Key TakeawayAs businesses scale, informal controls break down. This piece draws on APRA's internal audit mandates to identify the five control gaps most commonly found in fast-growing mid-market companies.
Based on our internal audit mandates across mid-market companies over the past three years, we have observed a consistent pattern: the controls that worked at INR 50 crore revenue are inadequate at INR 300 crore, and the ones at INR 300 crore fail at INR 1,000 crore. The reason is not that management is negligent — it is that control frameworks designed for a small team don't scale automatically.
The five gaps we see most often are: (1) Vendor approval processes that still depend on founder sign-off, creating bottlenecks and bypasses; (2) Absence of a three-way match between PO, GRN and invoice in the AP function; (3) Payroll control weaknesses — particularly in companies with high contract workforce — where ghost employees or inflated headcount go undetected for quarters; (4) IT access controls that haven't kept pace with growth, leading to excessive privileges and inadequate audit trails; and (5) Treasury and cash management that remains informal even as the company's cash position grows.
The remediation approach for each gap is different. Some require process redesign; others require system implementation; a few require a change in the control philosophy — moving from detective to preventive controls. An effective internal audit function identifies which is which and prioritises accordingly.
For listed companies, the SEBI requirement for the internal auditor to report directly to the audit committee — not management — is both a compliance requirement and a design principle. The audit committee should insist on direct access, and the internal auditor should exercise it. The independence of the function is what gives the audit committee's oversight any teeth.
What this means for your business
This briefing is based on current regulatory positions as of 2 May 2026. Laws and regulatory positions change frequently. Before acting on any information in this publication, we strongly recommend consulting with a qualified partner who can assess your specific facts and circumstances. Contact our Corporate Governance team at info@aprafirm.com or 0124-4477824/825.