Risks & Controls: Areas of Internal Controls; Donor Due Diligence Checklist & Readiness Roadmap

Structure of session

Risks & Controls. Understanding the risk-control tangle.
Internal Controls. Internal control areas that donors examine closely.
Due Diligence Checklist & Readiness Roadmap. Completing the full circle from Session 1.

Two Pillars of Pre-Grant Due Diligence

Institutional Due Diligence

Is the organisation legitimate, well governed, and capable of delivering the programme?

Constitutional: legal registration & regulatory compliance
Statutory registrations & regulatory compliance
Governance
Mission fit
Policies & procedures
Programmatic track record & M&E systems
Visibility
Past donor relationships and references

Financial Due Diligence

Can the organisation be trusted to receive, manage and report on donor funds accurately?

Annual financial statements: state of financial health & progress
Audit and assurance
Internal financial controls
Budgeting
Grant management
Banking arrangements
Accounting systems
Procurement
HR

Part 1: Risks & Controls

Why Understand Risk & Risk Management

Risk is now a must-discuss in the NGO-funder relationship. The idea is how to understand, capture and manage risks
Robust risk management is (a) basic to an effective organisation and (b) ensures better delivery of services to the community
Fundamental concepts: Risk Appetite (willingness to take risk to achieve objectives) and Risk Tolerance (ability/boundary to take risk, i.e. acceptable deviation from risk appetite). Risk appetite is about "taking risk"; risk tolerance is about "controlling risk." Risk appetite denotes risk profile at an aggregate level; risk tolerance applies at activity level, case by case
Risk management is how to bridge the gap between risk appetite and risk tolerance
Understand need for internal controls commensurate with risks being mitigated

Why Risk Management Is Important for NGOs

Financial stability
Operational efficiency
Compliance management
Disciplined planning
Informed decision making
Reputation management
Building trust
Improved communication
Long-term impact & sustainability

Risk: Key Concepts

Threat: A danger in the environment, a potential cause of harm, e.g. legislative changes, technology, competition, inflation, globalisation, etc.
Risk: The probability and potential impact on achievement of objectives while encountering a threat.
Internal & external risks: Internal risks: personnel issues, technology issues, etc. within the organisation. External risks: economic, political, legal, act of God, etc. in the external environment.

Residual risk: the risk which inevitably remains after all reasonable mitigation measures have been taken. No organisation is completely free from risk; the environment will always contain risk.

Types of Risks Facing Organisations

Ethical: Due to unethical behaviour
Operational: Inability to achieve objectives; capacity/competence gaps; funding & access constraints
Financial: Improper financial planning and management
Reputational: Damage to image and reputation
Safety: Accident / illness
Security: Violence / crime
Fiduciary: Breach of trust: corruption, fraud, theft, diversion
Legal / compliance: Violation of / non-compliance with laws or regulations
Information: Data breach/loss, digital risk, systems breach
Competition: Competitors for service delivery

Risk: Key Concepts (Continued)

Risk Management / Mitigation

Organisational practices, policies & procedures (P&Ps) that reduce the probability of risks being realised and limit harmful consequences

Enterprise (Integrated) Risk Management (ERM)

Risk management that considers, combines and prioritises assessed risks in all risk areas (security, fiduciary, operational, informational and reputational) to strategise and implement mitigation measures

Risk mitigation is risk reduction. It cannot be made zero.

Risk Management Policy: Need

Donor audits for ongoing grants/due diligence by prospective donors
Need to instil a sense of identifying, understanding and addressing risks in the organisation as it grows; basic to a for-profit entity
Create awareness about risk-mitigation strategies when faced with risks in respective areas of work
Staff embrace and own the risk-management process
Is a tool for governance and control

Risk Management Process

Risk universe analysis
Risk identification
Risk assessment: risk assessment matrix based on likelihood and impact of identified risks

Risk assessment matrix (Likelihood vs Consequence)

Likelihood	Insignificant	Minor	Moderate	Major	Catastrophic
Almost Certain (5)	Low	Medium	High	High	High
Likely (4)	Low	Low	Medium	High	High
Possible (3)	Low	Low	Medium	Medium	High
Unlikely (2)	Low	Low	Low	Low	Medium
Remote (1)	Low	Low	Low	Low	Low

After assessment:

Prioritise risks: Risks to be taken up for mitigation
Risk response: Risk registers with roles and responsibilities of staff
Monitoring
Reporting

Internal Controls

Business practices that serve as "checks and balances" on internal stakeholders (staff/key functionaries) and/or external stakeholders (vendors) to reduce risk. To the donors, they assure that funds will be effectively utilised for the intended purpose.

Rationale for Internal Controls

Compliance: with laws and regulations
Accountability: promote accountability
Fraud prevention: preventing fraud and embezzlement
Operational efficiency: improving accuracy and timeliness of program and financial delivery and reporting

Internal Controls: Types

Preventive: approvals, authorisations, verifications, reconciliations, reviews of operating performance
Detective: audits and reviews, account reconciliations, physical inventories
Corrective: remedy problems through detective controls
Physical controls: security measures like locks, alarms etc.

Donor Due Diligence & Internal Controls

A direct correlation: every due diligence lens maps to a core internal control component.

Donor due diligence focus	Internal control component
Financial Management Assessment: Reviewing budgets, accounting systems, and audit history before an award	Control Environment: Tone at the top, ethics policies, lines of authority
Governance & Compliance Review: Checking board oversight, policies, and legal registration	Risk Assessment: Identifying and prioritizing risks to funds and mission delivery
Risk & Fraud Screening: Background checks, sanctions screening, and fraud-risk indicators	Control Activities & Information Systems: Segregation of duties, approvals, reconciliations, and reporting systems
Program & Results Monitoring: Verifying that funded activities deliver intended outcomes	Monitoring Activities: Ongoing supervision, internal audit, and corrective follow-up

A Reinforcing Cycle

Strong internal controls and favorable due diligence results reinforce each other continuously.

Strong Internal Controls: Clear policies, segregation of duties, active oversight
Favorable Due Diligence: Fewer findings, faster review, higher confidence rating
Funding Secured: Grants awarded or renewed, fewer restrictive conditions
Reinvestment in Controls: Funding builds systems, staff, and audit capacity, which leads back to strong internal controls

When Controls Are Weak

Delayed disbursements while donors verify systems
Restricted funding and added reporting conditions
Reputational damage among peer donors and partners
Loss of eligibility for future grants

Part 2: Internal Controls

Key Areas of Internal Controls in NGOs

Internal controls can be grouped into one of the following buckets: (a) Financial (b) Operational (c) Compliance. Illustrative but not exhaustive; discussed in the following sections.

Legal & Compliance (done in institutional DD)
Governance
Budget
Purchase / Procurement
Human Resource Management
Assets / Inventory Management
Accounting
Cash and Bank
Donor Reporting
Proceedings & Penalties
MIS & Software

Governance & Delegation

Current general and governing body members: due process of appointment, change or rotation as per rules with proper documentation as per rules. Too long a holding of positions is a negative
Founder as Chief Functionary for a long duration is evaluated against strategic contribution for such periods
Key office bearers (Chairman, Secretary and Treasurer): their association and discharging of roles and responsibilities
Blood relative/conflict of interest is a negative; independence of Board is questionable
Related person (ITA 2025; Specified person, Section 13 ITA 1961): transactions and benefits thereof
Any beneficial relations with other organisations
Governing body members duly updated with registering authority, Darpan and FCRA
Number and periodicity of meetings of general body and governing body as per constitution documents or law
Attendance and minutes of meetings maintained in minutes register, held with CEO
Meetings take up items of business as per roles/duties of the respective body laid down in the constitution document
Formal documentation of action taken on decisions in previous meetings
Sub-committees delegated Board responsibility should be as per constitution documents, and recommendations be duly approved by the governing body. Sub-committees could normally be FAC, HR, Grantee selection, etc.
Demonstration of strategic guidance, compliance and internal controls through policies and procedures
Does the governing board/executive committee have public servants?
Does the organisation or any directors/trustees have political or faith based affiliations?
Do key functionaries have a track record of adverse proceedings?
Does the organisation's work fall within the definition of political nature/party politics?
Key staff succession risk assessment?
Does the organisation understand boundaries in matters relating to Advocacy, Rights & Entitlements, Activism, etc.?

Accounts & Finance

Systems & Records

Fund-based accounting
Finance policy and systems implemented in letter and spirit
Accounting software, COA, basis of accounting etc.
Accounting records: vouchers, supporting bills/invoices for expenses, PO/contract, approvals, printouts, filing
Monthly and annual closing of books
Delegation matrix for approvals
Segregation of duties / checks and balances

Compliance & Assurance

Maintenance of books of accounts and other records as per Income Tax Act
Qualification and vintage of accounts/finance staff
Separate accounting for local, FC and business-incidental
Data security, backup and audit trail; rectification entries in succeeding period
Concurrent and internal audit
HO-branch accounting and reconciliation

Record Keeping

Rule 187 of ITR 2026: Specified Books of Accounts

Cash book
Ledger
Journal
Copies of bills issued
Original bills received and payments made

Form, Place & Period

Form: written, electronic or digital form, print-outs, or any other electromagnetic data storage device
Place: kept at the "registered office"; if not, intimate the Assessing Officer in writing with a Board Resolution within 7 days with full addresses of other places
Period: kept and maintained for six years from the end of the relevant tax year

Donors may stipulate record-retention clauses in their respective grant contracts. For other records, specific provision may be made in policy.

Costs, Budgets and Budgetary Control

Understanding the concept of costs: functional and natural heads
Policy framework for allocation of costs: HR, travel, utilities mainly
Common cost and apportionment as per common-cost policy
Budget formulation and approval process: annual master budget including all projects
Templates may vary by donor but the basic principles of formulation are the same: LOE, unit of measurement and unit cost for an activity, budget by line item and total budget
Expenditure reporting vis-à-vis budget: rolled up or detailed
Budget monitoring process: budget vs actual, derived from software
Budgetary control process: action based on tolerance/variance permitted, which may vary by donor

Human Resources

Org structure: updated
Recruitment, selection, engagement contract
Employee vs consultant vs contractual dilemma
Compensation and breakup: compliance with social security laws
Employee benefits: leave, insurance coverage, gratuity
Payroll and allocation of employee costs
Attendance records and allocation to donor projects
Performance appraisal
Disciplinary action
Employee strength currently, including in finance function
Understanding of various social security laws (central and state) so policy and procedures are as per law

HR recalibration in all matters requiring compliance with the New Labour Codes. Team due diligence: leadership, experience, alignment with mission, vision and culture values, transparency, etc.

Procurement

Procurement Policy

Most activities in grants fall within realm of procurement
Sample procurement transactions insisted upon by donors to validate policy implementation
Team's understanding and compliance of Procurement Policy for goods, services and works
Does the donor insist on following its own procurement policy/guidelines?
Dedicated admin staff to handle procurement in the organisation
Conflict of interest, ethics and transparency issues

Fixed Assets & Inventory

Distinction between asset and inventory understood by staff
Acquiring asset and inventory following procurement process laid down in policy
Recording, marking, issue and return, upkeep, depreciation, verification, loss, sale due to obsolescence of fixed assets
Recording, issue and return, verification, disposal of inventory not needed/useful
Insurance of assets to cover loss due to various reasons
Recording of land and building in books
Fixed assets presented separately in FC audited financials and annual reporting for FC assets in FC-4

Cash & Bank

Petty Cash & Banking

Petty cash: custody, administration and replenishment. Restrict petty cash to small office payments
Reduce cash handling and transactions to the bare minimum since banking is universal; good practice
Provisions on banking in constitution document: sometimes only a nationalised bank / SB account is insisted upon
Local and FCRA accounts: do's and don'ts
Dedicated bank account for grants
Recording and treatment of interest in pool account

Controls & Reconciliation

Signatory to bank accounts (see constitution documents): dual signatories, non-related, prefer net banking
Bearer payments: Section 40A(3) provisions
Bank reconciliation and follow-up
Minimise visits to branch; sometimes one person engaged for banks only
Bank statement copies for past 2 years to ascertain operations are through banking channels

Donor Grants

Current status of grant funding: donor funding is a factor of annual budgets and spends for past few years
Besides audited (historical) data, donors obtain projections of grants and income in future years
Understanding the donor is essential for positioning your organisation
Understanding and internal dissemination of the grant contract
Grant compliance checklist: accounting, utilisation and reporting differ by donor: FC, CSR, others
Cost center accounting for ensuring fund based accounting
Programme & financial reporting: template, periodicity, etc. for each grant contract
Timely request for course correction and revision
Community contribution, leverage, cost matching help build your case
Communication is key

Compliance: Proceedings and Penalties

Income Tax: assessments, proceedings
TDS/TCS deposit, return related
FCRA: violations and offences
Labour Codes: PF, ESI, PT, gratuity, LIN, Annual Return
GST related
Proceedings against Chief Functionary/Board members

MIS & Software

Accounting, TDS, Assets
HR: payroll, timesheet, leave, etc.
Audit
Programme MIS
Grant Management for donor entities
Integrated MIS (all parts on the same application)