Risks & Controls: Areas of Internal Controls; Donor Due Diligence Checklist & Readiness Roadmap
Structure of session
- Risks & Controls. Understanding the risk-control tangle.
- Internal Controls. Internal control areas that donors examine closely.
- Due Diligence Checklist & Readiness Roadmap. Completing the full circle from Session 1.
Two Pillars of Pre-Grant Due Diligence
Institutional Due Diligence
Is the organisation legitimate, well governed, and capable of delivering the programme?
- Constitutional: legal registration & regulatory compliance
- Statutory registrations & regulatory compliance
- Governance
- Mission fit
- Policies & procedures
- Programmatic track record & M&E systems
- Visibility
- Past donor relationships and references
Financial Due Diligence
Can the organisation be trusted to receive, manage and report on donor funds accurately?
- Annual financial statements: state of financial health & progress
- Audit and assurance
- Internal financial controls
- Budgeting
- Grant management
- Banking arrangements
- Accounting systems
- Procurement
- HR
Part 1: Risks & Controls
Why Understand Risk & Risk Management
- Risk is now a must-discuss in the NGO-funder relationship. The idea is how to understand, capture and manage risks
- Robust risk management is (a) basic to an effective organisation and (b) ensures better delivery of services to the community
- Fundamental concepts: Risk Appetite (willingness to take risk to achieve objectives) and Risk Tolerance (ability/boundary to take risk, i.e. acceptable deviation from risk appetite). Risk appetite is about "taking risk"; risk tolerance is about "controlling risk." Risk appetite denotes risk profile at an aggregate level; risk tolerance applies at activity level, case by case
- Risk management is how to bridge the gap between risk appetite and risk tolerance
- Understand need for internal controls commensurate with risks being mitigated
Why Risk Management Is Important for NGOs
- Financial stability
- Operational efficiency
- Compliance management
- Disciplined planning
- Informed decision making
- Reputation management
- Building trust
- Improved communication
- Long-term impact & sustainability
Risk: Key Concepts
- Threat: A danger in the environment, a potential cause of harm, e.g. legislative changes, technology, competition, inflation, globalisation, etc.
- Risk: The probability and potential impact on achievement of objectives while encountering a threat.
- Internal & external risks: Internal risks: personnel issues, technology issues, etc. within the organisation. External risks: economic, political, legal, act of God, etc. in the external environment.
Residual risk: the risk which inevitably remains after all reasonable mitigation measures have been taken. No organisation is completely free from risk; the environment will always contain risk.
Types of Risks Facing Organisations
- Ethical: Due to unethical behaviour
- Operational: Inability to achieve objectives; capacity/competence gaps; funding & access constraints
- Financial: Improper financial planning and management
- Reputational: Damage to image and reputation
- Safety: Accident / illness
- Security: Violence / crime
- Fiduciary: Breach of trust: corruption, fraud, theft, diversion
- Legal / compliance: Violation of / non-compliance with laws or regulations
- Information: Data breach/loss, digital risk, systems breach
- Competition: Competitors for service delivery
Risk: Key Concepts (Continued)
Risk Management / Mitigation
- Organisational practices, policies & procedures (P&Ps) that reduce the probability of risks being realised and limit harmful consequences
Enterprise (Integrated) Risk Management (ERM)
- Risk management that considers, combines and prioritises assessed risks in all risk areas (security, fiduciary, operational, informational and reputational) to strategise and implement mitigation measures
Risk mitigation is risk reduction. It cannot be made zero.
Risk Management Policy: Need
- Donor audits for ongoing grants/due diligence by prospective donors
- Need to instil a sense of identifying, understanding and addressing risks in the organisation as it grows; basic to a for-profit entity
- Create awareness about risk-mitigation strategies when faced with risks in respective areas of work
- Staff embrace and own the risk-management process
- Is a tool for governance and control
Risk Management Process
- Risk universe analysis
- Risk identification
- Risk assessment: risk assessment matrix based on likelihood and impact of identified risks
Risk assessment matrix (Likelihood vs Consequence)
| Likelihood | Insignificant | Minor | Moderate | Major | Catastrophic |
|---|---|---|---|---|---|
| Almost Certain (5) | Low | Medium | High | High | High |
| Likely (4) | Low | Low | Medium | High | High |
| Possible (3) | Low | Low | Medium | Medium | High |
| Unlikely (2) | Low | Low | Low | Low | Medium |
| Remote (1) | Low | Low | Low | Low | Low |
After assessment:
- Prioritise risks: Risks to be taken up for mitigation
- Risk response: Risk registers with roles and responsibilities of staff
- Monitoring
- Reporting
Internal Controls
Business practices that serve as "checks and balances" on internal stakeholders (staff/key functionaries) and/or external stakeholders (vendors) to reduce risk. To the donors, they assure that funds will be effectively utilised for the intended purpose.
Rationale for Internal Controls
- Compliance: with laws and regulations
- Accountability: promote accountability
- Fraud prevention: preventing fraud and embezzlement
- Operational efficiency: improving accuracy and timeliness of program and financial delivery and reporting
Internal Controls: Types
- Preventive: approvals, authorisations, verifications, reconciliations, reviews of operating performance
- Detective: audits and reviews, account reconciliations, physical inventories
- Corrective: remedy problems through detective controls
- Physical controls: security measures like locks, alarms etc.
Donor Due Diligence & Internal Controls
A direct correlation: every due diligence lens maps to a core internal control component.
| Donor due diligence focus | Internal control component |
|---|---|
| Financial Management Assessment: Reviewing budgets, accounting systems, and audit history before an award | Control Environment: Tone at the top, ethics policies, lines of authority |
| Governance & Compliance Review: Checking board oversight, policies, and legal registration | Risk Assessment: Identifying and prioritizing risks to funds and mission delivery |
| Risk & Fraud Screening: Background checks, sanctions screening, and fraud-risk indicators | Control Activities & Information Systems: Segregation of duties, approvals, reconciliations, and reporting systems |
| Program & Results Monitoring: Verifying that funded activities deliver intended outcomes | Monitoring Activities: Ongoing supervision, internal audit, and corrective follow-up |
A Reinforcing Cycle
Strong internal controls and favorable due diligence results reinforce each other continuously.
- Strong Internal Controls: Clear policies, segregation of duties, active oversight
- Favorable Due Diligence: Fewer findings, faster review, higher confidence rating
- Funding Secured: Grants awarded or renewed, fewer restrictive conditions
- Reinvestment in Controls: Funding builds systems, staff, and audit capacity, which leads back to strong internal controls
When Controls Are Weak
- Delayed disbursements while donors verify systems
- Restricted funding and added reporting conditions
- Reputational damage among peer donors and partners
- Loss of eligibility for future grants
Part 2: Internal Controls
Key Areas of Internal Controls in NGOs
Internal controls can be grouped into one of the following buckets: (a) Financial (b) Operational (c) Compliance. Illustrative but not exhaustive; discussed in the following sections.
- Legal & Compliance (done in institutional DD)
- Governance
- Budget
- Purchase / Procurement
- Human Resource Management
- Assets / Inventory Management
- Accounting
- Cash and Bank
- Donor Reporting
- Proceedings & Penalties
- MIS & Software
Governance & Delegation
- Current general and governing body members: due process of appointment, change or rotation as per rules with proper documentation as per rules. Too long a holding of positions is a negative
- Founder as Chief Functionary for a long duration is evaluated against strategic contribution for such periods
- Key office bearers (Chairman, Secretary and Treasurer): their association and discharging of roles and responsibilities
- Blood relative/conflict of interest is a negative; independence of Board is questionable
- Related person (ITA 2025; Specified person, Section 13 ITA 1961): transactions and benefits thereof
- Any beneficial relations with other organisations
- Governing body members duly updated with registering authority, Darpan and FCRA
- Number and periodicity of meetings of general body and governing body as per constitution documents or law
- Attendance and minutes of meetings maintained in minutes register, held with CEO
- Meetings take up items of business as per roles/duties of the respective body laid down in the constitution document
- Formal documentation of action taken on decisions in previous meetings
- Sub-committees delegated Board responsibility should be as per constitution documents, and recommendations be duly approved by the governing body. Sub-committees could normally be FAC, HR, Grantee selection, etc.
- Demonstration of strategic guidance, compliance and internal controls through policies and procedures
- Does the governing board/executive committee have public servants?
- Does the organisation or any directors/trustees have political or faith based affiliations?
- Do key functionaries have a track record of adverse proceedings?
- Does the organisation's work fall within the definition of political nature/party politics?
- Key staff succession risk assessment?
- Does the organisation understand boundaries in matters relating to Advocacy, Rights & Entitlements, Activism, etc.?
Accounts & Finance
Systems & Records
- Fund-based accounting
- Finance policy and systems implemented in letter and spirit
- Accounting software, COA, basis of accounting etc.
- Accounting records: vouchers, supporting bills/invoices for expenses, PO/contract, approvals, printouts, filing
- Monthly and annual closing of books
- Delegation matrix for approvals
- Segregation of duties / checks and balances
Compliance & Assurance
- Maintenance of books of accounts and other records as per Income Tax Act
- Qualification and vintage of accounts/finance staff
- Separate accounting for local, FC and business-incidental
- Data security, backup and audit trail; rectification entries in succeeding period
- Concurrent and internal audit
- HO-branch accounting and reconciliation
Record Keeping
Rule 187 of ITR 2026: Specified Books of Accounts
- Cash book
- Ledger
- Journal
- Copies of bills issued
- Original bills received and payments made
Other Documents
- Record of all projects and institutions run by the organisation
- Record of income of the organisation during the tax year
- Record of application out of the income during the tax year
- Record of specified application out of income of preceding years
- Record of voluntary contribution with a specific direction to form corpus
- Record of contribution received under 80G(2)(b), treated as corpus
- Record of loans and borrowings
- Record of properties held by the assessee
- Record of related persons as per Section 355 of ITA 2025
- Any other document
Since August 2022, Rule 17AA of the Income Tax Department specifies what records to maintain, in what form, where, and for what period, and the consequences for non-compliance.
Form, Place & Period
- Form: written, electronic or digital form, print-outs, or any other electromagnetic data storage device
- Place: kept at the "registered office"; if not, intimate the Assessing Officer in writing with a Board Resolution within 7 days with full addresses of other places
- Period: kept and maintained for six years from the end of the relevant tax year
Donors may stipulate record-retention clauses in their respective grant contracts. For other records, specific provision may be made in policy.
Costs, Budgets and Budgetary Control
- Understanding the concept of costs: functional and natural heads
- Policy framework for allocation of costs: HR, travel, utilities mainly
- Common cost and apportionment as per common-cost policy
- Budget formulation and approval process: annual master budget including all projects
- Templates may vary by donor but the basic principles of formulation are the same: LOE, unit of measurement and unit cost for an activity, budget by line item and total budget
- Expenditure reporting vis-à-vis budget: rolled up or detailed
- Budget monitoring process: budget vs actual, derived from software
- Budgetary control process: action based on tolerance/variance permitted, which may vary by donor
Human Resources
- Org structure: updated
- Recruitment, selection, engagement contract
- Employee vs consultant vs contractual dilemma
- Compensation and breakup: compliance with social security laws
- Employee benefits: leave, insurance coverage, gratuity
- Payroll and allocation of employee costs
- Attendance records and allocation to donor projects
- Performance appraisal
- Disciplinary action
- Employee strength currently, including in finance function
- Understanding of various social security laws (central and state) so policy and procedures are as per law
HR recalibration in all matters requiring compliance with the New Labour Codes. Team due diligence: leadership, experience, alignment with mission, vision and culture values, transparency, etc.
Procurement
Procurement Policy
- Most activities in grants fall within realm of procurement
- Sample procurement transactions insisted upon by donors to validate policy implementation
- Team's understanding and compliance of Procurement Policy for goods, services and works
- Does the donor insist on following its own procurement policy/guidelines?
- Dedicated admin staff to handle procurement in the organisation
- Conflict of interest, ethics and transparency issues
Fixed Assets & Inventory
- Distinction between asset and inventory understood by staff
- Acquiring asset and inventory following procurement process laid down in policy
- Recording, marking, issue and return, upkeep, depreciation, verification, loss, sale due to obsolescence of fixed assets
- Recording, issue and return, verification, disposal of inventory not needed/useful
- Insurance of assets to cover loss due to various reasons
- Recording of land and building in books
- Fixed assets presented separately in FC audited financials and annual reporting for FC assets in FC-4
Cash & Bank
Petty Cash & Banking
- Petty cash: custody, administration and replenishment. Restrict petty cash to small office payments
- Reduce cash handling and transactions to the bare minimum since banking is universal; good practice
- Provisions on banking in constitution document: sometimes only a nationalised bank / SB account is insisted upon
- Local and FCRA accounts: do's and don'ts
- Dedicated bank account for grants
- Recording and treatment of interest in pool account
Controls & Reconciliation
- Signatory to bank accounts (see constitution documents): dual signatories, non-related, prefer net banking
- Bearer payments: Section 40A(3) provisions
- Bank reconciliation and follow-up
- Minimise visits to branch; sometimes one person engaged for banks only
- Bank statement copies for past 2 years to ascertain operations are through banking channels
Donor Grants
- Current status of grant funding: donor funding is a factor of annual budgets and spends for past few years
- Besides audited (historical) data, donors obtain projections of grants and income in future years
- Understanding the donor is essential for positioning your organisation
- Understanding and internal dissemination of the grant contract
- Grant compliance checklist: accounting, utilisation and reporting differ by donor: FC, CSR, others
- Cost center accounting for ensuring fund based accounting
- Programme & financial reporting: template, periodicity, etc. for each grant contract
- Timely request for course correction and revision
- Community contribution, leverage, cost matching help build your case
- Communication is key
Compliance: Proceedings and Penalties
- Income Tax: assessments, proceedings
- TDS/TCS deposit, return related
- FCRA: violations and offences
- Labour Codes: PF, ESI, PT, gratuity, LIN, Annual Return
- GST related
- Proceedings against Chief Functionary/Board members
MIS & Software
- Accounting, TDS, Assets
- HR: payroll, timesheet, leave, etc.
- Audit
- Programme MIS
- Grant Management for donor entities
- Integrated MIS (all parts on the same application)