Mid-sized companies occupy an uneasy middle ground when it comes to internal controls. There is enough transaction volume, enough headcount, and enough operational complexity for things to go wrong, yet most mid-sized organizations do not have a full internal audit function monitoring every part of the business the way a larger enterprise would.
In our review engagements, a recurring pattern shows up. A discrepancy surfaces during year-end close, it catches everyone off guard, and on closer inspection the warning signs had been present for months. Not concealed. Simply not reviewed.
Why These Red Flags Get Missed in the First Place
Most mid-sized companies grew up fast. The finance team that was three people five years ago is now twelve, but the processes never really got rebuilt to match. Founders still approve things informally over Slack. Spreadsheets are still doing jobs that should belong to actual systems.
Add to that the fact that internal audit, when it exists at all, is usually one person wearing three hats. They’re stretched between compliance, financial reporting, and whatever fire is burning that week. Red flags don’t get missed because nobody’s paying attention. They get missed because nobody has the bandwidth to look past the obvious stuff.
The Red Flags Worth Actually Checking For
None of these are dramatic. That’s kind of the point. They’re boring, everyday gaps, and boring is exactly what slides under the radar.
1. One Person Doing Too Much of the Approval Chain
Segregation of duties sounds like a textbook phrase until you actually map out who can create a vendor, approve the payment, and release the funds. In a lot of mid-sized companies, it’s the same one or two people doing all three, because hiring hasn’t caught up with growth.
What to look for: pull a list of every AP user and check whether any single login has rights across vendor setup, invoice approval, and payment release. If yes, that’s your first fix.
2. Manual Journal Entries That Nobody Second-Guesses
Every company has journal entries that don’t come from a system, the plug numbers, the reclassifications, the “we’ll clean this up later” adjustments. The problem isn’t that they exist. It’s that in a lot of companies, they go in without a second set of eyes.
What to look for: run a report of manual entries above a certain threshold, say anything over your materiality level, and check who’s approving them. If it’s the same person who posted it, that’s a gap.
3. A Vendor Master File Nobody’s Cleaned in Years
This one’s almost never on anyone’s radar until fraud shows up. Duplicate vendors, vendors with addresses that match employee addresses, vendors that haven’t been paid in three years but are still active. Nobody’s job is to go clean this up, so it just sits there.
What to look for: run a duplicate check on vendor bank account numbers and addresses, and flag anything active with zero transactions in the last twelve months.
4. Expense Reports That Get Rubber-Stamped
At a certain size, managers approve expense reports for people they trust, and that trust turns into a habit of clicking approve without really reading the line items. Round-dollar amounts, missing receipts under the policy threshold, weekend charges on a weekday business trip. Small stuff, but it adds up.
Fact: companies that never sample expense reports for policy compliance tend to find, once they finally do, that the issues weren’t isolated to one or two people.
5. Inventory Counts That Don’t Match What’s on the Books
If your physical counts and your system numbers are always “close enough,” that gap is worth understanding rather than shrugging off. Sometimes it’s shrinkage. Sometimes it’s a receiving process that’s logging things late. Either way, a recurring variance that nobody investigates is a red flag on its own, separate from whatever’s actually causing it.
What to look for: trend your count variances over the last four quarters. A one-off blip is normal. A pattern isn’t.
Why This Actually Costs You More Than You Think
None of these red flags on their own will sink a company. That’s exactly why they get ignored. But they tend to travel together, and by the time one of them turns into an actual loss, whether that’s fraud, a failed audit, or a bank asking uncomfortable questions during a loan renewal, the fix costs a lot more than it would have earlier.
There’s also a quieter cost. Weak controls make it harder to raise capital, harder to pass due diligence if you’re ever acquired, and harder to hire a CFO who actually wants to inherit that mess.
Make It a Habit, Not a Once-a-Year Scramble
The companies that handle this well don’t run one big audit sweep in December and call it done. They build small checks into the calendar, a vendor file review each quarter, a sample of expense reports every month, a look at journal entry approvals as part of the regular close. None of it takes long once it’s routine.
Start with whichever red flag above made you a little uncomfortable reading it. That’s usually the one worth checking first.
Final Thoughts
Internal audit doesn’t need to be a big department with a formal charter to be useful. For a lot of mid-sized companies, it just needs someone asking the right questions on a regular basis instead of waiting for year-end to find out what’s been sitting there all along.
If you’re not sure where your own gaps are, that’s usually a sign it’s time for a second set of eyes to take a look, not because something’s necessarily wrong, but because you’d rather find out on your own terms.
At JD Shah Associates, we work with mid-sized businesses across Mumbai to catch these gaps early, through structured internal audit reviews rather than a report that gets filed away after year-end. We’re one of the established chartered accountant firms in Mumbai, and as an auditing firm our work spans everything from internal controls and statutory audits to GST consultant support, tax consultant services, and IPO consultancy for companies preparing to go public. If you’re looking for the best CA firm in Borivali, Mumbai to take a closer look at your controls, we’re happy to start with a conversation.
