Store and branch governance
Risk: Branches operate with informal approvals, weak surprise-check cadence or inconsistent local compliance ownership.
Controls
- Branch authority matrix
- Store visit checklist
- Opening/closing checklist
- Exception and escalation tracker
Tests
- Inspect current delegation matrix
- Review branch-visit coverage and overdue visits
- Sample opening/closing controls
- Trace exceptions to owner, due date and closure evidence
Evidence
Delegation matrix, store SOP, visit report, branch exception log, escalation emails and action-taken tracker.
POS sales and billing completeness
Risk: Sales are under-recorded, deleted, split, back-dated or not reconciled between POS, ERP, payment gateway and GST records.
Controls
- POS day-end close
- Invoice-number sequence control
- Void/delete approval
- POS-to-ERP reconciliation
Tests
- Reconcile POS day summary to ERP and bank/payment gateway
- Check gaps, duplicate bills and cancelled invoices
- Review high-value manual invoices
- Tie taxable sales to GST return support
Evidence
POS day report, invoice sequence report, cancellation log, ERP sales register, payment gateway settlement and GST working.
Cash, card, UPI and wallet collections
Risk: Collections are delayed, skimmed, posted to wrong dates, or not matched to bank settlement and cash deposit evidence.
Controls
- Cash drawer count
- Daily deposit control
- Payment-mode reconciliation
- Settlement exception review
Tests
- Match cash counted to POS cash sales and bank deposit
- Reconcile card/UPI/wallet settlements to bank
- Age pending settlement differences
- Review cash shortages and overages
Evidence
Cash count sheet, cashier handover, bank deposit slip, bank statement, payment gateway settlement file and shortage approval.
Inventory receiving, transfers and shrinkage
Risk: Stock is lost, moved between locations, received short, written off or sold without accurate system movement evidence.
Controls
- GRN and receiving check
- Inter-branch transfer approval
- Cycle count programme
- Shrinkage review
Tests
- Match supplier invoice, GRN and stock ledger
- Reconcile inter-branch transfers in transit
- Compare physical counts to book stock
- Review shrinkage by SKU, store and employee shift
Evidence
GRN, supplier invoice, stock ledger, transfer note, goods-in-transit ageing, cycle count sheet and shrinkage report.
Discounts, schemes and price overrides
Risk: Discounts, loyalty benefits, coupons or manual price overrides are granted outside policy or used to hide leakage.
Controls
- Price master approval
- Promotion calendar
- Manual discount limits
- Coupon and loyalty reconciliation
Tests
- Compare discounts to approved scheme period and SKU/customer rules
- Review manual overrides by cashier and store
- Test loyalty redemptions and coupon utilisation
- Investigate margin-negative sales
Evidence
Price master, scheme circular, discount dump, override approval, loyalty ledger, coupon report and margin exception list.
Returns, refunds and exchanges
Risk: Refunds or exchanges are processed without customer evidence, duplicate approval, inventory return or payment reversal.
Controls
- Return policy and reason codes
- Refund approval matrix
- Original invoice matching
- Returned-stock inspection
Tests
- Match returns to original sale and payment reversal
- Inspect high-value or repeated refunds
- Check returned stock receipt and condition
- Review refunds just below approval limits
Evidence
Return note, original invoice, customer acknowledgement, payment reversal proof, stock receipt, inspection note and approval trail.
Ecommerce and marketplace reconciliation
Risk: Online orders, marketplace commissions, returns, COD collections or delivery exceptions are not reconciled to books.
Controls
- Order-to-dispatch matching
- Marketplace settlement reconciliation
- COD ageing review
- Return-to-origin control
Tests
- Reconcile orders to dispatch and invoice data
- Match marketplace settlement to sales, fees and bank receipt
- Age COD receivables and delivery exceptions
- Review cancelled and RTO orders
Evidence
Order dump, dispatch manifest, invoice register, marketplace settlement file, COD report, RTO list and bank statement.
Store payroll, attendance and incentives
Risk: Attendance, overtime, incentives or temporary staff payments are processed without branch-level evidence.
Controls
- Attendance approval
- Roster and overtime control
- Incentive scheme approval
- Exit and access removal checklist
Tests
- Match attendance to roster and payroll inputs
- Review overtime and temporary staff approvals
- Recompute selected incentives
- Check exited employees for payroll and POS access removal
Evidence
Roster, attendance report, payroll input file, incentive working, approval mail, exit checklist and access-removal evidence.
POS and branch ITGC
Risk: Cashiers, store managers or support users can change prices, void bills, alter stock or export data without adequate access control.
Controls
- Role-based POS access
- Privileged access review
- Audit-log retention
- Master-data change approval
Tests
- Review POS users and roles by store
- Test leaver access removal
- Sample price/SKU/tax master changes
- Inspect void, delete and refund audit logs
Evidence
POS user list, role matrix, leaver list, access review, audit logs, master change register and UAT/approval evidence.
