A few months ago, we interacted with a founder who was preparing for an investor discussion.
The business was profitable. Revenue was growing. GST returns had been filed. Income tax returns were up to date. The founders were confident that the company was fully compliant.
Then the due diligence process began.
Within a few weeks, several issues surfaced:
- Vendor agreements could not be located.
- MSME declarations were missing.
- Employee records were incomplete.
- GST credits had not been reconciled for months.
- Board resolutions were not properly documented.
None of these issues appeared in the profit and loss statement.
None of these issues prevented the business from operating.
Yet together, they created delays, additional questions, and concerns that could have been avoided.
This is a mistake many small businesses make.
They assume compliance means filing tax returns on time.
In reality, compliance is much broader. More importantly, the risks are often hidden until an investor, lender, auditor, customer, or regulator starts asking questions.
Here are some of the most common compliance gaps we see in growing businesses.
Risk #1: Believing GST Compliance Ends After Filing Returns
Most business owners associate GST compliance with filing GSTR-1 and GSTR-3B.
Unfortunately, filing returns is only one part of the story.
The real problems usually emerge when:
- GST returns do not match accounting records.
- Input Tax Credit has not been reconciled.
- Vendor filings contain errors.
- E-invoicing requirements have been overlooked.
- E-way bill documentation is incomplete.
A business may believe everything is in order until it receives a notice seeking explanations for mismatches.
The lesson is simple.
Do not just ask whether GST returns have been filed, ask whether GST data can withstand scrutiny.
Risk #2: The Hidden MSME Liability Many Founders Ignore
Ask a founder whether they know their top customers.
Most will answer immediately.
Ask whether they know which vendors are registered as MSMEs.
The answer is often very different.
This is surprising because MSME-related compliance has become increasingly important.
Many businesses fail to collect MSME declarations from vendors. Others do not track payment timelines properly.
The result is that potential reporting obligations and interest exposures remain hidden until they are identified during an audit or due diligence review.
The risk is not always financial.
Sometimes the bigger issue is discovering that management never knew the exposure existed.
Risk #3: Ignoring ESI and PF Compliance Requirements
Growing businesses often focus on hiring and expansion while overlooking employee-related statutory obligations.
This becomes particularly risky when businesses cross employee thresholds that trigger requirements under Provident Fund (PF) and Employee State Insurance (ESI) regulations.
We frequently see businesses that:
- Are unaware that PF or ESI registration requirements apply to them.
- Have delayed registrations after crossing eligibility thresholds.
- Maintain incomplete employee records required for compliance.
- Struggle with contribution calculations and reporting obligations.
These issues often remain unnoticed during day-to-day operations.
However, they can quickly become serious concerns during labour inspections, audits, due diligence exercises, or employee disputes.
Many founders assume these requirements only apply to large organisations.
In reality, growing businesses often become subject to these obligations sooner than expected.
Understanding when PF and ESI requirements apply and ensuring compliance from the outset can help avoid unnecessary penalties, disputes, and regulatory scrutiny.
Risk #4: Treating Compliance as the Accountant's Responsibility
One of the most dangerous assumptions a founder can make is:
"My accountant handles compliance."
Accountants play an important role.
However, compliance ultimately remains a management responsibility.
For example:
An accountant may file returns.
The founder is responsible for ensuring:
- Business records are accurate.
- Contracts are maintained.
- Internal approvals exist.
- Vendor information is complete.
- Regulatory requirements are understood.
Compliance failures rarely occur because a single return was missed, they occur because nobody owned the process.
Risk #5: Weak Internal Controls That Nobody Notices
Not every compliance issue originates from a law.
Many originate from weak business processes.
Consider the following questions:
- Who approves vendor onboarding?
- Who authorises payments?
- Who reviews employee reimbursements?
- Who verifies changes in bank account details?
- Who monitors regulatory deadlines?
If the answer is "whoever is available," your business may already have a control weakness.
Many frauds and compliance failures begin with informal processes that worked when the company was small but became risky as the business grew.
Risk #6: Governance Gaps That Surface During Due Diligence
Founders often assume investors focus primarily on revenue and profitability.
While financial performance matters, governance matters too.
During due diligence, investors frequently review:
- Board records
- Statutory registers
- Shareholding records
- Director information
- Related party transactions
These documents tell a story about how the business is managed.
Strong governance creates confidence.
Poor governance creates questions and in fundraising, questions can become delays.
Risk #7: The Documentation Problem Nobody Notices
Imagine receiving a call from an investor, auditor, bank, or regulator asking for records.
Could your team provide the following within 24 hours?
- Vendor agreements
- Customer contracts
- Employee files
- Tax records
- Board resolutions
- Financial statements
Many businesses cannot.
The issue is not that the documents do not exist.
The issue is that nobody knows where they are.
Compliance is not only about having records, it is about being able to produce them when required.
Compliance Is Not About Avoiding Penalties
Many business owners view compliance as a cost, while the most successful businesses view it differently.
They see compliance as a trust-building mechanism.
Strong compliance practices improve investor confidence.
They support fundraising. They simplify audits. They strengthen governance.
Most importantly, they allow founders to focus on growth instead of firefighting preventable issues.
Not Sure Where You Stand?
If your business has not undergone a structured compliance review in the last 12 months, it may be worthwhile to conduct a compliance health check before the financial year closes.
Identifying issues early is usually far less expensive than dealing with notices, penalties, audit observations, or investor concerns later.
At Grevx Consulting, we periodically conduct complimentary compliance health check discussions for founders who want to better understand their current compliance position and potential risk areas.
Final Thought
The biggest compliance risks are rarely the ones founders worry about.
They are the ones nobody notices until someone starts asking questions.
The goal is not merely to file returns.
The goal is to build a business that can withstand scrutiny, inspire confidence, and continue growing without unpleasant surprises.
Need help applying this insight?
Our consulting team helps businesses translate strategy into practical action.
Talk to our team →
