If your turnover crossed ₹100 crore in the last three years but your approval controls did not change, you are probably leaking margin at seven predictable points. Most promoters find out at the tax audit, or when somebody resigns. A b2b management consultancy is usually called in to close these seven, and this is the order that works.
The pattern repeats across auto components, engineering and textile units in Tamil Nadu that grew past ₹80 crore without rebuilding their processes. Nothing gets stolen dramatically. The controls that worked when you could see the whole plant from the office window simply stop covering a second unit, a third shift and four hundred vendors.
The seven checkpoints at a glance
| # | Checkpoint | The control that stops the leak |
|---|---|---|
| 1 | Procurement and vendor management | Three way match of purchase order, goods receipt note and vendor invoice before payment |
| 2 | Inventory and stock reconciliation | Perpetual cycle counts by value class, not one annual count |
| 3 | Scrap and byproduct realisation | Numbered gate passes tied to a verified weighbridge ticket |
| 4 | Credit control and receivables | Credit limits set by finance and locked in the system, never by sales |
| 5 | Maintenance and capital spending | Approval thresholds plus preventive maintenance logs per asset |
| 6 | Payroll and labour cost allocation | Biometric attendance matched to production output for the same shift |
| 7 | IT and ERP authorisation | No user can initiate, approve and record the same transaction |
1. Procurement and Vendor Management
Match every vendor invoice to its purchase order and goods receipt note before payment, and duplicate or inflated payments stop at the gate.
In a plant clearing 300 to 500 vendor invoices a month it fails for two reasons. Someone raises the purchase order after the invoice arrives, which turns approval into paperwork. Or the tolerance sits at zero, so buyers override the block a hundred times a month and the override becomes the routine. Set rate tolerance at two percent and quantity tolerance at one percent, force purchase orders to precede delivery, and route every override to a named approver with a written reason. Pay a vendor registered under Udyam as micro or small on day 46 rather than day 45 and the entire payment is added back to your taxable income for that year, not merely penalised. On ₹2 crore of late payments that is a timing hit of roughly ₹50 lakh, and it surfaces in Form 3CD at audit, by which point the year is closed and cannot be fixed. Write the rebuilt sequence into an SOP with named owners before you touch the software.
Why it matters: every rupee of duplicate payment is pure margin, not revenue you still have to go out and earn.
2. Inventory and Stock Reconciliation
Count high value stock continuously through the year instead of once, because an annual count tells you a loss happened but never when or where.
Split raw material, work in progress and finished goods by value class. Count the top class monthly, the middle quarterly, the tail twice a year, and reconcile each count to the system the same day it is taken. A single yearly count hands you a variance you cannot investigate, because the trail is eleven months cold. CARO 2020 requires your statutory auditor to report if management verified inventory at reasonable intervals, and to report any discrepancy of ten percent or more in each class of inventory. That paragraph goes into the annexure to the audit report, which your board reads and which your lender reads at renewal. Fix the reason codes. If every variance is booked as normal loss you have a posting habit rather than a control, and your internal audit will report the same finding every year.
Why it matters: a variance you find within thirty days is an investigation. The same variance found in March is a write off.
3. Scrap and Byproduct Realisation
Tie every scrap movement to a numbered gate pass and a stamped weighbridge ticket, or your secondary output leaves the plant as somebody else’s income.
Scrap is the quietest leak in Indian manufacturing because nobody owns it. Number the gate passes in a controlled series, reconcile outward weight to the weighbridge ticket, and have someone other than the weighbridge operator sign the release. Keep the weighbridge verified and stamped under the Legal Metrology Act 2009, which requires periodic reverification. Then work out your own exposure. Take your metal input value, multiply by your scrap generation percentage, and multiply again by the gap between the rate on your gate pass and the traded rate that week. On most machining units that arithmetic produces a number the promoter has never seen written down. GST now leaves a trail you can audit against. Since 1 October 2024, metal scrap supplied between registered persons carries two percent TDS under GST, so the buyer side is now visible.
Why it matters: scrap revenue you never see is untaxed, unbanked and untraceable the moment the truck clears your gate.
4. Credit Control and Receivables
The team that closes the sale must never be the team that approves the payment terms.
Give sales the target and finance the credit limit, then lock the limit in the system so no field user can edit it. Set aging buckets at 0 to 30, 31 to 60, 61 to 90 and beyond 90 days, and make the sales incentive payable on collection rather than on invoice. That single change moves days sales outstanding faster than any reminder process. Export receivables rarely get the same discipline, because the credit decision often gets made by whoever met the buyer at the trade fair. At ₹120 crore of turnover, every ten days of days sales outstanding is about ₹3.3 crore of working capital you are funding, which on a cash credit line at around nine percent costs roughly ₹30 lakh a year in interest alone.
Why it matters: an order you cannot collect is a cost you have already paid for.
5. Maintenance and Capital Spending
Set spending thresholds before the machine breaks, because an emergency purchase gets approved by whoever happens to be standing on the shop floor.
Two controls do most of the work. First, a threshold ladder that names an approver at each level, with a written business case above a defined limit and a review six months after commissioning against that case. Second, a preventive maintenance log per asset, because unplanned breakdowns create the emergency purchases the ladder exists to prevent. Schedule II of the Companies Act 2013 sets the useful life of general plant and machinery at fifteen years, so a repair wrongly capitalised distorts depreciation and profit for fifteen years, and a capital item wrongly expensed understates your asset base just as your banker computes debt to EBITDA. Rebuilding the approval sequence is faster than arguing about the last purchase.
Why it matters: a wrong capital decision sits on your books long after the person who approved it has left the company.
6. Payroll and Labour Cost Allocation
Cross reference biometric attendance against production output, because attendance proves presence and nothing else.
Ghost workers survive in contract heavy plants where the contractor supplies the muster roll and nobody reconciles it. Match biometric punches to piece rate or line output for the same shift, and reconcile headcount to EPF and ESI remittances every month. EPF applies once you reach twenty employees and ESI at ten in most states, so contract labour is where the numbers are easiest to inflate and easiest to check. The Income Tax Act 2025, in force from 1 April 2026, brings manpower supply explicitly within the definition of work for TDS purposes, closing an ambiguity many manufacturers relied on to skip deduction on labour supply contracts. If you were not deducting on those contracts before, you are now, and interest runs from the date of payment.
Why it matters: you are paying for those hours either way. The only open question is if you are getting them.
7. IT and ERP Authorisation Matrix
Write down who can initiate, approve and record each transaction type, then make sure no single person holds all three.
An authorisation matrix is a grid of roles against transaction types, maintained by finance and reviewed every quarter, not a one time setup handed to your ERP vendor. Start with the highest risk pairs: vendor master creation with payment release, and inventory adjustment with stock issue. Then check the audit trail is actually switched on. Since 1 April 2023, companies using accounting software must have an audit trail feature that records every edit and cannot be disabled. A system where the feature exists but sits switched off is a finding in your internal financial controls audit, not a technicality. If you run two or more units under the same PAN, input service distributor registration has been mandatory since 1 April 2025 for common input services, with form GSTR 6 due by the 13th of the following month. Credit distributed outside that mechanism is recoverable with interest.
Why it matters: the person who can create a vendor and release a payment does not need an accomplice.
What you can fix yourself, and what you cannot
Four of the seven need discipline rather than expertise. Cycle counting, gate pass numbering, aging buckets and capex thresholds can be put in by a competent finance manager inside a quarter. Paying an outside firm to do those four is a waste of your money.
Three are genuinely hard to do from inside the business. The vendor master clean up needs someone with no relationship to the vendors. The authorisation matrix needs someone who can say no to the person who signs their salary. The scrap yield baseline needs a comparison from outside your own plant, because your own history is the thing under question. That is where a b2b management consultancy earns its fee. PKC runs those three as a single review across the books, the floor and the system settings, under ICAI professional standards. That scope is set out on the PKC management consulting practice page.
Why your internal auditor may not catch these
It is a fair question. The three reviews answer different questions, and none replaces the other two.
| Statutory audit | Internal audit | Control review | |
|---|---|---|---|
| Core question | Do the accounts show a true and fair view | Are the controls being followed | Why the control keeps failing and what replaces it |
| What triggers it | Annual requirement under the Companies Act 2013 | Section 138 obligation above defined thresholds | You commission it, at any point in the year |
| Main output | Audit report with the CARO annexure | Observation list for the audit committee | Redesigned process, SOP, named owner, system settings |
| It ends when | The report is signed | The observation is marked closed | The leak stops recurring |
| What it will not do | Redesign your process | Rebuild the process it flagged | Replace either of the two audits |
Frequently asked questions
What does a b2b management consultancy actually do?
It reviews how work moves through your business, finds where money or time exits without a decision, then redesigns that process and hands you the SOP, the approval matrix and the system settings. A b2b management consultancy works on operations, not just on reports. That is the difference from an audit.
Is internal audit mandatory for a private limited company in India?
Yes, above defined limits. Section 138 of the Companies Act 2013 requires internal audit for private companies with turnover of ₹200 crore or more, or outstanding borrowings from banks or public financial institutions above ₹100 crore, at any point during the preceding financial year.
How long does a control review take for a ₹100 crore manufacturer?
Four to six weeks of fieldwork across one plant and the head office, then a further quarter to confirm the fixes hold. The slowest part is usually reconciling the vendor and item masters, not the site visit itself.
Do we need to change our ERP first?
No. All seven checkpoints work in Tally, Zoho, SAP, Oracle or a spreadsheet, because they control the sequence of approvals rather than the software. Fix the process first. A new ERP built on the old approval logic simply automates the same leak at higher speed.
How much does a control review cost in India?
Most Indian firms price it as a fixed fee against a defined scope, then a monthly retainer if you want the fixes monitored. The fee moves with plant count, transaction volume and the state of your masters. Ask for the scope in writing, naming which of the seven checkpoints are in and which are out.
Start with the one that takes a day
If you are not sure which of the seven you are exposed on, run your vendor master against current Udyam status first. That check usually takes a day, and it tells you quickly how well the rest of your controls are holding. Schedule an Appointment and we will work through the list with you.
