Simplified Internal Controls for MSME
Executive Perspective
Corporate governance is a term often understood as applicable to large enterprises, within which deployment of internal controls is a crucial element. An effective internal control system plays a key part in helping a company achieve business objectives and financial success. It provides a framework using which employees can deploy sound controls over their areas of business and keep keen watch to ensure the long-term security of the business. In MSME, which typically are thin on resources with, quite often, ownership and management being the same, in the author’s opinion, components “Control Activities” and “Monitoring Activities” of the COSO framework become more critical. Read on…
1. The MSME Landscape and Structural Vulnerabilities
Micro, Small and Medium Enterprises (MSME) constitute the backbone of our economy and have contributed significantly to the Indian economy in terms of employment generation and rural industrialisation. This sector has registered remarkable growth in scale of production, quantum of investment, and overall contribution to national GDP. Despite some infrastructural deficiencies and challenges like flow of institutional credit and inadequate market linkages, MSMEs have proved their mettle in all sectors. All MSMEs are spiritedly focusing on increasing the business.
Key Challenges Faced by Indian MSMEs:
- Inappropriate opportunities of adequate capital and institutional credit;
- Poor and inadequate infrastructural facilities;
- Inadequate access and marketing linkages;
- Lack of skilled and qualified human resources;
- Limited access to new and modern technology; and
- Lack of specialized knowledge regarding complex regulatory and statutory practices.
2. The Foundational Imperative: Why MSMEs Need Internal Controls
Keeping in mind the above challenges, the role of internal auditors and internal controls becomes more important for MSMEs who are always facing rigorous competition and lack of adequate best practices in the sector. For most MSMEs, the Board of Directors has to state in their report whether the company has adequate internal controls over financial reporting (ICFR) in place and whether these are operating effectively. This is more about assuring that financial statements are reported correctly.
However, in a forward-looking sense, MSMEs should aim to build a robust internal controls system, which will address broader operational risks and controls and compliance and bring substantial business benefits.
“Controls protect weak people from temptation, strong people from opportunity and innocent people from suspicion.”
– Institute of Internal Auditors (IIA) Magazine, August 1977
The above quotation demonstrates that effective internal control plays a critical role not only in organisations, but also in the life of individuals. MSMEs with resource constraints are often discouraged from developing sound internal controls, making them vulnerable to fraud, financial errors and non-compliance.
Internal controls play an important role in the prevention and detection of fraud and physical protection of assets, and moreover lead to high operational efficiency. Therefore, if there is a strong system of internal controls to monitor and run businesses, the prospect of bankruptcy reduces.
Adapting the COSO 2013 Framework for MSMEs:
The COSO framework (encompassing Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring Activities) is the universal guiding document for internal controls. While deployment of the full COSO framework may be complex, costly, and overkill for MSMEs, critical elements can certainly be adapted and deployed.
Statutory Auditors can play a transformative role in assisting MSMEs to establish the requisite framework—spanning Risk Assessment and Control Activities—testing controls annually during the audit. Aligned with simpler accounting ERPs typically used by MSMEs (such as Tally, Zoho Books, etc.), select Control Activities fulfill statutory reporting requirements while boosting day-to-day operational efficiency.
3. Practical Control Activities Matrix for Trading & Manufacturing MSMEs
The following matrix delineates pragmatic, high-impact Control Activities across seven core operational cycles. Modern ERP packages contain these features which can be quickly activated without prohibitive cost:
| Operational Area | Control Activity | Operational Notes & Risk Mitigation |
|---|---|---|
| Purchasing |
Enable ERP software to perform an automated 3-way match of PO (purchase order), GR (goods received) and invoice. Monthly review of GR for which no invoice received, and of invoice received for which no GR made, should be performed. Unmatched items open for more than 30 days should be followed up and closed. |
Enables quicker processing and reduced processing errors. Ensures timely and complete accounting and reporting. Nowadays, this is also mandatory for seamless GST input tax credit (ITC) claims. |
| Review changes to vendor master data independently on a regular basis (at least quarterly). | Unauthorised changes to vendor details, particularly changes to bank account numbers, can be promptly detected. | |
| Review cost of key items (determined using the 80/20 Pareto rule), comparing with prior year and budget costs. | Allows management to spot procurement errors, enable timely pricing adjustments, and maintain profitability at the individual item level. | |
| Inventory | Perform cycle counts monthly or quarterly to ensure all inventory items are counted and reconciled to the ERP at least twice a year. Depending on the number of items, prioritisation can be established using the 80/20 rule. | Typically, MSMEs perform inventory counting only annually as part of the Statutory Audit. Discrepancies between physical and book stock surface too late; perpetual cycle counting eliminates sudden year-end write-offs. |
| An inventory ageing report should be prepared twice or thrice a year and reviewed for quality and obsolescence issues; assessment and approval of provisions for slow/non-moving inventory items should be documented. | Enables timely inventory liquidation actions, discounting strategies, and prevents working capital lockup. | |
| Accounts Receivable (AR) | On a monthly basis, an AR ageing report should be prepared, segregating receivable balances into: not yet due, currently due, and overdue. Overdue AR should be categorized into aging buckets of 30, 60, 90, and 180 days, or similar. | Enables timely dunning, legal follow-ups, or stop-sale actions on defaulting buyers, dramatically reducing the risk of bad debts. |
| All AR balances should be reviewed monthly for collectability and bad debt provisions established as appropriate. | Coupled with Days Sales Outstanding (DSO) calculations, regular reviews directly improve operating cash flows and liquidity. | |
| Sales & Revenue | Establish credit limits for customers. A simple credit scoring mechanism with highest weightage to payment history can be easily configured in most ERP systems. Other factors like customer reputation and sales staff opinion can be considered. | Pre-empts unauthorized credit extensions and minimizes defaults and collection delays. |
To enable correct sales and inventory cutoff:
|
Prevents unbilled dispatches, delayed receivables collections, and incorrect revenue recognition. | |
| Review product and customer pricing master data on a regular basis, and confirm that any pricing modifications are formally authorized. | Enforces pricing policy integrity and detects rogue discounting or unauthorized billing rates. | |
| Cash & Banking | Perform weekly or monthly bank reconciliations using automated ERP reconciliation tools. Unmatched items open for more than 30 days must be rigorously investigated and cleared. | Provides early fraud detection, flags uncredited deposits, and triggers prompt recovery in cases of bounced customer cheques. |
| Payroll | Comparison of current month payroll totals to prior month totals is adequate when headcount is constant. If headcount fluctuates significantly, a detailed variance review must be performed. | Identifies computational discrepancies, unapproved overtime, and phantom wage escalations. |
| Independent review of changes to employee master data (new additions, salary revisions, bank account numbers). | Critical for fraud prevention and eliminating “ghost employees” on payroll registers. | |
| Balance Sheet Accounts |
Reconciliation frequency should be tiered according to transaction volume and monetary value:
|
Facilitates timely collection or settlement of tender deposits, earnest money, rental advances, and statutory liabilities. |
| Related-Party Accounts | Regular, documented reconciliation of inter-company and related-party balances. Unmatched balances must be resolved immediately rather than parked in “suspense” accounts. | With heightened statutory and regulatory focus on related-party transactions, this control prevents transfer pricing disputes and compliance breaches. |
4. The “Traffic-Light” Monitoring System
To keep internal control monitoring simple and intuitive for MSME owner-managers, a visual “traffic-light” dashboard can be deployed:
Completed & Documented: The control activity has been executed on schedule, verified, and complete audit documentation is archived.
Completed, Inadequately Documented: The control was performed, but formal sign-offs, reconciliation trails, or supporting vouchers are missing.
Overdue / Unperformed: The control should have been performed by now, but is unexecuted or only partially completed. Immediate management escalation required.
Dual-Dimensional Assessment: Beyond tracking whether a control was performed on time, the dashboard evaluates operational effectiveness—for instance, noting where a bank reconciliation was completed on time, but long-outstanding unreconciled items have been left uninvestigated.
5. Remedial and Cost-Effective Measures for MSMEs
MSMEs can establish robust internal control health without massive consulting budgets by institutionalizing seven basic disciplines:
- 1. Document Control: Enforcing strict sequential pre-numbering of purchase orders, sales invoices, goods dispatch notes, and cheques. Pre-numbering instantly highlights missing transactions or duplicate billings.
- 2. Timely Financial Account Reconciliations: Eliminating items dwelling in suspense or ledger accounts for long durations, which often mask accounting errors or misappropriations.
- 3. Independent Payroll Review and Sign-off: Prior to batch payment release, an independent review of payroll sheets verifies headcount, hourly rates, and deductions—a vital role where Chartered Accountants add immediate value.
- 4. Surprise Physical Checks of Petty Cash & Inventory: Conducting unannounced surprise physical counts of petty cash boxes and critical inventory items by an external professional expert to safeguard physical assets.
- 5. Segregation of Requisition and Payment Authorisation: Separating the personnel who raise purchase indents from those who approve purchase orders and disburse payments.
- 6. Monthly Business Credit Card Reconciliations: Enforcing strict monthly statement reconciliations where corporate cardholders must furnish valid commercial vouchers for all expenses.
- 7. Prior Approval for Staff Expense Claims: Mandating standardized expense claim forms with attached supporting invoices before reimbursing employee travel or entertaining costs.
Strategic Business Dividends of Simple Controls:
Apart from fulfilling statutory reporting requirements under the Companies Act, these pragmatic measures:
- Yield highly accurate, dependable financial statements;
- Enable data-driven commercial decisions using clean MIS reports;
- Substantially lower operational risks (bad debts, stock write-downs, inventory theft);
- Empower employee upskilling and operating confidence;
- Significantly enhance bank lender, credit rating, and investor confidence; and
- Provide the Board with the assurance necessary to expand business operations organically or inorganically.
6. Conclusion: Elevating MSMEs for ‘Make in India’ and Global Value Chains
The MSME sector possesses immense potential to pushbutton accelerated industrial growth in our developing economy and is well-prepared to support national initiatives like ‘Make in India’. With a proactive risk management focus, internal audit moves beyond traditional retrospective checking to proactively mitigate risks before they escalate into business crises.
Modern commerce is knowledge-intensive, creating complex operational processes and heightened risk exposures. A robust, simplified internal control framework strengthens MSME foundations, ensuring sustainable long-term development.
The Transformative Role of Auditing Professionals:
As India captures an expanding share of global trade and international supply chains, efficiently governed MSMEs are indispensable. Auditing professionals—both Internal and Statutory Auditors—can contribute immense strategic value by partnering with MSMEs to design, operate, and mature these simplified control frameworks.