Donation receipts, donor records and 80G evidence
Risk: Donations are recorded without complete donor details, valid receipts, bank traceability, 80G reporting support or donor restriction tagging.
Controls
- Receipt numbering control
- Donor master validation
- Bank reconciliation
- 80G evidence review
Tests
- Trace sampled receipts to bank credit and donor record
- Review cancelled/duplicate receipts
- Check PAN/address/80G certificate data for sampled donors
- Test anonymous/cash donation flags
Evidence
Donation receipt, donor master, bank statement, payment reference, 80G certificate/reporting file and cancellation log.
Grants, restricted funds and utilisation certificates
Risk: Grant funds are used outside donor conditions, reported without evidence or carried forward without clear restricted-fund accounting.
Controls
- Grant agreement review
- Budget-to-actual tracking
- Restricted fund ledger
- Utilisation certificate review
Tests
- Map grant agreement conditions to expense heads
- Reconcile grant receipts, spends and closing restricted balance
- Sample utilisation certificate evidence
- Review overrun or unspent grant treatment
Evidence
Grant agreement, donor budget, restricted-fund ledger, expense vouchers, utilisation certificate, donor report and approval notes.
FCRA receipts, bank account and utilisation
Risk: Foreign contribution is received, transferred, invested or spent without FCRA registration/prior permission, designated account controls or proper utilisation evidence.
Controls
- FCRA registration validity check
- Designated bank account control
- FC receipt and utilisation ledger
- Annual return evidence review
Tests
- Verify FCRA registration or prior permission status
- Trace foreign receipts to the designated bank account and FC ledger
- Sample utilisation against approved objects and programme evidence
- Review annual-return support and old balances
Evidence
FCRA registration/prior permission, designated bank statement, FC receipt ledger, utilisation ledger, donor terms, vouchers and FCRA return support.
Programme expenses and beneficiary evidence
Risk: Programme expenditure is claimed without beneficiary evidence, field verification, budget linkage or proof that spend reached the intended activity.
Controls
- Programme budget approval
- Beneficiary register
- Field verification
- Expense-to-activity tagging
Tests
- Sample programme expenses to beneficiary lists, attendance or delivery proof
- Review duplicate beneficiaries and unusual reimbursements
- Tie spends to programme budget and donor report
- Check field-visit evidence
Evidence
Programme plan, budget, beneficiary list, attendance, distribution proof, field report, photos where appropriate and expense voucher.
Procurement, vendors and conflict checks
Risk: Goods or services are procured from related, conflicted, unapproved or split vendors without competitive evidence.
Controls
- Vendor onboarding
- Conflict declaration
- Quotation/tender control
- Purchase approval matrix
Tests
- Review vendor onboarding and related-party declarations
- Test split purchases below approval threshold
- Match PO, GRN/service note, invoice and payment
- Check tender/quotation evidence for sampled buys
Evidence
Vendor master, KYC, conflict declaration, quotation/tender file, PO, GRN/service confirmation, invoice and payment proof.
Payroll, consultants, volunteers and reimbursements
Risk: Payroll, consultant fees, honorarium, volunteer reimbursements or travel claims are unsupported, duplicate, excessive or not aligned with project budgets.
Controls
- HR master control
- Timesheet/activity approval
- Consultant contract review
- Reimbursement policy
Tests
- Match payroll to HR master, attendance and bank payments
- Review consultant deliverables and TDS where applicable
- Sample travel and field reimbursements
- Check allocation to restricted projects
Evidence
HR master, appointment/contract, attendance, timesheet, deliverable, claim form, approval, bank proof and project allocation.
Corpus, endowment, investments and fund accounting
Risk: Corpus, endowment or restricted funds are mixed with general funds, invested outside policy or used without donor/board approval.
Controls
- Fund classification review
- Board-approved investment policy
- Investment register
- Corpus utilisation approval
Tests
- Reconcile corpus and restricted fund balances
- Verify investment holdings and income allocation
- Review donor restrictions and board approvals
- Test fund transfers between project and general accounts
Evidence
Fund ledger, donor restriction note, board minutes, investment register, bank/FD statements and income allocation working.
Statutory registrations, returns and tax compliance
Risk: 12AB, 80G, FCRA, CSR-1, TDS, GST where applicable or statutory returns lapse without tracking, causing exemption, donor or grant risk.
Controls
- Compliance calendar
- Registration validity tracker
- Return filing review
- Exception escalation
Tests
- Check validity of key registrations and renewal dates
- Review income-tax, TDS, FCRA and CSR-1 evidence where applicable
- Assess GST applicability for taxable activities
- Age delayed filings and notices
Evidence
12AB/80G orders, FCRA certificate, CSR-1 acknowledgement, Darpan ID, return acknowledgements, challans, notices and compliance tracker.
Governance, related parties, MIS and safeguarding controls
Risk: Board oversight, related-party transactions, management information, whistleblowing, safeguarding or data controls are weak or undocumented.
Controls
- Board meeting calendar
- Related-party register
- MIS review
- Safeguarding and data-access policy
Tests
- Review board minutes and approval trail
- Test related-party transactions and conflict disclosures
- Check programme/finance MIS quality
- Review user access to donor, beneficiary and payroll data
Evidence
Board minutes, policy register, related-party register, MIS pack, access list, incident log and corrective-action tracker.
