Compliance Monitoring Framework

It is a documented system that tells your Board, at any point in time, exactly which laws and regulations apply to your company, who is responsible for each one, whether the company is currently compliant, and what is coming due next. It replaces informal tracking — a spreadsheet someone updates when they remember, or trust that 'the CA firm has it covered' — with a structured register, clear ownership, and a regular reporting cadence to the Audit Committee and Board.

There is no single section of law titled 'Compliance Monitoring Framework' that mandates this exact deliverable. However, Section 134(5) of the Companies Act 2013 requires directors to state that they have devised proper systems to ensure compliance with all applicable laws, and that those systems are adequate and operating effectively. For listed companies, SEBI LODR Regulation 17(3) requires the Board to review compliance reports for all applicable laws at least annually, and Regulation 24A requires an Annual Secretarial Compliance Report. A formal framework is the practical mechanism through which these statutory representations are made honestly and defensibly.

The statutory audit under Section 143 examines the company's financial statements and gives an opinion on whether they present a true and fair view — it is backward-looking, financial-statement-focused, and occurs once a year. A Compliance Monitoring Framework is forward-looking and continuous — it tracks every applicable regulatory obligation (not just financial reporting) throughout the year, flags upcoming due dates before they are missed, and reports to the Audit Committee on a quarterly (not annual) basis.

Secretarial audit (Form MR-3), mandatory for certain classes of companies under Section 204 of the Companies Act, is an annual, point-in-time audit conducted by a Practising Company Secretary examining compliance with a defined set of corporate and securities laws. A Compliance Monitoring Framework is broader in scope (it typically covers tax, labour, FEMA, and sector licences in addition to corporate law) and operates continuously through the year rather than as a once-a-year exercise. In practice, a good framework makes the secretarial audit smoother, because the PCS can draw on a maintained register rather than reconstructing the year's compliance history from scratch.

No. PNPC is a practising CA firm, not a software vendor. We configure and recommend a tracking tool appropriate to your scale — this could be a well-structured tracking workbook for a smaller company, or integration guidance for a third-party compliance management platform for a larger group — but the value we provide is the underlying Applicable Laws Assessment, the register design, the independent quarterly review, and the Audit Committee reporting. The tool is the container; the professional judgment behind what goes into it is the actual service.

There is no fixed turnover or headcount threshold. The practical trigger is complexity: multiple states, multiple entities, foreign shareholding, sector licences beyond the basics, a listing on the horizon, or a Board/Audit Committee that wants documented assurance rather than informal comfort. A single-entity company with GST in one state and basic MCA/tax obligations may be well served by a strong compliance calendar from its CA firm rather than a full dashboard-driven framework.

For a single-entity company, realistically 6–8 weeks from the initial scoping conversation to Audit Committee sign-off and go-live. For a multi-entity group, or one with India-UAE cross-border obligations, 10–14 weeks is more realistic, given the additional Applicable Laws Assessment work across jurisdictions and entities.

We verify the status claims in the register against actual evidence where practical — filing acknowledgements, payment challans, or licence renewal certificates — rather than simply accepting self-reported 'done' status. We check whether any new obligations have been triggered by business changes during the quarter (new state GST registration, PF/ESI threshold crossed, a new subsidiary, a new licence requirement). We also check for regulatory changes — amended thresholds, new forms, revised due dates — that affect the register's accuracy.

We document the gap, assess the exposure (penalty risk, director liability risk, licence risk), and support remediation — which may include regularisation filings, compounding applications under FEMA or the Companies Act where required, or corrective registrations. The gap and remediation status are reported transparently to the Audit Committee, not smoothed over, because the Board's ability to make an informed risk decision depends on seeing the full picture.

Yes. PNPC operates from Chennai, Bangalore, Hyderabad, and Dubai, and we build consolidated frameworks covering Indian Companies Act/SEBI/FEMA/GST/tax obligations alongside UAE trade licence renewal, VAT, Corporate Tax registration and filing, and WPS payroll compliance obligations — presented as a single dashboard and a single Audit Committee report rather than two disconnected trackers prepared by two different firms.

This depends on organisation size — typically the Company Secretary function for corporate/SEBI obligations, the CFO/finance team for tax and GST, and HR for labour law and PF/ESI obligations, all feeding into a single consolidated register. PNPC helps design realistic ownership assignments during the build phase rather than defaulting everything to one already-stretched function.

Section 134(5)(f) requires directors to state that they have devised proper systems to ensure compliance with the provisions of all applicable laws and that such systems were adequate and operating effectively. Without a documented framework, this statement is, in practice, an assertion without evidence. With a framework — the Applicable Laws Assessment, the register, the quarterly Audit Committee reports, and the documented remediation of any exceptions — the statement is supported by an actual audit trail the Board reviewed and acted on through the year.

No. The framework does not itself file your GST returns, your MCA forms, or your TDS returns — those continue to be handled by your existing accounting team, CA firm, or company secretary. The framework is the oversight and tracking layer that sits above individual filings, ensuring nothing is missed and giving the Board visibility. Where PNPC is also your compliance/audit firm, the framework and the filing work are naturally integrated; where you use a different firm for day-to-day filings, we coordinate with them.

Under SEBI LODR Regulation 24A, every listed entity must obtain an Annual Secretarial Compliance Report from a Practising Company Secretary, confirming compliance with SEBI regulations and circulars, and submit it to the stock exchanges within 60 days of the financial year end. A well-maintained compliance register under PNPC's framework gives the PCS a structured, evidence-backed starting point for that report, rather than requiring the PCS to independently reconstruct the year's compliance position.

Cost depends on the number of entities, states, and regulatory categories covered, and on whether it is a one-time build with quarterly PNPC review, or a fully outsourced monitoring arrangement. PNPC scopes and quotes every engagement individually after the initial scoping conversation and Applicable Laws Assessment sizing — there is no fixed published fee, because a single-entity, single-state company and a five-entity, cross-border group have very different scope.

Yes, particularly if the company has multiple state registrations, foreign shareholding, sector licences, or a Board that includes independent or nominee directors who want documented assurance rather than informal comfort. That said, for a genuinely small, single-state, single-entity company with straightforward obligations, a well-run compliance calendar maintained by the CA firm may deliver most of the same protection at lower cost — we recommend the framework when complexity justifies it, not by default.

It is the documented protocol defining who gets notified, and when, as a due date approaches — for example, the responsible owner at 30 days before due date, their functional head at 15 days if not yet marked complete, and the CFO/Company Secretary (with a note flagged for the next Audit Committee meeting) at 5 days if still outstanding. It converts a passive calendar into an active accountability mechanism rather than a list that only gets checked after something is missed.

Yes, where relevant — FC-GPR and FC-TRS filings for foreign shareholding events, ODI filings and Annual Performance Reports for overseas subsidiaries including UAE entities, External Commercial Borrowing (ECB) reporting where applicable, and any other FEMA reporting triggered by the company's cross-border structure. These are event-triggered obligations (tied to a transaction date, not a fixed calendar date) and are a common source of missed deadlines precisely because they do not appear on a standard annual compliance calendar.

Both. The quarterly PNPC review and the annual framework refresh specifically check for regulatory developments that affect the company — amended thresholds, new forms, changed due dates, or entirely new obligations (for example, when the Labour Codes come into force and change PF/ESI/wage-related compliance requirements). The register is updated proactively rather than only after the company is caught out by a change it did not know about.

Where a company already has an internal audit function, PNPC coordinates scope to avoid duplication — internal audit often tests broader operational and financial controls, while the compliance framework focuses specifically on statutory/regulatory obligation tracking. In many engagements, the compliance register becomes a specific testing area within the internal audit's annual plan, with PNPC's independent quarterly review serving as the primary ongoing assurance layer between internal audit cycles.

This is precisely the single-point-of-failure risk the framework is designed to eliminate. Because the register, ownership assignments, and due-date logic are documented externally (not held only in one person's head or personal spreadsheet), a departing employee's knowledge does not leave with them. PNPC's quarterly independent review also means there is continuity even during an internal transition, and we support onboarding a replacement compliance owner using the existing register as the training tool.

Yes, on request. Many companies have financial covenants under loan agreements, reporting obligations to investors under a Shareholders' Agreement, or specific undertakings in material customer contracts. These can be added as tracked items alongside statutory obligations in the same register, giving the Board and Audit Committee one consolidated view of everything the company has committed to, not only what the law requires.

This is configured to the client's preference. Many clients want a summarised, Board-ready report presented at each Audit Committee meeting rather than raw dashboard access for every director; others prefer read-only dashboard access for Audit Committee members between meetings. We configure access levels — data entry, internal view-only, and Audit Committee/Board view — as part of the dashboard setup stage.

No. While the framework naturally integrates well when PNPC also handles the underlying statutory audit, tax, or secretarial compliance work, we do build and independently review Compliance Monitoring Frameworks for companies whose day-to-day filings are handled by another firm. In those cases, we coordinate with the existing team rather than replacing them.

A compliance calendar is typically a list of known recurring due dates — GST returns, TDS returns, MCA annual filings — often maintained by the accounting or CA team as part of routine service. A Compliance Monitoring Framework is broader and more structured: it includes the comprehensive Applicable Laws Assessment (not just recurring known filings but also event-triggered and less-obvious obligations), documented ownership and escalation, independent quarterly verification, and formal Audit Committee/Board reporting. A calendar is a component that typically sits inside a full framework.

The register includes threshold-triggered obligations as monitored items even before they apply — for example, tracking headcount against the PF applicability threshold (20 employees) and the ESI applicability threshold (10 employees in most states) so the obligation is identified and registration initiated proactively as the company approaches the threshold, rather than discovered retrospectively after non-compliance has already occurred.

Yes. GST is one of the most dynamic compliance areas — return formats, e-invoicing thresholds, e-way bill rules, and reconciliation requirements (GSTR-2B matching, GSTR-9/9C annual reconciliation) change periodically. The framework tracks state-wise GST registration status, return filing cadence (monthly or QRMP quarterly), and flags regulatory changes affecting the company's GST obligations as part of the quarterly review, in coordination with whoever prepares the actual GST returns.

Sector-specific obligations — RBI regulatory returns and prudential norms for NBFCs, RERA project-wise compliance and quarterly progress reporting for real estate developers, SEBI intermediary regulations, or FSSAI licensing conditions for food businesses — are incorporated into the Applicable Laws Assessment as a distinct, specialised category, often requiring PNPC to work alongside the company's sector-specific compliance/legal advisor rather than covering that specialised regulatory area in isolation.

SEBI LODR Regulation 17(3) requires listed company Boards to review compliance reports for all applicable laws at least once a year, at minimum. PNPC recommends quarterly Audit Committee reporting as good practice for most companies with a formal framework, since it catches emerging issues faster than an annual-only review, while remaining a manageable cadence for the Audit Committee's agenda. Companies in higher-risk situations (post-funding, pre-listing, or recovering from a past compliance issue) sometimes opt for monthly reporting for a defined period.

Yes. Where the framework — or an external event — surfaces a past miss that has already attracted a show-cause notice, penalty order, or demand, PNPC supports the response: representations to the relevant authority, compounding applications under FEMA or the Companies Act where applicable, regularisation filings, and the internal Board communication needed to manage the situation, alongside feeding lessons back into the framework to prevent recurrence.

The underlying legal obligations are largely the same, but the governance context differs. A VC-funded company typically has nominee directors, investor reporting covenants, and near-term funding or exit plans that raise the value of a documented, diligence-ready framework sooner. A family-owned private company may prioritise director-liability protection and succession-related compliance discipline. PNPC scopes the framework's emphasis — investor-reporting integration versus succession and continuity focus — to the company's actual governance context during the initial scoping conversation.

Day-to-day, the internal owners (typically CS/CFO/HR functions) need to update the register as filings are completed — a modest but consistent time commitment, generally far less than the time currently spent on ad hoc deadline-chasing and firefighting. The Audit Committee needs to allocate a standing quarterly agenda slot for the compliance report. Beyond that, PNPC carries the independent review, regulatory update tracking, and annual refresh workload.

You can, and some companies do build an internal register without external support. What PNPC adds is the breadth of an Applicable Laws Assessment informed by decades of practice across sectors and jurisdictions — catching obligations an internal team may not think to look for — plus genuinely independent quarterly verification, which an internally-built and internally-reviewed system cannot provide by definition. We also bring continuity that survives staff turnover and current regulatory awareness that a single internal function, focused on its day job, may not maintain at the same depth.

Initial scoping conversation and engagement letter. Comprehensive Applicable Laws Assessment across corporate, tax, FEMA, labour, and sector-specific law. Compliance register build with ownership assignment and escalation matrix design. Tracking tool/dashboard configuration suited to your scale. A pilot monitoring cycle before go-live. Audit Committee presentation and Board sign-off support. Ongoing quarterly independent review and Audit Committee/Board reporting. Annual framework refresh. Remediation support for any flagged exceptions. India-UAE consolidation where the group has both.