Internal Audit: A Growth Partner for Startups

Internal Audit: A Growth Partner for Startups

India currently has the third largest ecosystem of startups globally. These start-ups are usually defined as a young, innovative company, typically within the first 10 years of operation, aiming to develop or improve products, processes, or services, or employing a scalable business model with high employment or wealth creation potential.

The start-up ecosystem in India is characterized by rapid growth over the past few years which is also inclusive ie. not restricted to metropolitan cities but has spread to tier 2 and tier 3 cities, initiatives from the Government of India through programs like “Startup India” and tax incentives, substantial funding from both domestic and international investors, tech savy work force and founders, diversified sectors like e-commerce, fintech, cleantech, deeptech and finally a bustling ecosystem with incubators , accelerators and mentorship programs and increased industry[1]academia partnerships.

Recent failures – Weworks (failed IPO in the US), FTX (the crypto currency exchange) are examples of failures aggravated by lack of good governance including internal controls systems in place. 

Start-ups globally face the following challenges that make building an internal control infrastructure difficult – 

• Founder / entrepreneur / key personnel juggling multiple roles with great risk to governance especially independent oversight
• Focus on operations and sales rather than on governance and controls
• “Speed is king” as the operative mantra due to pressure for quick turn-around and delivery of the product and services to establish market presence, that provides incentive to cut corners
• Small team and a constantly shifting environment making it more difficult to enact basic internal control procedures
• A lack of organization can also very easily cause tech startups to lose track of their cash flow, something that studies show plays a role in as many as 82% of business failures

The case for Internal Controls 

When the company is operating in hustle mode, which is the case with startups especially in the initial years, spinning up formal internal controls can feel like a costly distraction from product development, sales, and other growth priorities. However, the cost of ignoring internal controls is also huge. 

When there's a lack of clarity around spending and financial data, it breeds a culture of mistrust between founders and employees. A misaligned team is a fractured team. 

As the startup scales, so does the complexity of the financial operations. Hence, proper internal controls are essential in maintaining order amidst increasing complications, preventing chaos especially when the business is expanding. 

Irrespective of whether the company is raising the next round of investment, is getting acquired or taking the IPO route, investors and regulators tend to scrutinize internal controls and financial governance. Gaps or deficiencies send up red flags that can jeopardize funding and decrease the company’s credibility. 

The Cost of lack of internal Control: 

The hazards of poor internal control could range the entire spectrum of 

• The risk of encouraging unethical behavior resulting in frauds
• Unbridled spending resulting in cash flow issues and disproportionate cash burn
• The fines levied for non-compliances (especially statutory)
• Basic accounting mistakes, which could lead to exaggerated profits or losses and overpayment of taxes impacting credibility with investors, customers and partners.
• Lack of controls over transactions resulting in inappropriate recording of revenue
• Theft of inventory and cash
• Excess inventory purchases 

Some Basic Internal Control procedures that are required in any startup: 

Some of the basic internal control procedures that need to be in place in any start-up that goes a long way in enforcing financial and accounting discipline are – 

1. Implementing a written code of conduct to encourage ethical behavior
2. Documented policies, delegation of authority matrix
3. Paper trail around expenses, reimbursements, revenues, and intellectual property
4. Budgetary controls over expenses
5. Triggering an expenditure review for items over a threshold limit eg All expenses over Rs 50,000
6. Requiring additional approvals to perform certain transactions.
7. Separating financial responsibilities like bookkeeping and auditing
8. Standardised financial documentation/forms to be used
9. Basic reconciliations like Bank reco, GL to registers / sub-ledgers
10. Open items review eg. Open orders, uncollected invoices
11. Ageing review of advances, deposits, accruals
12. Auto-mailers that reminds the team to change passwords monthly.
13. Backing up computer data at regular intervals
14. Requiring password entry to complete a sensitive transaction 

The above list are very basic controls that need to be in place in an organisation and is not exhaustive list.

Tailoring internal controls to the Company growth stage and the role of internal audit The extent and nature of the internal controls is largely determined by the size and stage of startup. Typically, the internal controls mature as the startup goes through the various stages of growth.

Internal auditors as the experts in internal control systems, have a huge role to play in setting up, reviewing and scaling up the internal control mechanisms in the company. The role they play is different at different growth stages of the startup.

Smaller startups might have simple control systems due to fewer transactions, fewer employees, and less complexity. When a startup is in its earliest stages, the focus is often primarily on the spending side of the financial statements—typically on product development, marketing, or other operational costs. At this stage, internal controls should focus on expense approvals, vendor diligence, AP processes, and ensuring funds are being used appropriately. 

Documented approval matrix / delegation of authorities and basic SOPs for processes like payroll, expenses is required at this stage that will bring in structure to the operations and financial management. 

As a startup grows and generates more revenue, however, the need for more sophisticated internal controls becomes evident. Startups need to manage both income and expenses, increasing the complexity of financial management and the potential for errors or fraud. This drives the need for stronger internal controls that cover the greater risks and a bigger management layer being built to run the company. 

An independent review of the controls system by an internal auditor at this stage helps identify the gaps in the controls. Best practice would be to undertake this exercise at least annually. Of course, the review frequency is also guided by the scale and complexity of the operations and the rate of growth of the start-up. 

As the company acquires more customers, they also inherit the responsibility of protecting customer data, adding another layer to their internal control system. 

While the company scales and more management layers are introduced, the founding team will find themselves with less time to review expenses or invoices in detail, underlining the importance of having strong, automated internal controls in place. 

This is stage for regular internal audits and reviews. This goes a long way in introducing and enforcing the independent governance structure that comes along with internal audit while also enhancing the internal control systems that help the business sustain and grow.

As startups grow and become more successful, they face increased scrutiny from various stakeholders. Investors, auditors, and regulatory bodies will expect robust financial management and governance, including solid internal controls across the org, from accounting to IT to HR. They will also expect that companies have operated with these controls in place for a period of time and have built a culture of compliance around them. If a company has grown internationally, it must navigate and comply with unique sets of regulations across different regions. 

The presence of a robust internal audit team and process at this stage adds credibility to the company and also goes a long way in increased investor and regulator confidence in the company. 

Therefore, startups should aim to put the right tools, systems, and processes in place early on rather than waiting as they grow. Doing so will help instill a culture of sound financial management and control, preparing the company for future growth and scrutiny. This approach can make the company's financials more resilient, ultimately contributing to its long-term success. 

Building your internal control framework 

For internal controls to be effective, they need to be designed and implemented with care. Here are a few best practices: 

Conduct a comprehensive risk assessment 

This could involve financial risks, operational risks, or risks related to fraud and regulatory risks. The risk assessment should also factor growth prospects of the company in the next 12-24 months. The larger risk footprint could be due to adding new product ranges (some of which may be subject to greater regulatory overviews), new geographies (with culture, language, regulations adding to the complexity), increasing tech footprint resulting in greater exposure to IT and cyber risks. 

Document policies and communicate 

Documented policies and procedures go a long way in establishing discipline and standardisation across the processes. But, documentation alone is not enough, these policies and procedures must be evangelised through training and continuous communication.

Adopt the right financial automation tools 

Using technology helps in increasing efficiency and reducing manual error. Hence, investments in tools tailored to the pocket of the startup is a must. The scaling up of the entity operations in the next 24-36 months should also be factored in when investing in tools and technology as these should not themselves become a bottleneck to operations due to limitations in operations and scalability. 

Improve constantly 

The concept of Plan-Do-Check-Act should be adopted in internal controls ensuring constant improvement in the controls that meet business needs and prevent frauds and misstatement. 

Foster a culture of integrity 

Ultimately, the effectiveness of internal controls depends on the company's culture. Encouraging a culture of financial integrity and accountability can go a long way in ensuring the effectiveness of internal controls, especially as the company matures.

In conclusion, just as a robust sales and margin growth is essential for a company’s existence, robust internal control and audit function is one of the important pillars that helps keep the company on track financially and operationally. It is also the insurance that the company has against theft, fraud, misstatement, non-compliances and penalties that could drag the company down financially and in terms of credibility. 

Thus, the start-up needs internal controls and internal audit as much as a mature organisation. But, as said earlier, the scale and complexity should be aligned with the scale of operations and growth of the entity to make it a meaningful and sustainable activity. The ethics and culture of integrity is however the bedrock of a strong internal audit system.