Financial Planning & Internal Controls: Where It Goes Wrong
The failures on Financial Planning & Internal Controls repeat, which means they are avoidable if you know what to watch. The questions below are the ones raised most often in practice; the full scope of the service is on the Financial Planning & Internal Controls page.
What happens if our actual results diverge significantly from the budget mid-year — is the budget just wrong?
Not necessarily. A variance can be a timing difference (revenue that shifted a month later than planned), a genuine performance issue (costs running structurally above plan), or a change in underlying assumptions (a new competitor, a delayed product launch) that means the original budget needs a formal revision. PNPC's variance review distinguishes between these three categories explicitly, because the correct management response is different for each.
In practice: We advise against silently 're-forecasting' every month to make the numbers always look on-track. A budget that is quietly rewritten to match actuals stops functioning as a planning tool. Formal, documented revisions at defined checkpoints are better discipline.
Can this service help us prepare for a statutory audit specifically?
Yes — this is one of the most common reasons companies engage PNPC for this service. We ensure the authorisation matrix, SOPs, and reconciliation evidence are current, documented, and available for the statutory auditor's review of internal financial controls under Section 143(3)(i), and we brief management ahead of time on the kind of queries the auditor is likely to raise, so there are no surprises during fieldwork.
In practice: An auditor arriving to find a documented control framework already in place moves through the IFC testing portion of the audit noticeably faster — which, in practice, also reduces audit fees and disruption to your team.
What is a reconciliation, and why does PNPC treat it as a control, not just an accounting task?
A reconciliation compares two independent records of the same activity — your bank statement against your cash book, a vendor's statement against your accounts payable ledger — to confirm they agree, and to surface discrepancies immediately if they do not. Reconciliation is a control because it is one of the few checkpoints that can catch an error or an unauthorised transaction after the fact, even if the initial approval control was bypassed or failed. An unreconciled account is a blind spot — discrepancies can sit there undetected for months.
In practice: We ask every new client how recently their bank accounts were last reconciled. The answer is often more revealing about the state of financial control in a business than any other single question we ask.
How does PNPC handle vendor master data controls specifically?
Vendor master data — bank account details, GSTIN, contact information for each vendor in your accounting system — is a common fraud vector: a fraudulent change to a vendor's bank account details can redirect a legitimate payment to an unauthorised account. We design a control requiring any change to vendor bank details to be independently verified (typically via a callback to a known contact, not the number on the change request) and approved by someone other than the person who processes payments to that vendor.
In practice: Business email compromise fraud, where a fraudster impersonates a vendor and requests a bank detail change by email, has become increasingly common. This specific control — independent verification before any bank detail change is actioned — is one of the highest-value, lowest-cost controls we recommend to every client, regardless of size.
Can the internal controls framework you design help with GST or TDS compliance too?
Indirectly, yes. A well-designed procure-to-pay control ensures invoices are checked for correct GSTIN and tax treatment before payment, and that TDS is deducted at source on applicable payments (rent, professional fees, contractor payments) as part of the standard payment approval workflow rather than being caught later at reconciliation. Building the tax-compliance check into the approval step, rather than treating it as a separate downstream task, meaningfully reduces the risk of missed TDS deductions and input tax credit mismatches.
In practice: TDS defaults are a costly compliance failure in businesses without a controls framework — largely because nobody's job explicitly included checking TDS applicability before a payment was released. We build that check into the approval workflow itself.
What is the role of the Board or promoters in this process, versus the finance team?
The Board (or promoters, in a smaller company) sets the overall risk appetite and approves the final authorisation matrix and budget, since ultimate accountability for internal financial controls rests with the directors (Section 134(5)(e) for listed companies, and Section 134(3)(q) read with Rule 8(5)(viii) of the Companies (Accounts) Rules, 2014 for the Board's report of every company). The finance team executes the day-to-day process — processing transactions, running reconciliations, flagging variances. PNPC facilitates both sides: building the technical framework with the finance team's input, and presenting it to the Board or promoters for formal approval and sign-off.
In practice: We insist on formal Board or promoter sign-off of the authorisation matrix and budget, not just finance-team agreement. A framework the finance team designed for itself, without director-level endorsement, has no real authority when someone senior wants to bypass it.
Why should we engage PNPC rather than build this framework ourselves using free templates online?
Free templates give you a generic structure — they do not know your actual approval chain, your actual risk points, your actual chart of accounts, or your actual statutory obligations under the Companies Act and Standards on Auditing. PNPC has designed and implemented these frameworks across businesses of many sizes and sectors since 1986, and we bring the pattern recognition of having seen exactly where control gaps typically hide — vendor master data, petty cash, segregation of payment initiation and approval — that a generic template will not flag for your specific business.
In practice: We frequently take over engagements where a business implemented a downloaded template, felt reassured by having 'a policy document', and then discovered at audit time or after an incident that the template did not actually address their real risk points. A document that exists but does not match reality is arguably worse than no document, because it creates false confidence.
Where this sits in the wider engagement
Financial Planning & Internal Controls rarely arrives on its own. The statutory basis and the current requirements are set out on the Financial Planning & Internal Controls service page, and the related services are grouped under Accounting Payroll.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Financial Planning & Internal Controls we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.