Home › Internal audit · Risk advisory · Control transformation
Internal audit · Risk advisory · Control transformation
See the risk. Protect the value.
Control-led assurance for manufacturing enterprises. Not checklist completion — control outcomes that protect cash, margin, assets and continuity.
After the report
We stay until the finding stops being possible.
A finding that sits in a PDF changes nothing. So we do not audit and hand over. The control is rebuilt — and where the fix takes more, we build the software that catches the deviation the day it happens, train the people who run the process, or reshape how the work is owned.
Find the value, fix the control, validate the outcome.
The management agenda
The questions leadership cannot leave unanswered.
We connect operational signals to cash, margin, risk and scalable growth. Every one of these questions lands somewhere specific — a process, a document trail, a set of controls that either held or did not.
Sales are up — where is the cash?
Are collections, credit terms, disputes and deductions preventing revenue from converting into liquidity?
Revenue is growing — is it quality growth?
Are discounts, returns, credit risk and overdue receivables weakening the value behind reported sales?
Where is margin leaking?
Are pricing, purchase rates, yield loss, rework, freight and claims quietly eroding contribution?
Is inventory productive, or blocked cash?
Are excess, ageing, inaccurate or slow-moving stocks locking working capital and hiding valuation risk?
Are operating costs creating value?
Are manpower, capacity, downtime, overhead and vendor spend aligned with output and service levels?
Can the business scale without control failure?
Are governance, ERP access, approvals, ownership and management information strong enough for growth?
Coverage
Coverage selected for the risk it reduces.
This is the map of where we look.
| Audit covers | Risks addressed | Management advantage |
|---|---|---|
| P2P · Procure-to-Pay | Unauthorised buying · vendor and master fraud · rate or quantity mismatch · duplicate or early payment | Purchase-cost integrity · controlled cash outflow · a compliant supplier cycle |
| O2C · Order-to-Cash | Weak credit · price and discount leakage · dispatch error · returns and disputes · delayed collection | Revenue quality · margin protection · faster cash conversion · reliable receivables |
| TPM · Job work | Inflated conversion rates · outsourced stock loss · excess consumption · quality and IP exposure | Protected material · controlled job-work cost · reliable output · brand assurance |
| Inventory | Master and access weakness · book–physical variance · ageing · wrong valuation · scrap leakage | Stock accuracy · working-capital release · asset custody · reliable financial reporting |
| Production | Plan variance · BOM error · yield loss · downtime · rework · scrap and safety exposure | Higher throughput · accurate cost · margin protection · quality and asset reliability |
| Travel | Policy override · non-competitive rates · duplicate or unsupported claims · pending advances | Spend discipline · clean expense accounting · faster settlement |
| Logistics | Excess freight · vehicle under-use · transit delay or loss · demurrage · missed claims · duplicate bills | Lower logistics cost · delivery assurance · claim recovery · accurate freight payment |
Cross-cutting tests run on every engagement: ERP access and overrides · master data · approvals · duplicate analytics · contract and SLA · accountability · recovery tracking.
The symptom you arrive with, and what sits under it
“Consumption is regular. Purchase cost keeps increasing.” — Procure-to-Pay
From approved need to accurate, compliant cash outflow.
- Demand plan, stock and open-PO netting, MOQ, lead time, budget → excess buying, idle stock, cash trapped in inventory → lower working capital, disciplined procurement.
- Vendor due diligence, share-of-business matrix, pricing comparison and vendor evaluation, should-cost, non-L1 approval → inflated rates, conflict of interest, a weak or dependent vendor base → purchase-cost integrity, a reliable supply base.
- PAN, GST, MSME and bank validation; maker-checker on the vendor master → fictitious or duplicate vendors, unauthorised bank or master changes → fraud and tax protection, a clean vendor master.
- PO–GRN–invoice three-way match; duplicate, advance and MSME tests → overbilling, early or duplicate payment, MSME delay and interest → controlled cash outflow, a compliant payment cycle.
Coverage is finalised with management after process walkthrough and data availability review.
“Sales increase, cash flow decreases.” — Order-to-Cash
From customer acceptance to timely, fully supported collection.
- Customer KYC — PAN, GST and master validation; agreement, security and recourse → invalid customers, linked exposure, weak recovery rights → a safer customer portfolio, stronger legal recourse.
- Credit limit and period approval; ERP block, override and open-order review → unauthorised credit, bad debt, lost or delayed sales orders → credit discipline, revenue conversion.
- Price and scheme masters, discount application; invoice, dispatch, LR and POD, cut-off → price and margin leakage, revenue and dispatch error → margin protection, accurate revenue recognition.
- Receipt allocation and ageing; dispute, return and credit-note review → unapplied receipts, high DSO, receivable blockage → faster collections, a reliable debtor position.
Coverage is finalised with management after process walkthrough and data availability review.
“Job-work material sent, recovery not fully tracked.” — TPM / Job work
Protect outsourced material, conversion cost, quality and brand.
- Capability, capacity and should-cost; KYS, licence, EHS, IP and contract → unsuitable job-workers, inflated rates, legal, safety and IP exposure → controlled conversion cost, protected brand and continuity.
- Job-work orders, rates and terms; lot and shade issue, acknowledgement → unauthorised issue, incomplete sets, delayed or unreturned material → material custody, delivery assurance.
- Vendor-site WIP and FG with ageing; input–output, loss, physical check → excess consumption and wastage, inventory loss, wrong WIP and FG → accurate job-work stock, yield and working-capital control.
- Quality, rework and rejection; receipt–invoice match, debit and GST → quality failure, duplicate billing, unrecovered claims, GST leakage → reliable output quality, correct billing and recovery.
Coverage is finalised with management after process walkthrough and data availability review.
“Book stock reliability doubtful.” — Inventory
Make quantity, movement, ageing and valuation trustworthy.
- Item, UOM, lot, shade and location masters; access, maker-checker, receipt → duplicate or incorrect codes, unauthorised master changes → traceability and clean data.
- Storage and stacking, issue and return; transfer, gate pass, FIFO → pilferage, untracked movement, lot or shade mixing and damage → asset protection, accurate material movement.
- Independent physical count; cut-off, book reconciliation, root-cause analysis → book–physical variance, unsupported stock adjustments → stock accuracy, accountable variance closure.
- FIFO and cost, WIP and FG valuation; ageing, provision, scrap and write-off → wrong valuation, obsolete stock, unauthorised write-offs and scrap loss → reliable financials, working-capital release.
Coverage is finalised with management after process walkthrough and data availability review.
“Repeated production delays.” — Production
Convert plan, capacity and material into profitable output.
- Plan versus actual, order priority; capacity, manpower, line loading → plan variance, idle capacity, delivery failure → higher throughput, predictable delivery.
- BOM version and approval, consumption; WIP and FG booking, cut-off and closure → incorrect BOMs, excess issue, cost error, aged WIP → accurate product cost, clean production accounting.
- Input–output, marker and cut plan; wastage, process loss, scrap → yield loss, excess wastage, scrap leakage and under-realisation → material and margin protection.
- Efficiency, downtime and maintenance; quality, rework, EHS, labelling → breakdown and rework, quality failure, safety and customer exposure → asset reliability, quality and EHS assurance.
Coverage is finalised with management after process walkthrough and data availability review.
Travel — control travel cost, policy compliance and advance settlement
From policy eligibility to a settled advance.
- Policy eligibility and limits; pre-trip approval, exceptions → policy overrides, unauthorised trips, excess class or mode spend → policy discipline, controlled employee spend.
- Vendor selection and rate comparison; contract, SLA, performance → non-competitive rates, vendor concentration, SLA failure → lower travel cost, reliable service.
- Invoice, itinerary and support; duplicate, cancellation and GST tests → unsupported or duplicate bills, cancellation and tax leakage → clean expense accounting, recoverable tax and credits.
- Employee claims and business purpose; advance settlement and ageing → fictitious or excess claims, long-pending advances → faster advance closure, controlled reimbursement.
Coverage is finalised with management after process walkthrough and data availability review.
Logistics — optimise freight while protecting delivery, inventory and claims
From transporter selection to a verified freight bill.
- Transporter selection and evaluation; lane rates, contract, scorecard → excess freight rates, weak vendors, concentration and service risk → lower freight cost, stronger vendor performance.
- Vehicle availability and loadability; type, capacity, route, item master → under-utilised vehicles, wrong vehicle, rate or master error → better utilisation, avoidable-freight reduction.
- Dispatch, LR and POD, turnaround time; detention, demurrage, insurance → delivery delay, transit loss, unrecovered damage claims → delivery assurance, faster claim recovery.
- Contract-rate bill verification; weight, CFT and carton checks, duplicates, approval → duplicate or incorrect freight bills, unsupported payments, missed penalties → accurate freight payment, leakage prevention.
Coverage is finalised with management after process walkthrough and data availability review.
The method
Ground reality to board action.
Evidence is built before an observation is raised.
We do not begin with a checklist. We begin with the value management is trying to protect.
Ground-level understanding
Walk the operation; understand roles, pain points and actual practice.
Full-population analytics
Extract ERP and software data; identify patterns, outliers and exceptions.
Software control testing
Test access, workflow, approvals, masters, overrides and system logic.
Process and physical testing
Validate the end-to-end process: documents, stock, assets, field reality.
End-user clarification
Discuss exceptions and grievances with process users and owners.
Evidence and management response
Obtain support, root cause, clarification and the management position.
Risk rating and impact
Rate every validated issue from lower to critical and quantify exposure.
Board reporting and control fix
Present observation, action, owner and timeline; support implementation.
Observation quality depends on evidence, fair clarification and a practical control response — not on assumption.
The cases
Our audits do not stop with an observation.
We trace the transaction to its operational source, validate the exception with the process owner or a third party, quantify the value, and follow the action through. Each case carries its classification, and the classification is the point: recovered means the money came back. Prevented means it never left.
Fabric that existed in records, but not in accountability
The vendor ledger carried the fabric for years. The vendor’s floor did not. We reconstructed the complete movement trail — 21 dispatch documents covering 2019 to 2022 — matched delivery records against the vendor ledger, and carried out physical verification at the vendor’s premises. The first reconciliation was blunt: 13,622 kg dispatched, 5,103 kg accounted for, 8,519 kg unconfirmed. Formal confirmation followed. Then a payment hold. Then sustained follow-up, until 6.9 tonnes of old fabric came back onto the company’s floor in March 2023.
RECOVERED — ₹29.21 lakh · March 2023 | Control strengthened: vendor stock is now confirmed periodically — by challan, lot and ageing — with payment linked to unresolved material.
One delivery, two invoices
Two vendors had billed twice for work done once, and both ledgers looked balanced. A ledger may look balanced, but the delivery challan is the operational fingerprint. We matched that fingerprint across the full invoice population — invoice to challan to material movement to vendor statement — and the duplicates surfaced. Because the exception was detected before duplicate accounting and payment, the company avoided the loss.
PREVENTED — ₹17.95 lakh | Control strengthened: duplicate detection now matches invoice, challan, quantity, date and amount — never the invoice number alone.
Freight leakage rarely arrives as one large invoice
It accumulates quietly, one small override at a time. Across three transporters, April to October 2022, we ran trip records against route-wise kilometre norms and eligible charges, then against the bills as submitted and the payments as made. The overclaims were individually small and collectively steady. Norm-based analytics converted that noise into an actionable recovery.
RECOVERED — ₹3.15 lakh | Control strengthened: a central rate master, route-wise kilometre norms, exception approval and verification before payment.
The rejection was on record. The recovery was not.
A quality rejection is not a saving merely because it appears in a report. We traced the rejected lot through its job-work history, established where responsibility actually sat, and validated it with the vendor. A debit note followed, and the vendor’s credit reached the books. That last step is the one that matters — without it, rejection reports remain operational statistics and valid claims quietly expire.
RECOVERED — ₹2.34 lakh · debit raised February 2023 | Control strengthened: a time-bound claim register with an owner, debit-note status, vendor-credit proof and closure validation.
The discount was negotiated. The purchase order never carried it.
Everything downstream agreed with the PO. The PO disagreed with the deal. Comparing approved quotations against released purchase orders, we found negotiated terms that had never entered the order. The exception was clarified with the process owner and the PO amended — before a single payment ran against the wrong rate.
PREVENTED — ₹1.27 lakh | Control strengthened: a commercial-term checklist and independent pre-release validation for material-value purchase orders.
The findings register
These stories are anonymised to protect client and vendor confidentiality. Values are based on historical internal-audit records supplied for review. They should be described as engagement-specific outcomes, not guaranteed future savings.
Not every exposure is a leak
The notice that was wrong.
One arrived by post: a tax department notice demanding ₹3.02Cr. The notice was wrong. Proving that is not a matter of saying so — we matched every record the assessment touched, line by line, until the file answered for itself. The disputed liability came down from crores to tens of lakhs.
The difference between those two numbers is what a complete, defensible set of records is worth on the day someone official disagrees with you.
What management receives
Every output is built for a decision, an owner and closure proof.
Executive readout
Priority risks and the decisions they need.
Risk-rated findings
Evidence and quantified impact.
Action tracker
Owner, due date, status.
Closure validation
Proof of the completed action.
| Boundary | How it holds |
|---|---|
| Governance | Board / Audit Committee cadence |
| Confidentiality | NDA + information wall |
| Independence | No self-review or operating role |
| Boundary | No statutory / tax certification |
We do not leave management with a report stack. We leave an action system.
A finding that sits in a PDF changes nothing. So we do not audit and hand over. The control is rebuilt — and where the fix takes more, we build the software that catches the deviation the day it happens, train the people who run the process, or reshape how the work is owned.
The smallest way to begin
“I need a 2–3% improvement in profit. Where is it?”
Some owners arrive with no single symptom — just that question. The Diagnostic Business Audit is built for it. We review the business end to end, find the priority areas where correcting leakage will actually move profit, and hand you the list: ranked, with what each area needs. From there you choose what to fix, and with whom.
It is the smallest way to engage us, and the fastest way to find out what working with us is like.