Financial Planning & Internal Controls: Who Needs It and Who Does Not
Whether Financial Planning & Internal Controls applies to a given business is the first thing worth settling, and it is where most of the early questions land. The questions below are the ones raised most often in practice; the full scope of the service is on the Financial Planning & Internal Controls page.
We are a 15-person startup. Do we really need a formal controls framework yet?
There is no fixed headcount threshold in law, but in practice, once more than one or two people can independently initiate a payment or approve an expense, the risk of an uncaught error or a deliberate misuse rises sharply. Fifteen people with multiple department heads is often the point where informal, founder-checks-everything oversight starts breaking down. The framework does not need to be heavy — it needs to be proportionate to your actual risk, and it is far cheaper to build lightly now than to retrofit after an incident.
In practice: We scale the framework to the business. A 15-person startup gets a leaner authorisation matrix and fewer reconciliation checkpoints than a 200-person multi-location company — the principles are the same, the depth differs.
What is an authorisation matrix and why does PNPC say it is the most important document?
An authorisation matrix is a single reference document that maps every category of financial transaction — vendor payment, reimbursement, payroll change, capital purchase — to a named approver and a value threshold, with escalation to a second approver above that threshold. Without it in writing, 'who can approve this' gets decided differently each time, by whoever happens to be available, which is exactly the inconsistency that creates control gaps.
In practice: Without a written approval matrix, several people can each believe they have final approval authority on vendor payments — none of them wrong, because nothing was ever written down. The matrix ends that ambiguity permanently.
What is segregation of duties, in practical terms?
It means the person who requests or initiates a transaction should not be the same person who approves it, and ideally not the same person who executes or has custody of the funds or assets involved. In a small business, one person often ends up doing two or all three — creating a single point where an error or a deliberate act could go undetected. Where full segregation is not staffing-feasible, we design compensating controls, such as mandatory periodic review by a second person, to reduce the exposure.
In practice: Complete segregation is genuinely difficult in a very small team. We are honest about that constraint and design the best achievable control given your actual headcount, rather than prescribing a textbook model you cannot realistically staff.
Does PNPC design controls only for large companies, or also for proprietorships and small LLPs?
We work with businesses of every size and structure — sole proprietorships, partnerships, LLPs, and private/public companies. The statutory IFC reporting requirement under the Companies Act applies specifically to companies, but the underlying discipline of budgeting and basic controls — separating who approves payments from who executes them, reconciling bank accounts regularly — benefits any business handling money through more than one person.
In practice: For proprietorships and small LLPs, a lighter engagement focused on the highest-risk points — cash handling, vendor payment approval, payroll — is more proportionate than a full corporate-grade IFC framework, which would be disproportionate to the entity's size.
Our finance team already uses accounting software with built-in approval workflows. Do we still need this service?
Software approval workflows are useful enforcement mechanisms, but they only enforce whatever rules are configured into them — and those rules are frequently set up quickly at implementation without a proper authorisation matrix or segregation-of-duties review behind them. Software can end up configured so that the same person who can create a vendor can also approve payments to that vendor, simply because nobody designed the access rules deliberately. The software is the enforcement layer; this service is the design layer behind it.
In practice: We review your existing software's user roles and access configuration as part of the engagement and flag any configuration that undermines the segregation of duties you actually need, even if the software 'looks' like it has approvals turned on.
How does PNPC handle petty cash and physical cash controls specifically?
For businesses that handle petty cash or physical cash collections, we design an imprest-based petty cash system with a fixed float, mandatory voucher documentation for every disbursement, a defined replenishment approval process, and periodic surprise verification. For cash collection points (retail counters, field collections), we design daily reconciliation and deposit discipline so cash does not sit unaccounted for extended periods.
In practice: Cash-handling businesses are disproportionately exposed to both genuine error and deliberate misuse simply because cash, unlike a bank transfer, leaves no automatic digital trail. We treat cash controls as a distinct, higher-priority workstream whenever they are relevant to a client's business.
Will building a control framework slow down our operations?
A poorly designed control framework can absolutely slow a business down — if every payment above a trivially low threshold requires three signatures, staff will find ways to route around it. PNPC deliberately walk-tests the designed controls against real transaction samples before finalising, specifically to catch friction points where the control is disproportionate to the risk it is managing, and to right-size approval thresholds to your actual transaction patterns.
In practice: A risk in self-designed control frameworks is thresholds copied from a generic template that do not match the business's actual transaction sizes — resulting in either near-zero oversight or every routine payment needing director sign-off. Neither works long-term.
Can PNPC design controls specifically to detect and prevent employee fraud?
Yes — fraud prevention is one of the explicit design objectives of this service, alongside general error reduction and financial reliability. Segregation of duties, mandatory second approval above defined thresholds, vendor master data change controls, and regular independent reconciliation are the core mechanisms that make fraud materially harder to commit and easier to detect quickly if attempted. No control framework eliminates fraud risk entirely, but a well-designed one significantly raises the difficulty and shortens detection time.
In practice: We are careful never to promise a framework that 'prevents all fraud' — that claim is not honest. What a good framework does is remove the easiest opportunities and shorten the window before something unusual is noticed.
How does PNPC's approach differ from buying an off-the-shelf budgeting or ERP template?
PNPC starts from your actual processes, your actual risk points, and your actual people, and builds the budget and controls around that reality. The output may end up living in a spreadsheet or your existing software, but the thinking behind it is specific to your business, not generic.
In practice: We have taken over engagements where a client bought a budgeting template, populated it with guessed numbers because nobody owned the assumptions, and abandoned it by month two. The tool was never the missing piece — the process and ownership around it was.
Where this sits in the wider engagement
Financial Planning & Internal Controls rarely arrives on its own. The statutory basis and the current requirements are set out on the Financial Planning & Internal Controls service page, and the related services are grouped under Accounting Payroll.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Financial Planning & Internal Controls we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.