AS | Ankit Sarawagi|Founder, CFOmatrix·July 2026·18 min read | The complete guide |
- Two people, not a chain. Finance does or checks the action, one other person (founder or department head) approves. Two sets of eyes is enough, and every spend gets approved.
- Founder always for the sensitive three. New vendors, salary changes, and bank-detail changes go to the founder, every time.
- The board line is your SHA, not a round number. Big or strategic spend follows the reserved matters in your investment agreement or shareholders agreement.
- Let the tool keep the trail. Run books in software with an audit log (Zoho Books, QuickBooks), use maker-checker on payments, and capture any WhatsApp or Slack approval back into the record.
- Documentation is a byproduct. Auditors want the document, the agreement, the process, the approval and the audit log. Right-sized SOPs produce all five without extra work.
| 2 People involved in the baseline approval: doer plus one approver | 5 Things every auditor wants: document, agreement, process, approval, audit log | 20 Right-sized SOPs in this series, mapped by money flow |
Why Startups Need SOPs, Not Bureaucracy
A finance SOP for startups exists to solve one tension. Too little process and money leaks, approvals live only in someone’s memory, and diligence turns into a nightmare. Too much process and a 12-person company grinds to a halt behind signature chains built for a 1,200-person one. The right answer is neither extreme: right-sized SOPs a lean team can actually run.
- Money leaks, no one notices
- Approvals live in memory
- Diligence becomes a scramble
- One owner, minimum approvers
- Trail produced by the tool
- Runs at startup speed
- Long signature chains
- Everything waits on approvals
- Process built for a giant
One clarification up front, because founders mix the two. A policy is the rule (the travel limit, the procurement principles). An SOP is the process that applies the rule: the steps, the owner, the approver and the record. You need both, and each SOP should point to the policy it applies. Keep your rules in the CFOmatrix policy library and let these SOPs be the operating procedures your team follows. Every SOP in this series shares the same lean spine, which the rest of this guide builds up piece by piece.
The Approval Model
The heart of a lean control system is a simple approval matrix with no long chains. The baseline is two people: the head of finance does or checks the action, and one other person approves it, either the founder or the relevant head of department. Two sets of eyes is enough. Every spend gets approved. There is no auto-approve-below-a-number free pass, because that is exactly where quiet leakage hides.
| Tier | What it covers | Who approves |
| Everyday | Routine, budgeted spend and vendor payments | Finance does or checks + 1 approver (founder or dept head) |
| Sensitive | New vendors, salary changes, bank-detail changes | Founder, always |
| Above SHA limit | Big or strategic spend and reserved matters | Board, per the investment agreement / SHA |
“I do not believe in long approval chains. Two people is enough for everyday spend: finance does or checks it, one other person approves it. What I never compromise on is the sensitive three, new vendors, salary changes and bank-detail changes, those always come to the founder.”
Ankit Sarawagi, from building finance functions inside lean startupsThe sensitive three deserve a word on why. A fake new vendor is the classic fraud, a changed salary line is money out the door every month, and a changed bank detail is how a genuine invoice gets paid to the wrong account. Founder eyes on those three closes the highest-risk gaps for almost no friction. For the board tier, resist the urge to invent a threshold: read it straight from your investment agreement or shareholders agreement, so what needs board approval is exactly what your investors agreed needs it. The full walk-through, with a downloadable matrix you can adapt, is in the approval matrix SOP.
Write the matrix once, on one page, and pin it where the team spends. The single most common control failure in a startup is not fraud, it is a well-meaning employee who genuinely did not know something needed approval.
Segregation of Duties on a Tiny Team
Segregation of duties sounds like something only a big company can afford. It is not. The core rule survives even a one-person finance team: the person who does an action never approves it. Finance does the action; the founder or a department head approves it. Nobody self-approves, ever.
There is one more rule that matters even at tiny scale: whoever negotiates or decides a vendor’s terms should not also be the person who onboards that vendor into your systems. Splitting terms from onboarding removes the single most abusable combination on a small team. When you genuinely cannot separate two duties, the founder’s month-end review and payment release are the compensating controls that keep the process defensible. See the segregation of duties SOP and, once you cross the reporting thresholds, the internal financial controls guide.
The Tool Stack and Audit Trail
The reason lean SOPs work is that the tools do the remembering. Run your books in software that keeps an audit trail and the record is produced for you. In India this is not optional: the Ministry of Corporate Affairs requires accounting software to have an audit trail (edit log) feature that stays switched on, and auditors are now required to comment on it (subject to the current law that applies to your company).
Zoho Books keeps a built-in audit log. QuickBooks has a strong audit-trail option too. Keep the log on.
Zoho Payroll runs salary, PF, ESI and TDS with its own record of each run and change.
Maker-checker: one person uploads (maker), another approves and releases (checker) in the bank.
Speed is fine. If a founder approves a payment or a new vendor over WhatsApp, Slack or email, save that approval back into the accounting tool or attach it to the transaction. An approval nobody can find later is the same as no approval when an auditor or diligence team asks.
“Keep the approval and the trail inside the tool, because the tool has an audit trail. When you approve on WhatsApp or Slack for speed, and you will, capture it back into the record. That one habit is the difference between a clean diligence and a painful one.”
Ankit SarawagiThe full setup, including which tool settings to check and how maker-checker maps to your bank, is in the payment controls and maker-checker SOP. This audit-trail-in-tool habit is what makes every other SOP in this series produce documentation as a byproduct.
The Spend Processes
Money going out is where the most controls belong, because it is where the most goes wrong. Four SOPs cover the whole outbound flow, and each follows the same two-person spine.
On reimbursements specifically, the lean rule is strict but simple: a receipt is mandatory for every claim, no exceptions, category limits are set in advance, and everything is paid monthly alongside payroll so there is one clean, auditable run instead of scattered payouts. Dive into each: vendor onboarding, accounts payable, expense reimbursement and payment controls. Downloadable vendor and expense forms sit inside those posts.
The Revenue Processes
Money coming in needs less control than money going out, but it needs the right control: getting billed accurately, on time, and collected. Two SOPs cover it.
The one control that matters most here is the contract on file before the first invoice: it settles price, term and GST treatment in one place and removes the arguments that stall collections later. Read the customer onboarding SOP and the invoicing and accounts receivable SOP; a ready customer onboarding checklist is inside.
The People Processes
Payroll is usually a startup’s single largest cash outflow, so the people SOPs are as much a financial control as an HR one. Three cover the employee lifecycle.
Work through employee onboarding, payroll and full and final settlement. The employee onboarding checklist download makes the first day repeatable.
Assets and Banking
Two quiet SOPs prevent two quiet problems: assets that vanish and a bank balance that never quite matches the books. Neither is glamorous, and both are audit staples (CARO 2020 specifically covers physical verification of fixed assets).
- Every laptop and asset tagged and listed
- Owner and location recorded
- Physical verification once a year
- Books matched to the bank monthly
- Differences explained, not carried
- A named owner and a fixed date
See the fixed asset register SOP and the bank reconciliation SOP, with a fixed asset register template and a bank reconciliation template to start from.
Close, Compliance and Audit
The monthly close is where everything above comes together into numbers you can trust and a board pack you can send. It is also where the founder’s compensating review lives: at the month-end financials review the founder approves all expenses together, the clean second sweep from Section 03.
Each is its own SOP: month-end close, journal voucher control, the compliance calendar, related-party transactions, revenue cut-off and recognition and books and audit trail. A month-end close checklist and a compliance calendar are ready to download.
What Your Auditor Will Actually Ask For
Here is the payoff of every SOP above. Auditors and diligence teams are remarkably consistent about what they want, and it is always the same five things for any transaction they pick. Startups rarely fail because they did the wrong thing. They get caught because they did the work and never documented it.
“Every auditor and every diligence team asks for the same five things: the document, the agreement, the process, the approval and the audit log. Startups do the work, they just never write it down. If you run these SOPs, the documentation already exists when they ask.”
Ankit SarawagiThe most expensive gap in a startup fundraise is not a bad number, it is a missing approval or a contract nobody can find. A due diligence team reads absent documentation as weak controls, and it costs you time, leverage and sometimes valuation. Build the trail while the work happens, never after.
Use the books and audit trail SOP to close the loop, and keep an audit readiness checklist handy. Remember the boundary throughout: policies are the rules, these SOPs are the process, so cross-reference the CFOmatrix policy library rather than duplicating rule content inside a procedure.
“Good startup controls are not about slowing people down. They are about two people, the right tool, and a habit of capturing the approval, so the trail is already there the day someone asks for it.”
Ankit Sarawagi, CFOmatrixFrequently Asked Questions
What is a finance SOP for a startup?
A finance SOP is a short, written description of how one money process runs: the steps, who does each step, who approves it, and what record it leaves behind. For a startup the point is that it is lightweight: one owner, the minimum approvers, no long chains, and an audit trail produced automatically inside your accounting or payroll tool. A policy sets the rule; the SOP is the process that applies it day to day.
How many approvers does a startup really need on a payment?
Two people is the baseline. Finance does or checks the action, and one other person approves it, either the founder or the relevant department head. Every spend should be approved, with no auto-approve-below-a-number free pass. Sensitive items always go to the founder: new vendors, salary changes, and any bank-detail change. Anything above the limit in your investment agreement or shareholders agreement goes to the board.
How do you segregate duties when the finance team is one person?
You never let the same person both do and approve. Finance does the action and the founder or a department head approves it, so even a one-person finance team never self-approves. A practical compensating routine is that the founder eyeballs everything, reviews all expenses at the month-end financials review, and acts as the checker who releases bank payments. Also, whoever negotiates a vendor’s terms should not be the person who onboards that vendor.
Does startup accounting software need an audit trail by law in India?
Yes. The Ministry of Corporate Affairs requires companies to use accounting software with an audit trail (edit log) feature and to keep it switched on, and auditors comment on it. Tools like Zoho Books and QuickBooks offer this. Run your books in such a tool, keep the audit trail on, and keep approvals inside the tool where possible. This is subject to current law, so confirm the position for your company.
What if approvals happen over WhatsApp or Slack for speed?
That is fine for speed, but the approval only counts if it is captured back into the record. If a founder approves a payment or a new vendor over WhatsApp, Slack or email, save that approval into the accounting tool or attach it to the transaction so the trail is complete. An approval nobody can find later is the same as no approval when a diligence team or auditor asks.
What does an auditor actually ask a startup for?
Auditors and diligence teams consistently want the paper trail: the document, the agreement, the documented process, the approval, and the audit log. Startups get caught not because they did the wrong thing but because they did the work and never documented it. Right-sized SOPs, a few templates, and keeping approvals inside your tools produce that documentation as a byproduct rather than extra work.
How is expense reimbursement best handled in a lean startup?
Set clear category limits and require a receipt for every claim, no exceptions, then reimburse monthly with the payroll cycle. Category limits plus a mandatory receipt keep it simple and controllable, and paying reimbursements alongside salary means one clean, auditable run each month instead of scattered ad hoc payouts.
What is the difference between a finance policy and a finance SOP?
A policy is the rule: what is allowed, the limits and the principles. An SOP is the process that carries out the rule: the ordered steps, the owner, the approver and the record it creates. You need both. Keep policies in your policy library and keep SOPs as the operating procedures your team follows, and make sure each SOP points to the policy it applies.
This is general educational information for founders, current to mid-2026, drawing on the author’s experience building finance functions inside lean startups, and is not legal, tax or audit advice. References to Indian law (the MCA audit-trail requirement, CARO 2020, and Sections 128 and 188 of the Companies Act) are indicative and change over time; verify the current position or consult a professional before acting on a specific matter.
Segregation of Duties on a Small Finance Team
Payment Controls and Maker-Checker
AS | Founder, CFOmatrix | Finance Strategy & Equity Compliance CFOmatrix is a knowledge platform focused on how finance actually works inside growing companies. This guide draws on hands-on experience building right-sized finance controls inside lean startups, from the approval matrix and segregation of duties to the tool stack, the monthly close and audit readiness. |