AS | Ankit Sarawagi|Founder, CFOmatrix·July 2026·9 min read | Right-sized SOP |
- Controls exist for three reasons: accuracy of the accounts, preventing fraud and error, and being able to prove the process ran when an auditor or buyer asks.
- Six controls are enough for a lean startup: an approval matrix, segregation of duties (maker-checker), monthly bank reconciliation, master-data control, a founder month-end review, and a live audit trail in the software.
- Preventive stops it before; detective catches it after. Use both. Approvals prevent; reconciliations and the month-end review detect.
- The audit trail is a byproduct, not extra work. Keep approvals and records in the tool itself; if you approve on WhatsApp for speed, capture it back into the record.
- Add more only as you scale. Start with the minimum viable set; layer on structure when headcount and transaction volume grow.
| 6 Controls in the minimum viable set | 2 People needed: one who does, one who approves | 5 Records an auditor asks for, every time |
What Internal Financial Controls (ICFR) Are, and Why They Exist
Internal financial controls are simply the checks and rules you put around money and your books so that the numbers stay right and nothing walks out the door unnoticed. In the Companies Act language you will hear the term ICFR, internal financial controls over financial reporting: the board, and above certain thresholds the auditor, have to confirm that the company has adequate controls and that they actually work. That sounds heavy, but for a lean startup it comes down to a few repeatable habits and the records they leave.
They exist for three plain reasons: accuracy (the accounts reflect reality), fraud and error prevention (money moves only when it should), and auditability (you can prove the process ran). The reserved matters and the RULES themselves usually live in your finance policy; these controls are the PROCESS that enforces them. See the CFOmatrix policy library for the rules, and this guide for how to run them day to day. This post is one of the process SOPs in the right-sized finance SOPs and controls guide.
Preventive vs Detective Controls, in Plain English
Every control is one of two kinds. A preventive control stops a bad transaction before it happens. A detective control catches something after it has happened. You want both: preventive controls keep most problems out, detective controls catch what slips through and, just as importantly, prove the process ran.
- Approval before a payment goes out
- A second person releases the payment in the bank (maker-checker)
- Founder sign-off for a new vendor, a salary change or a bank-detail change
- Receipt mandatory before a reimbursement is booked
- Monthly bank reconciliation
- Founder month-end review of all expenses and financials
- Audit-trail / edit-log review in the accounting software
- Variance check against budget or last month
The Minimum Viable Control Set
Here is the whole set a startup actually needs. Six controls, one finance owner, one approver. Everything below is either preventive (P) or detective (D), and every one of them leaves a record in your tools by design.
You do not need three approvers and a committee. The head of finance does or checks the action, and one other person (founder or department head) approves. Two sets of eyes catches almost everything. Keep the sensitive items (new vendors, salary changes, bank-detail changes) always with the founder, and route only genuinely strategic amounts to the board, using the threshold your SHA already sets rather than an arbitrary number.
Keep the Trail in the Tool, Not in Your Head
Controls only count if they leave a record. The trick a lean team can actually keep up is to run the approval and the record inside the tool itself, because the tool already keeps an audit trail. Set your accounting on Zoho Books (QuickBooks has a strong audit-trail option too) and your payroll on Zoho Payroll, and let the software log who did what and when.
“Keep the approval and the trail in the tool itself, because it has an audit trail. If you approve something on email or Slack or WhatsApp for speed, capture it back into the record, save it to the tool or the email, so it stays audit-defensible. In Zoho Books that log is already there; do not disable it.”
Ankit Sarawagi, from running finance for early-stage teamsEvery control above produces a record and a place it lives: the approval (in Zoho Books or a captured WhatsApp/email approval), the payment release (maker-checker log in the bank portal), the reconciliation (monthly rec statement), the master-data change (founder sign-off on file), and the edit log (audit trail in the software). That is the paper trail an auditor asks for, produced as a byproduct of doing the work, not as extra work.
How These Map to What an Auditor Tests
When an ICFR review or a due-diligence team looks at your controls, they are not looking for a fancy framework. They want five things, every time: the document, the agreement, the documented process, the approval, and the audit log. Startups get caught not because they lack controls but because they do the work and never document it. The table below maps each control to what an auditor actually tests, referencing CARO 2020 areas and the MCA audit-trail rule (all subject to current law).
| Your control | What the auditor tests | Evidence they want |
| Approval matrix | Authorisation of spend; related-party transactions (Section 188 / CARO) | Approval on record |
| Segregation of duties | ICFR design and operating effectiveness | Documented process, maker-checker log |
| Bank reconciliation | Completeness and accuracy of books (Section 128) | Monthly rec statements |
| Master-data control | Statutory dues (GST/TDS/PF/ESI), payment integrity (CARO) | Founder sign-off, vendor agreement |
| Month-end review | Fixed-asset verification, provisions, review evidence (CARO) | Signed review, variance notes |
| Audit trail in software | MCA audit-trail (edit-log) requirement; auditor reports on it | Edit log on and untampered |
“Auditors and DD teams always want the same five things: the document, the agreement, the documented process, the approval and the audit log. Startups do the work but never document it, and that is what gets them caught. These SOPs produce the documentation as a byproduct.”
Ankit SarawagiWhen to Add More, as You Scale
The minimum viable set carries you a long way. Do not add controls for their own sake; add a step only when headcount and transaction volume make the current one thin. Here is the maturity path.
The two failure modes are opposite extremes. One is no control at all: a single person who books, approves and releases payments, with a master-data gap that lets a vendor bank account be changed silently. The other is copying a large company’s control manual onto a 15-person team, which nobody follows, so it exists on paper but not in practice. Right-sized means real and run, not absent and not theatre.
Frequently Asked Questions
What are internal financial controls?
The routine checks and rules a company puts around money and its books so the numbers stay accurate, spending is authorised, assets are protected and fraud or error is caught early. For a startup that means a small set of habits: every spend approved by a second person, the person who does a transaction not being the only one who reviews it, monthly bank reconciliation, master-data control on vendor bank details, a founder month-end review, and an audit trail in the accounting software. They exist for accuracy, fraud and error prevention, and being able to prove the process ran.
What is ICFR?
ICFR stands for Internal Financial Controls over financial reporting. Under the Companies Act the board and, above certain thresholds, the auditor comment on whether controls are adequate and operate effectively. For a startup it is not a heavyweight framework; it means having a documented, repeatable process for approvals, segregation of duties, reconciliations and month-end review, and being able to show the records those processes leave. Applicability and thresholds are subject to current law, so confirm the position for your company.
Which internal controls does a startup actually need?
Six. An approval matrix so every spend has a second set of eyes and sensitive items go to the founder. Segregation of duties or maker-checker so no one person both does and releases a payment. Monthly bank reconciliation. Master-data control so vendor bank details, salaries and new vendors cannot be changed by one person alone. A founder month-end review. And a live audit trail in the accounting software. That is the minimum viable set; add more only as headcount and transaction volume grow.
What is the difference between preventive and detective controls?
A preventive control stops a bad transaction before it happens: an approval before a payment, a second person releasing the payment, a rule that a vendor bank change needs founder sign-off. A detective control catches something after the fact: a monthly bank reconciliation, the founder reviewing all expenses at month-end, an audit-trail review. A healthy startup uses both. Preventive controls keep most errors out; detective controls catch what slips through and prove the process ran.
Do auditors check internal controls in a startup?
Yes. Auditors and due-diligence teams always want the paper trail: the document, the agreement, the documented process, the approval and the audit log. Under CARO 2020 the auditor reports on areas such as physical verification of fixed assets, statutory dues and related-party transactions, all of which rest on your controls. Above certain thresholds the auditor also opines on the adequacy and effectiveness of internal financial controls. Startups get caught not for lacking controls but for doing the work and never documenting it. Figures and thresholds are subject to current law.
What is the MCA audit-trail requirement?
The Ministry of Corporate Affairs requires companies to use accounting software with an audit-trail (edit-log) feature, to keep it switched on through the year, and not to tamper with it; the auditor checks and reports on this. In practice, use software like Zoho Books or QuickBooks with the audit trail enabled so every entry, edit and deletion is logged with who and when. That is exactly the record an auditor and a buyer will ask to see, so keep it on. The requirement and its dates are subject to current law.
This is general educational information for founders, current to mid-2026, and is not legal, tax or audit advice. References to the Companies Act, CARO 2020, ICFR reporting thresholds and the MCA audit-trail requirement are indicative and subject to current law; applicability depends on company type and thresholds. Verify the current position or consult your auditor before acting on a specific matter.
Segregation of Duties for a Tiny Finance Team
Audit Readiness and the Paper Trail
AS | Founder, CFOmatrix | Finance Strategy & Equity Compliance CFOmatrix is a knowledge platform focused on how finance actually works inside growing companies. This SOP draws on hands-on experience building right-sized controls for lean startups: approvals, maker-checker, reconciliation and an audit trail that stands up to diligence, without big-company bureaucracy. |