Compliance universe and ownership
Risk: Applicable registrations, filings, licences or owners are incomplete, leading to missed returns or unassigned compliance risk.
Controls
- Compliance universe register
- Owner matrix
- Applicability review
- Compliance calendar
Tests
- Compare registrations to entity activities and locations
- Review owner sign-offs
- Check new entity/location/product triggers
- Inspect overdue items and escalation trail
Evidence
Entity structure, registrations, licences, compliance calendar, owner matrix, board/audit committee updates and overdue tracker.
GST outward supply and return filing
Risk: Sales, credit notes, export supplies, e-invoices or GSTR-1/3B values are incomplete, late or inconsistent.
Controls
- Invoice sequence control
- E-invoice/e-way bill review
- GSTR-1 to 3B reconciliation
- Return approval
Tests
- Reconcile sales register to GSTR-1 and 3B
- Test cancelled/credit-note sequences
- Inspect e-invoice/e-way bill exceptions
- Check filing dates and reviewer evidence
Evidence
Sales register, GST returns, e-invoice data, e-way bills, credit-note register, challans and reviewer sign-off.
GST input tax credit and reversals
Risk: ITC is availed without vendor reporting, eligibility review, blocked-credit screening or Rule 42/43 reversal support.
Controls
- GSTR-2B reconciliation
- Blocked-credit checklist
- Vendor follow-up
- ITC reversal working
Tests
- Match purchase register to GSTR-2B
- Test blocked-credit categories
- Review unmatched ITC ageing
- Check reversal and re-availment approvals
Evidence
Purchase register, GSTR-2B, vendor confirmations, blocked-credit working, Rule 42/43 computation and reversal entries.
GST payments, refunds and notices
Risk: GST liability, interest, late fees, refunds or notices are not computed, paid, responded to or tracked completely.
Controls
- Liability review
- Challan approval
- Refund support file
- Notice tracker
Tests
- Agree liability to challans and cash/credit ledger
- Review interest/late fee working
- Inspect refund support
- Age open notices and responses
Evidence
GST ledgers, challans, interest workings, refund applications, notices/orders, response files and legal/advisor correspondence.
TDS/TCS deduction, deposit and returns
Risk: Withholding is missed, applied at wrong rate, deposited late, filed under wrong form/section or unreconciled to books.
Controls
- Payment-code mapping
- TDS/TCS rate review
- Monthly challan reconciliation
- Quarterly return review
Tests
- Sample payments for TDS/TCS applicability
- Reconcile GL to challans and returns
- Test lower/nil certificates
- Review return filing and correction statements
Evidence
Vendor/customer ledgers, TDS/TCS workings, challans, Form 24Q/26Q/27Q/27EQ or current equivalent forms, certificates and TRACES reports.
Income-tax forms, advance tax and tax audit tie-outs
Risk: Advance tax, self-assessment tax, statutory forms, Form 3CD data or tax-audit schedules are late, unsupported or inconsistent.
Controls
- Tax calendar
- Computation review
- Form filing tracker
- Tax audit tie-out
Tests
- Review advance-tax computation and challans
- Check statutory form filing evidence
- Tie Form 3CD clauses to ledgers
- Inspect management certification
Evidence
Tax computations, challans, income-tax portal acknowledgements, Form 3CD workpapers, ICDS/allowance workings and management representations.
ROC and Companies Act filings
Risk: Board/shareholder filings, annual forms, resolutions, registers or event-based forms are delayed, incomplete or inconsistent with books.
Controls
- ROC calendar
- Secretarial event tracker
- Register maintenance
- Form approval workflow
Tests
- Match board events to filed forms
- Inspect AOC-4/MGT-7 and event forms
- Check additional fee/delay cases
- Review register and minutes evidence
Evidence
MCA challans/SRN acknowledgements, board minutes, registers, annual return, financial statements, event tracker and secretarial certificates.
Payroll statutory compliance
Risk: PF, ESI, professional tax, labour welfare fund, gratuity or salary TDS compliance is inaccurate, late or unreconciled to payroll books.
Controls
- Payroll compliance calendar
- Payroll-to-challan reconciliation
- Employee master review
- Return approval
Tests
- Reconcile payroll to PF/ESI/PT/TDS challans
- Sample employee eligibility and wage base
- Review late payment interest/damages
- Check leaver and new joiner coverage
Evidence
Payroll register, employee master, PF/ESI returns, professional-tax challans, salary TDS returns, gratuity/leave workings and HRMS reports.
Portal access, maker-checker and audit trail
Risk: GST, income-tax, MCA, PF/ESI or licence portals are accessed through shared IDs, leavers, unreviewed DSCs or weak approvals.
Controls
- Portal user register
- DSC custody control
- Maker-checker filing
- Quarterly access review
Tests
- Review active users and leavers
- Inspect DSC/token custody
- Check maker/checker evidence
- Review filing audit trail and IP/user logs where available
Evidence
Portal users, DSC register, access review, leaver list, filing approvals, OTP/authorisation trail and consultant access list.
Notices, litigation and consultant management
Risk: Tax notices, assessments, appeals, consultant filings or management positions are not tracked, reviewed or escalated.
Controls
- Notice register
- Response approval
- Litigation tracker
- Consultant scope and SLA
Tests
- Age notices and hearing dates
- Review response quality and approvals
- Tie disputed demands to books
- Inspect consultant deliverables and pending list
Evidence
Notice register, portal notices/orders, response submissions, demand register, appeal files, consultant engagement letters and status MIS.
