UDIN portal - Red flags, adverse observations, litigations, etc. pointed out in audit reports - Assurance undertaken: broader range of subjects - Audit and assurance are proxy indicators for donors on red flags for taking funding decisions - Period of association of auditor: rotation once every 3 to 5 years is critical