CORAA
Log inRun your first audit free
CORAA University · Free tool

Finance controls health check 2026

Thirty plain questions a CFO or controller can answer in ten minutes: are vendor bank changes approved by a second person, is every bank account reconciled, are manual journals reviewed, is the audit trail on? Answer yes, partly or no to get a score for each area, the top gaps with one concrete next step each, and a one-page summary for the board or audit committee — with the full question set and an action plan in Excel for FY 2026-27.

Before you start
Answer for how things work today, not how the policy says they should. Yes means it happens every time and there is something to show for it. Partly means it happens sometimes, informally, or for some entities only. No means it does not happen. Click an answer again to clear it. Nothing you enter leaves your browser.
Vendor payments (procure-to-pay)0 of 5 answered
Is every new vendor, and every change to a vendor's bank account, approved by someone other than the person who entered it, with the bank details checked independently?
Are invoices matched to an approved purchase order and a goods or service receipt before they are passed for payment?
Is there a check for duplicate invoices and duplicate payments across the whole vendor ledger, beyond the accounting system's own same-number warning?
Is each payment released by an authorised person who sees the list of invoices being paid, within written limits by amount?
Are balances with major vendors agreed to their statements at least once a year, and are old advances and debit balances reviewed?
Sales and receivables (order-to-cash)0 of 4 answered
Does each customer have a credit limit and payment terms, approved outside the sales team and checked before dispatch?
Is every dispatch or completed service invoiced in the same period, with a month-end check for deliveries not yet billed?
Are credit notes, discounts and write-offs approved, within written limits, by someone independent of the person who made the sale?
Is the receivables ageing reviewed every month, with a named owner for each overdue account and unallocated receipts cleared?
Month-end close and reporting0 of 5 answered
Is there a written month-end close calendar with an owner and a date for each task, and is it met?
Is every balance-sheet account reconciled each month and reviewed by a second person, with old reconciling items followed up?
Are manual journal entries approved by someone other than the preparer, with the supporting paper attached?
Does the monthly MIS agree to the trial balance, and does it reach management early enough to act on?
Are intercompany balances agreed with each group entity every month? (Answer "Not applicable" for a single-entity company.)
Treasury and cash0 of 4 answered
Is every bank account reconciled at least monthly by someone who cannot make payments, with old items cleared?
Do bank payments need two people — one to prepare and one to release — on the bank portal, and is the list of signatories and portal users current?
Is there a short-term cash flow forecast that is compared with what actually happened?
Are borrowing covenants, drawing power statements, bank guarantees and fixed deposits tracked in one place with an owner?
Payroll0 of 4 answered
Are joiners, leavers and pay changes entered in payroll only against HR approval, by someone other than the person who runs the payroll?
Is the payroll register reviewed each month against the previous month, with changes in headcount and amount explained before payment?
Are employee bank accounts checked for duplicates, and is the salary paid agreed to the payroll register?
Are full-and-final settlements, recovery of company assets and removal of system access completed against an exit checklist?
Statutory compliance0 of 4 answered
Is there a compliance calendar covering GST, TDS, provident fund, ESI, professional tax, income tax and company-law filings, with a named owner and a due date for each?
Are the books reconciled to the GST returns and input tax credit to GSTR-2B each month, and TDS deducted to the returns each quarter?
Are notices and demands from tax and other authorities logged with a reply date and an owner?
Are payments to micro and small enterprise suppliers tracked against their due dates?
System access and master data0 of 4 answered
Does every user have their own login, with access that matches the job and is reviewed at least once a year, and is leavers' access removed promptly?
Is the ability to create or change masters — vendor, customer, item, price, ledger — limited to a few people and kept separate from those who post transactions?
Is the audit trail (edit log) switched on in the accounting software at all times, and are altered, deleted and back-dated entries reviewed?
Are earlier periods locked after the close, and are backups taken and a restore tested?
where the controls stand
Overall score
—
Provisional — 0 of 30 answered
In plain words
Not scored
This tool's own scale
Gaps to act on
0
0 not in place · 0 partly
What the score means
Answer the questions to see where the finance controls stand.
Scale used here: 85% and above — strong; 70% to 84% — sound, with gaps; 50% to 69% — uneven; below 50% — weak. The bands are this tool’s own and are not a standard or a comparison with other companies. The score says whether controls exist, on management’s own answers; it does not say they have been tested.
Score by area
Vendor payments (procure-to-pay) · not scored0%
Sales and receivables (order-to-cash) · not scored0%
Month-end close and reporting · not scored0%
Treasury and cash · not scored0%
Payroll · not scored0%
Statutory compliance · not scored0%
System access and master data · not scored0%
Top gaps, and one next step for each
Answer the questions above and the gaps will be listed here, most serious first.
Where this sits in company law — and where it does not

The Companies Act, 2013 looks at internal controls from three sides. In a listed company, the directors’ responsibility statement under Section 134 covers the internal financial controls the directors have laid down. Under Section 143(3)(i), the statutory auditor’s report states whether the company has an adequate internal financial controls system in place and whether those controls are operating effectively; certain smaller private companies are exempted from that reporting by notification. And under Section 138, prescribed classes of companies must appoint an internal auditor — the internal audit applicability checker works that out. Where a company has an audit committee under Section 177, the committee can call for the auditors’ comments on internal control systems.

This health check is none of those. It is management’s own quick view of whether ordinary finance controls exist, answered from the finance head’s chair. It does not test anything, it is not an audit opinion, and a high score is not evidence that controls operated through the year. Its use is to decide where to look first, and to give the board or audit committee a short, honest page to discuss.

For the documentation a formal controls review needs, see the internal financial controls readiness guide. To assess the internal audit function itself rather than the company’s controls, use the internal audit maturity assessment. On the audit trail requirement for accounting software, see the audit trail guide.

From a questionnaire to the ledger

The answer that matters is what the transactions show

A self-assessment records what people believe happens. The books record what did: every vendor bank change, every manual journal, every payment released. When those are read in full each month — every transaction, not a sample — a control that is only partly in place shows up as a list of exceptions with an owner and a closure date. That is the part CORAA does.

Acting on the gaps? Start with the duplicate payment test kit, the month-end close checklist or the intercompany reconciliation template.

How the finance controls health check works in 2026

The health check asks thirty questions about controls that any finance function of a mid-size company should be able to answer: five on vendor payments, four on sales and receivables, five on the month-end close and reporting, four on treasury and cash, four on payroll, four on statutory compliance, and four on system access and master data. Each is a question of fact about how things work today — for example, whether a change to a vendor's bank account is approved by a second person — and not a question about policy.

Each answer scores two points for Yes, one for Partly and none for No. A question that does not apply, such as intercompany balances in a single-entity company, is marked not applicable and left out. The score for an area is the points earned divided by the points available for the questions scored, shown as a percentage. The overall score is the same calculation across all areas. If some questions are still unanswered the score is shown as provisional.

The overall score is put into plain words on a scale this tool defines and states: 85% and above is strong, 70% to 84% is sound with gaps, 50% to 69% is uneven, and below 50% is weak. These bands are not a standard and do not compare the company with any other; they are a way to turn the number into a sentence a board can discuss.

Every No and Partly becomes a gap with one concrete next step. Gaps are ordered with controls that are not in place first and those partly in place second, and within each, the fundamental controls — two-person approval of vendor bank changes and payments, bank and balance-sheet reconciliations, review of manual journals, payroll master changes, individual logins and the audit trail — come first. The page shows the top five; the Excel action plan lists all of them with owner, due date and status columns.

Worked example — an illustrative single-entity company, October 2026

Illustrative answers only (the same set the "show an illustrative set of answers" button loads). A single-entity company answers all thirty questions: 11 Yes, 13 Partly, 5 No and 1 not applicable (intercompany).

Inputs
Vendor payments2 Yes, 2 Partly, 1 No — 6 of 10 points
Sales and receivables2 Yes, 2 Partly — 6 of 8 points
Month-end close and reporting1 Yes, 2 Partly, 1 No, 1 not applicable — 4 of 8 points
Treasury and cash2 Yes, 1 Partly, 1 No — 5 of 8 points
Payroll1 Yes, 2 Partly, 1 No — 4 of 8 points
Statutory compliance2 Yes, 2 Partly — 6 of 8 points
System access and master data1 Yes, 2 Partly, 1 No — 4 of 8 points
Output
Overall score35 of 58 points = 60% — Uneven
Strongest areasSales and receivables, and statutory compliance — 75% each
Weakest areasMonth-end close, payroll, and system access — 50% each
First gap listedManual journal entries are not approved by a second person (not in place, fundamental)
Gaps in the action plan18 — 5 not in place, 13 partly in place
The company is compliant on filings and reasonably controlled on sales, but the areas that protect the books themselves — journals, reconciliations, payroll masters, who can change a master — are informal. The one-page summary would tell the board exactly that, with five named next steps, rather than giving a single comforting percentage.

Common mistakes

Answering for the policy, not the practice
A written policy that nobody follows is a No. Answer for what actually happened last month, and be ready to show the sign-off, the system setting or the reconciliation that supports a Yes.
Treating the score as an audit result
A self-assessment records what management believes. It has not been tested. Do not describe it to the board, a lender or an investor as an audit finding or as an opinion on internal financial controls.
Letting one person answer everything
The CFO may believe bank payments need two people while the accounts team knows one person holds both tokens. Have the person who does the work answer, and the finance head review.
Answering for the main entity only
In a group, the holding company's controls are usually stronger than those of a small subsidiary or a branch. Run the check for each entity that keeps its own books.
Chasing the percentage
Moving several answers from Partly to Yes raises the score but may leave one fundamental control missing. Fix the fundamental gaps first, whatever they do to the number.
Doing it once
People leave, systems change and controls lapse. Repeat the check every six months and put the two results side by side for the audit committee.

Frequently asked questions

What is a finance controls health check?+
It is a short self-assessment in which the finance head answers questions about whether basic controls exist over payments, receivables, the month-end close, cash, payroll, statutory compliance and system access. The result shows which areas are sound and which need attention. It is a management tool, not an audit.
How do I assess internal controls in my company in 2026?+
Start with a self-assessment like this one to find the obvious gaps, close the fundamental ones, and then have the controls tested by internal audit on actual transactions. For FY 2026-27, pay particular attention to vendor bank-detail changes, manual journals, bank reconciliations, user access and the audit trail in the accounting software.
Is this the same as the auditor's report on internal financial controls?+
No. Under Section 143(3)(i) of the Companies Act, 2013 the statutory auditor reports on whether the company has an adequate internal financial controls system and whether it is operating effectively, after testing. This health check is management's untested self-assessment and gives no opinion.
Who is responsible for internal financial controls in a company?+
Management and the board. In a listed company the directors' responsibility statement covers the internal financial controls laid down by the directors. The statutory auditor reports on those controls, and the internal auditor, where one is required or appointed, reviews them; neither takes over management's responsibility for having them.
What are the most important finance controls for a mid-size company?+
Two-person approval of vendor creation, vendor bank changes and payments; monthly bank and balance-sheet reconciliations reviewed by a second person; approval of manual journals; separation of payroll master changes from payroll processing; a compliance calendar with owners; and individual logins with the audit trail switched on.
What score is a good score?+
On this tool's own scale, 85% or more is described as strong. But the score matters less than which questions were answered No: a company at 80% with no second approval on bank payments has a more serious problem than one at 70% with only minor gaps.
Can I give this to the audit committee?+
Yes — the one-page PDF is written for that purpose. It states the overall score, the score by area, the top gaps and the next step for each, and says plainly that it is management's self-assessment and not an audit. Add an owner and a due date to each gap before circulating it.
How is this different from an internal audit maturity assessment?+
An internal audit maturity assessment scores the internal audit function — its charter, planning, methods and reporting. This health check scores the company's own finance controls, from management's side. A company can have a mature internal audit function and weak controls, or the reverse.

Authoritative sources

MCA
Companies Act, 2013 — Sections 134, 138, 143 and 177 — Directors' responsibility statement, internal audit for prescribed classes of companies, the statutory auditor's reporting on internal financial controls, and the audit committee. Referred to here in general terms; read the sections and the rules for applicability.
ICAI
ICAI — Internal Audit Standards Board — Standards on Internal Audit and guidance used by internal auditors in India when controls are reviewed and tested.
Always confirm against the latest version of the source. Regulations evolve and amendments are common.
Related calculators
Internal financial controls readiness guide →Internal audit maturity assessment →Internal audit applicability checker →Duplicate payment test kit →Month-end close checklist generator →MIS report format generator →
Share this tool
Last reviewed: 2026-10-01 · For informational purposes only — not professional advice.