Process Mapping, Re-engineering & Control Reviews

It is the deliberate redesign of how a piece of work gets done — from the moment it starts to the moment it finishes — with the explicit goal of making it faster, less error-prone, and better controlled. Rather than tweaking an existing process at the margins, it asks whether the process would look the same if you were designing it today, from scratch, with your current team size, systems, and objectives. Very often the honest answer is no — and the redesign removes steps that exist only because 'we have always done it this way'.

A general management consultant typically optimises for speed and cost. PNPC's engagement is led by practising Chartered Accountants, which means every redesigned process is evaluated simultaneously against the internal financial control requirements your Board is statutorily accountable for under Section 134(5)(e) and Section 143(3)(i) of the Companies Act 2013, and against the tax and GST consequences the process touches — TDS deduction points, GST input credit reconciliation, related-party transaction approvals under Section 188. A process that is fast but breaks a statutory control requirement is not actually an improvement.

No, though the two are closely related and often feed each other. Internal Audit tests whether existing controls are operating effectively — it looks backward at what has already happened, typically through sampling. Process Mapping and Re-engineering looks forward — it redesigns the process itself, including the control points, before testing whether it operates correctly. In practice, recurring Internal Audit findings are one of the most common triggers for commissioning a process re-engineering engagement, and the Risk and Control Matrix this engagement produces becomes a key input into the next Internal Audit cycle.

The most common candidates are procure-to-pay, order-to-cash, inventory and fixed-asset management, payroll and HR onboarding/exit, treasury and banking operations, and the month-end/year-end financial close. Sector-specific processes are added depending on the business — shop-floor production controls for manufacturers, project accounting for real estate and construction, loan origination and collections for NBFCs, or reconciliation between marketplace and books for e-commerce businesses. We scope the specific list with you at the start of the engagement based on where the pain or risk is greatest.

A focused review of a single process — say, procure-to-pay at one location — typically runs 6–8 weeks from scoping to a signed-off future-state design. A multi-process, multi-location engagement, such as procure-to-pay plus order-to-cash plus payroll across three branches, typically runs 10–16 weeks end-to-end including implementation support. Post-implementation testing is best scheduled 60–90 days after go-live, once the redesigned process has had time to bed in under real operating conditions.

You receive a current-state process map (swimlane/flowchart format), a gap analysis document classifying each finding by type and risk rating, a future-state process design with explicit control points and an updated Delegation of Authority matrix, a formal Risk and Control Matrix (RCM) mapping risks to mitigating controls, and an updated SOP document your team can actually follow. Where the review touches an ERP or accounting system, we also provide the specific workflow/approval configuration required to enforce the new design in the system, not just on paper.

Often, yes — the gap we most commonly find is between the documented SOP and how the process actually runs day to day. Staff develop workarounds when a system limitation, an unavailable approver, or a genuine process flaw makes the documented steps impractical, and these workarounds rarely make it back into the SOP. A walkthrough with actual process owners, not just a read of the existing document, is the only reliable way to find this gap — which is exactly what our current-state mapping step is designed to surface.

It is highly relevant for growing businesses specifically — this is usually the exact inflection point where informal, founder-driven processes stop scaling. A business that has grown from 10 to 80 employees in two years, or added a second location, often finds that approvals which used to happen over a quick conversation now need a documented, system-enforced process because the founder can no longer personally review every transaction. Catching this early, before a statutory audit finding or an investor due diligence process surfaces it, is materially cheaper than fixing it under pressure later.

Under Section 134(5)(e) of the Companies Act 2013, the Board's report must state that the company has laid down internal financial controls and that these controls are adequate and were operating effectively. Under Section 143(3)(i), the statutory auditor must separately opine on the adequacy and operating effectiveness of the company's internal financial controls over financial reporting — though a private company that is not a subsidiary or holding company of a public company, and that meets the small-turnover and low-borrowing conditions specified in the MCA's Companies (Audit and Auditors) Rules exemption, is excluded from this specific auditor-reporting requirement (the Board's own obligation under Section 134(5)(e) still applies). Whether your company qualifies for that exemption should be confirmed with your statutory auditor. Both requirements depend on having documented processes and a Risk and Control Matrix that ties specific risks to specific controls — which is precisely the artefact this engagement produces. Without it, the IFC assessment each year becomes a rushed, undocumented exercise that is difficult for the Board to stand behind with confidence.

An RCM is a structured document that lists, for each process, the specific risks that could occur (e.g., payment made to a fictitious vendor, revenue recognised before delivery, inventory shrinkage going undetected) alongside the specific control that is designed to prevent or detect that risk (e.g., three-way match between purchase order, goods receipt, and invoice before payment approval). It is the standard artefact statutory auditors and internal auditors use to test control design and, subsequently, operating effectiveness. Without a documented RCM, every audit cycle has to reconstruct this mapping from scratch through interviews — slower, less consistent, and more prone to gaps being missed.

Yes, and it is one of the most effective times to run it. Implementing a new ERP or accounting system without first re-engineering the underlying process typically results in the new system simply automating the old inefficiency — the same redundant approvals and manual workarounds, just inside a more expensive system. Running process re-engineering ahead of or alongside the system implementation means the future-state process design directly informs how the new system's workflows, approval hierarchies, and access controls are configured.

Segregation of duties is the principle that no single individual should control every stage of a transaction — initiation, approval, custody of the asset, and recording — because a single person controlling all stages creates both fraud opportunity and error risk that no one else is positioned to catch. It is one of the most fundamental internal control principles and one of the most common gaps we find in growing businesses, where a small finance team means the same person raises a payment, approves it, and reconciles the bank statement. Re-engineering typically resolves this either by redistributing responsibilities across existing staff or, where headcount genuinely does not allow it, by introducing a compensating control such as a mandatory secondary review.

We map each location's variant of the process separately during the current-state walkthrough stage, because processes that are supposedly 'standardised' across locations frequently diverge in practice — different approval thresholds, different documentation habits, different system usage. The future-state design then either harmonises the process into one standard version applied everywhere, or, where a genuine business reason requires local variation, documents the variation explicitly with its own control points rather than leaving it undocumented.

Both. Most processes today run through some combination of manual steps and system workflows, and a control that exists on paper but is not enforced by the system (or vice versa) is a common gap. We review the system access matrix, workflow configuration, and any manual workarounds being used to bypass a system limitation, alongside the manual approval and documentation steps. Where IT general controls (user access management, change management, backup and business continuity) are materially relevant to the process, we flag them, though a dedicated ITGC/IS audit is a separate, deeper engagement if that is the primary concern.

Each documented process step is tested against two questions: first, does this step add genuine value, or is it redundant, duplicative, or a manual workaround for a system limitation; second, does this step prevent or detect error, fraud, or non-compliance, and is that control actually operating as intended (not just documented). Gaps are then classified by type — segregation-of-duties gap, missing or informal authorisation, unreconciled handoff between systems or teams, redundant approval that adds delay without adding control — and rated by risk severity and the effort required to remediate.

PNPC prices this as a fixed-fee, scope-defined engagement — the fee depends on the number of processes, locations, and entities in scope, and whether implementation support and post-implementation testing are included. The exact fee and scope are confirmed in writing before any work begins, following the scoping conversation. We are not the cheapest option in the market; the value is in a CA-led review that connects process efficiency directly to statutory control obligations, not a generic operations consulting deliverable.

The engagement needs genuine access to the actual process owners and operational staff who perform the work daily — not just a summary from the department head — because that is where the real gaps and workarounds surface. Typically this means a series of structured interviews of 60–90 minutes per process per location during the discovery phase, plus availability for a validation session once the current-state map is drafted, and sign-off meetings with the Audit Committee/Board sponsor at scoping and at future-state design approval. We schedule this to minimise disruption, but genuine engagement from process owners is not optional for a credible outcome.

This is the single most common reason a re-engineering exercise fails to deliver value, and it is why our engagement explicitly includes implementation support and change management — process owner training, a defined cut-over date so the old and new process do not run in parallel indefinitely, and post-implementation testing 60–90 days after go-live to confirm the new process is actually being followed, not just that the SOP was signed off. A redesign without this follow-through is, in our experience, reliably abandoned under the first real deadline pressure.

There is no standalone statute that mandates 'process re-engineering' as a named exercise. However, the underlying obligation to maintain adequate and effective internal financial controls is a statutory requirement under Section 134(5)(e) and Section 143(3)(i) of the Companies Act 2013, and companies crossing the thresholds under Section 138 read with Rule 13 of the Companies (Accounts) Rules, 2014 must maintain an Internal Audit function that will test those controls. Process mapping and re-engineering is the practical mechanism by which many organisations actually meet these underlying statutory obligations, even though the exercise itself is not separately named in the law.

Financial and operational due diligence in a fundraise or acquisition routinely tests exactly the things this engagement documents — segregation of duties, approval trails, reconciliation discipline, and whether controls described to the investor actually operate as described. A documented process environment with a current Risk and Control Matrix materially shortens diligence timelines and reduces the scope for the investor's advisers to raise findings that get used to negotiate a lower valuation or additional warranties. Undertaking this review proactively, well before a term sheet, is significantly cheaper and less stressful than doing it reactively under diligence deadline pressure.

PNPC's core deliverable is the process design, the RCM, and the SOP/DOA documentation, along with change management support for rollout. Where system reconfiguration is required — updating an ERP's approval workflow, for example — we specify the exact configuration needed and work alongside your IT team or ERP implementation partner to ensure it is built correctly; PNPC is not typically the party doing the hands-on system coding itself unless that is separately scoped as part of a broader engagement.

A control gap is a point in the process where error, fraud, or non-compliance could occur, or already has occurred, without being reliably prevented or detected — for example, a payment approved by the same person who raised it. An efficiency gap is a point where the process is slower or more resource-intensive than necessary without adding any corresponding control benefit — for example, three sequential sign-offs for a routine, low-value purchase order. The distinction matters because control gaps are generally the higher priority to fix and are the ones your auditors will test, while efficiency gaps affect cost and speed but not, on their own, financial statement integrity.

The process mapping and control gap analysis frequently surfaces the structural weaknesses — missing segregation of duties, unreconciled handoffs, informal approval overrides — that create the opportunity for fraud or leakage to occur, and closing those gaps is a genuine preventive benefit. However, this engagement is not a forensic investigation: if you already suspect a specific fraud has occurred, a targeted forensic audit engagement with evidence-gathering standards appropriate for potential legal or disciplinary action is the more precise tool, and we would recommend that route instead or alongside this one.

A full re-assessment is generally advisable every 2–3 years, or sooner if triggered by a material business change — a new product line, an acquired entity, an ERP migration, a significant headcount increase, or a new regulatory requirement affecting the process. Even well-controlled processes drift over time as people change roles and informal shortcuts creep back in; the documentation itself should also be reviewed annually as part of the ongoing Internal Audit or IFC assessment cycle, even without a major trigger event.

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control–Integrated Framework is the most widely referenced framework globally for designing and evaluating internal controls, structured around five components — control environment, risk assessment, control activities, information and communication, and monitoring activities. Indian statutory and internal auditors commonly benchmark IFC assessments against COSO's structure, even though the Companies Act itself does not mandate COSO by name. You do not need to formally 'adopt' COSO as a certification; we use it as the reference structure to ensure the control environment we design is complete and defensible against what an auditor will expect to see.

The discovery and design phases require structured interview time from process owners but do not require operations to pause — walkthroughs are scheduled around the team's existing workload, and current processes continue to run unchanged until the future-state design is signed off and a deliberate cut-over is planned. Some short-term disruption is expected during the actual implementation and change-management phase, as staff learn the new process, which is why we recommend a defined cut-over date and, where practical, a phased rollout rather than switching every process simultaneously.

Yes. PNPC has offices in Chennai, Bangalore, Hyderabad, and Dubai, and the underlying methodology — process mapping, gap analysis, control redesign — applies equally in the UAE, adapted to the relevant regulatory context, including UAE Corporate Tax record-keeping requirements, VAT compliance touchpoints, and any sector-specific regulation (financial free zones, DIFC/ADGM entities, and so on). For groups with both an Indian and a UAE entity, we can run a coordinated review across both jurisdictions under one engagement rather than splitting the work between two separate advisers who never compare notes.

The most common mistake is documenting the process as management believes it runs, based on the original SOP or an interview with the department head, rather than walking the floor with the actual staff performing the work. The second most common mistake is treating the exercise as a documentation project rather than a redesign project — producing a beautiful flowchart of the existing broken process instead of asking whether the process itself needs to change. Both mistakes produce a deliverable that looks professional but does not close the actual gaps.

Yes. We can run a scoped diagnostic review — typically a 1–2 week rapid assessment of one or two priority processes — to surface the most material gaps and give management and the Board a clear, evidence-based business case for whether a fuller engagement is warranted, and at what scope. This is a common and sensible way to start for organisations that are not yet certain how deep the issue runs.

This is one of the explicit design tests we apply — a re-engineered process that adds steps or approval layers without a corresponding, clearly articulated control justification has failed the efficiency half of the brief, regardless of how well-controlled it looks on paper. Wherever we recommend a new control point, we identify what it replaces or consolidates elsewhere in the process, so the net effect on the team's workload is transparent and, in most well-executed engagements, net-positive rather than simply additive.

PNPC's process and control review engagements are led by Chartered Accountants with practising experience in statutory audit, internal audit, and IFC assessment, supported by team members with relevant sector and systems experience where the engagement requires it (for example, ERP-specific expertise for a system-heavy process review). This CA-led structure is deliberate — it ensures the process redesign is evaluated not just for operational efficiency but for its statutory and tax consequences from the outset, rather than those consequences being discovered later by a separate auditor.

A generic process consultant optimises for speed and cost reduction. PNPC is a practising Chartered Accountancy firm with four decades of statutory audit, internal audit, and tax practice — which means the process we design for you is evaluated simultaneously against the Companies Act control requirements your Board must certify, the tax and GST consequences embedded in the transaction flow, and the documentation your next statutory or internal auditor will actually test. We do not hand you a report and disappear; we support implementation, test post-go-live whether the redesign held, and hand the Risk and Control Matrix over to your ongoing Internal Audit and IFC programme so the investment compounds year after year rather than expiring the day the report is delivered.