Institutional & Financial Due Diligence (Continued); Risks & Controls: Areas of Internal Controls

Layout of Presentation
Institutional & Financial Due Diligence. Continued from Session 1.
Risks & Controls. Understanding the risk-control tangle.
Internal Controls. Areas of internal controls that donors examine closely.
Part 1: Institutional & Financial Due Diligence (Continued)
Two Pillars of Pre-Grant Due Diligence
Institutional Due Diligence
Is the organisation legitimate, well governed, and capable of delivering the programme?
Constitutional: legal registration & regulatory compliance
Statutory registrations & regulatory compliance
Governance
Mission fit
Policies & procedures
Programmatic track record & M&E systems
Visibility
Past donor relationships and references
Financial Due Diligence
Can the organisation be trusted to receive, manage and report on donor funds accurately?
Annual financial statements: state of financial health & progress
Audit and assurance
Internal financial controls
Budgeting
Grant management
Banking arrangements
Accounting systems
Risk management
Institutional Due Diligence 2A: The 3 Labour Codes: Compliance Checklist
Comp structure as per definition of "Wage" (Code on Wages) aligned with SS benefits. Revisit and revise existing comp structure
Applicability of Minimum Wages, Payment of Wages provisions to NGOs
Mandatory coverage of NGOs under ESI provisions
Mandatory registration and insurance for gratuity, if covered
A new flexi-hiring category: Fixed Term Employment (FTE); only regular/permanent and FTE are permitted HR-engagement categories
Engagement of contract labour in 'core activity' is prohibited
Employee vs. worker classification: EL, overtime and comp-off applicable to "worker" category
Mandatory appointment letter, wage slip as per template in state rules
Labour Identification No. (LIN) registration
Annual leave provisions for workers
PT registration and S&E licence continue as per state Acts; they co-exist
Health, safety and welfare provisions as per OSH standards
Institutional Due Diligence 2A: Statutory & Regulatory Registration (Continued)
PAN, TAN
TAN: deduction/collection and deposit of tax at source
Incorporation date on PAN and registration certificate must match
For a Section 8 company, the CIN, PAN and TAN are allotted on issue of the COI
GSTIN
Registration required for making 'taxable supply' beyond threshold
Notification 12/2017 exempts an org registered under Section 12A undertaking a charitable activity as defined under GST
Understanding what constitutes a taxable supply matters: it can jeopardise charitable status itself
CSR funders need not set up service contracts or insist on GST/TDS since grants are not a taxable supply under the GST Act
NITI Aayog's NGO Darpan
UIN and updating information on the Darpan portal. Mandatory for seeking government grants, FCRA registration and reporting, opening/updating local and FC bank accounts (bank/FI to conform under PMLA), and 80G approval.
DPDP Act, 2023
Prepare a policy on digital personal data protection as per the DPDP Act and Rules; full rollout of Act and Rules from 1st May 2027
Map personal data collected: beneficiaries, donors, volunteers, staff
Prepare a privacy notice and consent form as Data Fiduciary
Use technology to handle access, correction and erasure requests from the Data Principal
Identify a contact person for grievances and data-protection queries
Review contracts with vendors: payment gateways, CRMs, cloud hosts
Put basic security measures in place: access control, backups, encryption
Prepare a data-breach response plan with reporting timelines as per DPDP
Train staff who handle personal data: compliance, programme, finance
Registration with Social Stock Exchange (SSE)
To register and list securities of NPOs on the SSE
Valid for 3 years, extendable by 1 more year by the SSE
Institutional Due Diligence 2B(i): Statutory & Regulatory Reporting Compliance
Income Tax: Annual Filing
Form 112: audit report (earlier 10B / 10BB), by 30th Sep
Form ITR-7: income tax return, by 31st Oct
Form 113: statement of donation (earlier 10BD), by 31st May
Form 114: donation receipt / certificate (earlier 10BE), by 31st May
Form 108, 109: deemed application / accumulation (9A, 10 earlier) for shortfall in 85% utilisation, before filing ITR-7
Form 145, 146: for remittance abroad (Form 15CA, 15CB earlier), before remittance
Income Tax Proceedings
IT assessment: Section 270
FCRA
Annual Return in Form FC-4 with increased disclosures: digital footprints, detailed activity report, publication details, etc.
Changes via Forms FC-6A to 6F: name, objects, FC bank, key functionary, scope of registration (new Form FC-6F)
New Form FC-3BB for subsequent instalment under Prior Permission
GST
Monthly or quarterly statement of outward supply: GSTR-1
Monthly or quarterly return: GSTR-3B, Annual GST Return
TDS, SSE, Labour Codes
TDS/TCS: monthly challan, quarterly return; new form numbers under ITR 2026
SSE: Annual disclosure (within 60 days) and Social Impact Report (31st Oct) per SEBI's LODR, for registered and listed NPOs
Labour Codes: Annual Return under OSHWC Code by 31st Jan for a CY; EPF ECR filing & Annual Return; ESIC challan by 15th of following month & six-monthly return; PT and S&E Act reporting as per state requirement
Institutional Due Diligence 2B(ii): Constitution-Related Compliance Reporting
Annual reporting to the registration authority differs by legal form:
Trust
To Charity Commissioner as per the Trust Act for the specific state
Where there is no separate state trust act, there is no annual reporting requirement
Society
Differs by state but generally requires annual reporting of the Governing Body list as at the AGM
Audited financials as approved by the general body to the RoS/designated officer in the respective state
Section 8 Company
e-Form AOC-4 (audited financial statement, within 30 days of AGM)
MGT-7 (Annual Return, within 60 days of AGM; AGM on or before 30 Sept)
ADT-1 (auditor appointment, 15 days from AGM)
Director KYC DIR-3: once every 3 years (by 30 June)
Institutional Due Diligence 3: Governance
Governance is about fiduciary duty (trust) and risk management.
Constitution documents lay down governance structure (general body/governing body). These must align with byelaws for a society, trust deed for a trust, and AOA for a Section 8 company
Understanding and compliance with rules & regulations relating to:
Memberships, tenure, re-election for general & governing bodies
Meetings, quorum, notice, minutes
Conflict of interest: diluting fiduciary duty
Clear roles and responsibilities (powers and duties) of General Body, Governing Body and executive management to ensure:
Governance oversight: activities aligned with established frameworks
Organogram and reporting lines
Delegation: sub-committees and reporting
Institutional Due Diligence 4: Mission, Vision & Core Values
These state the purpose of an organisation's existence, its culture and direction. This helps donors assess mission alignment with their funding priorities and goals.
Mission
The organisation's purpose, and how it differentiates itself from others. A mission statement should be specific and indicate how the organisation will meet the needs of its stakeholders.
Vision
The organisation's future goals and what it hopes to achieve. A vision statement sets the direction for the organisation to meet its mission.
Core Values
The organisation's core principles and ethics, and how people should behave. Core values define the organisation's defining features and shape its culture.
Where donors find mission alignment: constitutional documents, strategic plan, logical frameworks/theory of change, operational geographies, themes/objects, Annual Reports.
Institutional Due Diligence 5: Policies & Procedures
Statutory
PoSH: The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013
Apprentices Act, 1961
Child protection: Protection of Children from Sexual Offences (POCSO) Act, 2012
Vulnerable Adults Act, 2018
Others
Finance & admin: travel, procurement
HR
DE&I (diversity, equity and inclusion) policy
Code of business conduct / ethics, Whistleblower
Conflict of interest
Risk management
IT
Personal Digital Data Protection policy
Anti-bribery, anti-corruption, lobbying, Terrorism financing: for US grants, Blocked Persons List
Formulation, revision, implementation in letter and spirit to demonstrate a robust internal-controls framework. Policies should facilitate action and are therefore dynamic documents as the organisation evolves. Policies & Procedures must be in simple language, easy to understand and followed by all staff categories. That is key.
Institutional Due Diligence 6: Visibility & Reputational
Website: place statutory registrations, AFS (both conso and FC) and AR for 3 years
Social media presence for demonstrating scale and delivery of services
Partnerships and collaboration: strategic
Awards
Accreditations
Publications
Testimonials
Intellectual property: trademarks, patents, etc.
Address and contact details including registered office: does it match statutory documents?
Name and contact details of Chief Functionary or point of contact
IEC demonstrating ecosystem engagement and innovation in approach and interventions
FC Annual reporting now requires detailing visibility and publications annually.
Institutional Due Diligence 7: Programmatic Capacity & Track Record
Donors look for demonstrated delivery experience of a similar scale and nature: evidence that the NGO can execute, not just plan, the proposed intervention.
Documents / evidence reviewed
Past project reports and completion certificates
Technical expertise / sectoral specialisation
Existing infrastructure and field presence
What donors assess
Beneficiary reach and outcome data over past 3 to 5 years
Third-party evaluations or case studies
Institutional Due Diligence 8: Monitoring, Evaluation & Learning (MEL)
A credible MEL system shows the NGO can track its own performance and course-correct, giving donors confidence that outcomes will be measured and reported accurately and reliably.
Documents / evidence reviewed
MEL framework and indicator tracking tools
Data collection and quality-assurance processes
Reporting formats used for past donors
What donors assess
Baseline / midline / endline study practices
Grievance redressal for beneficiaries: DPDP Act
Institutional Due Diligence 9: Past Donor Relationships & References
A track record of well-managed grants, and donors willing to vouch for the NGO, is one of the strongest institutional signals available in due diligence.
Documents / evidence reviewed
List of current and past donors / grant sizes
History of grant compliance / any past red flags
Media coverage or public reputation review
What donors assess
Donor reference checks and recommendation letters
Co-funding and partnership arrangements
Financial Due Diligence 1: Annual Financial Statements
Provide insights and assurance on the state of financial health and financial progress, spending patterns and credibility of accounting practices.
Trust and Society to use format of financial statements prescribed by ASB, ICAI from 1.4.2025
Annual financials are top-level disclosure to various stakeholders on the pulse (present) and direction (future) of an org
Donors generally insist on 3 financial years' FS to understand build-up and observe trends/progression
Separate financial statements for FC operations
Understand your annual audited financials. At times leadership struggles to read and interpret them although they are signatories
Key Components of Audited Financial Statements
Balance Sheet: liabilities and assets of an org as at a point in time
Unrestricted / own funds: corpus, reserves & surplus / net asset (excess of income over expenditure)
Restricted funds: unutilised grants
Loans and borrowings
Current liabilities and provisions
Investments: corpus, accumulation
Fixed assets
Cash and bank
Deposits and debtors (receivables): grants receivable
I&E Statement (during a time period)
Grants and donations: trend, expansion of donor base, excessive cash donations/subscriptions
Other income: interest, rent, business incidental
Expenditure heads: presentation based on functional (why) and not natural (what) heads
Surplus / deficit
R&P (Cash) Statement
Movement of inflow and outflow of cash
Accounting Policies and Notes to Accounts
Most organisations do not pay attention; very often it is not included in financial statements. Accounting policy exhibits the standards followed for arriving at and presenting items of financial statements (ICAI-prescribed) so they are standard, comparable and consistent. Notes to accounts are management's explanatory notes for important items, for clarifying to the reader.
What Donors Look for in Audited Financials
Size and trend of organisation
How much net assets or free reserves are available
Level of investments
Fixed assets, particularly land and building
Level of cash
Unutilised grant or grant receivable amounts and trends
Proportion of grant and other income
Breakdown of expenses: programme vs admin
Current assets other than cash vs current liabilities
Donors now demand a 3-year projected fund-flow statement for visibility
Financial Due Diligence 2: Audit & Assurance
Type of audit conducted for NPOs: Statutory (as required by Income Tax law); Internal (depending on size and stage of evolution); Donor (as per grant contract conditions); FCRA (undertaken by MHA); C&AG (mainly for govt and semi-govt entities)
Formal appointment of statutory auditors by General Body with a formal engagement contract
Audit process: periodicity, MRL, ML, ATR, independent auditor's report and qualifications if any, UDIN no. from ICAI's UDIN portal
Red flags, adverse observations, litigations, etc. pointed out in audit reports
Assurance undertaken: broader range of subjects
Audit and assurance are proxy indicators for donors on red flags for taking funding decisions
Period of association of auditor: rotation once every 3 to 5 years is critical