Compliance Checklist

Compliance is not a founder’s favorite topic, but it is part of trust.

This page is not legal, tax, or accounting advice. Use it as a preparation checklist before speaking with a CA, CS, lawyer, payroll partner, or internal finance owner.

The founder’s job is not to personally execute every filing. The founder’s job is to make sure the company has owners, records, reminders, and professional review before avoidable issues become expensive.

Core company records

Keep these organized from the beginning:

Incorporation documents
PAN and tax identity records
Board and shareholder records
Cap table
Founder agreements
Share issuance records
ESOP plan and grants, if any
Registered office records
Bank account documents
Auditor, CA, CS, and legal contact details

Founder question: if an investor, acquirer, bank, or regulator asks for this document, can we find the latest version in ten minutes?

Stage-based compliance focus

The compliance burden changes by stage. Use this as a founder planning guide before speaking with professionals.

Stage	Founder focus
Idea and pre-incorporation	Avoid premature complexity, but document founder contributions, IP, domain ownership, and any serious customer/vendor promise.
Incorporation	Choose entity deliberately, document founder ownership, open bank/accounting systems, and set up professional advisors.
First revenue	Confirm invoicing, GST/TDS questions, payment terms, contract templates, revenue classification, and collections process.
Hiring	Use written offers, contractor agreements, IP/confidentiality terms, payroll records, access controls, and exit process.
Fundraising	Prepare cap table, board/shareholder records, due diligence folder, ESOP plan, filings, investor docs, and use-of-funds records.
Enterprise sales	Prepare contracts, security/privacy answers, insurance if needed, data handling, vendor onboarding, and renewal/termination tracking.
Expansion or exit	Clean financials, contracts, IP, tax records, regulatory exposure, employee records, and data/security posture.

Do not treat compliance as one giant cleanup. Treat it as stage-appropriate hygiene.

Tax and accounting preparation

Review with your CA:

Accounting system setup
Chart of accounts
Revenue classification
Recurring versus one-time revenue
GST applicability and invoicing treatment
TDS or withholding obligations where relevant
Expense documentation
Vendor payments
Customer collections
Bank reconciliation
Monthly management reports

Do not let tax and accounting live only in WhatsApp messages and scattered spreadsheets. Early mess becomes later diligence pain.

Payroll and people records

For employees, interns, consultants, and contractors, keep:

Offer letters or engagement letters
Compensation details
Joining documents
IP assignment language where appropriate
Confidentiality obligations
Payroll records
Reimbursement records
Leave and attendance process
Exit documents and access removal checklist

Founder mistake: hiring fast without collecting paperwork, then trying to repair records during fundraising, audits, or disputes.

Contracts and commercial records

Store signed versions of:

Customer contracts
Pilot agreements
Vendor agreements
Agency contracts
Contractor agreements
Partnership agreements
NDAs
Data processing or security addendums where relevant
Renewal and termination notices

For each important contract, know:

Effective date
Renewal date
Payment terms
Termination rights
Liability caps
Data or confidentiality obligations
Owner inside the company

IP and brand hygiene

Review:

Founder IP assignment
Employee IP assignment
Contractor IP assignment
Open-source dependency awareness
Domain ownership
Trademark search and filing plan where relevant
Logo, design, copy, and content ownership
Customer permission for case studies and logos

IP issues are easiest to fix before people leave, vendors disappear, or the company becomes valuable.

Data privacy and security preparation

Map:

What customer data you collect
Where it is stored
Who can access it
Which vendors process it
How long you retain it
How customers can ask questions
What security controls exist
What happens during an incident

If you sell to enterprise customers, prepare a basic security and privacy response pack before sales asks for it.

Compliance calendar

Create a calendar with:

Monthly items
Quarterly items
Annual items
Event-based items, such as funding, share issuance, board actions, hiring, and major contracts
Renewal dates
Filing owners
Professional reviewer
Evidence link after completion

The calendar should not be owned only by an external advisor. Someone inside the company must know what is due and whether it was done.

Event-trigger checklist

Certain events should trigger a compliance review even if the calendar is quiet.

Event	Review
New co-founder or equity promise	Founder agreement, vesting, board/shareholder approvals, cap table, tax/legal advice.
First customer contract	Contract template, invoicing, GST/TDS, data/security promises, payment terms.
First employee or contractor	Offer/engagement letter, payroll/contractor status, IP/confidentiality, access management.
Fundraising conversation becomes serious	Data room, cap table, board records, filings, ESOP, financial model, investor docs.
New country or state	Tax, invoicing, employment, data, contract, and regulatory implications.
Handling sensitive customer data	Privacy notice, data map, access control, retention, vendor processing, security review.
Major vendor or agency	Contract, IP ownership, data access, payment terms, termination rights.
Shutdown or sale discussions	Obligations, records, employee/customer communication, contracts, taxes, IP, data.

Event triggers catch issues that monthly calendars miss.

Advisor preparation sheet

Before meeting a CA, CS, lawyer, payroll partner, or tax advisor, prepare:

Field	Notes
Company entity and structure
Current founders/shareholders
Employees, contractors, interns
Revenue lines and customer types
States/countries where customers are located
Vendor and contractor locations
Funding history and planned funding
ESOP or equity promises
Regulated activities, if any
Customer data collected
Open questions

Advisors can help faster when founders bring context instead of scattered screenshots.

Document repository structure

Use a simple folder structure from the beginning.

Folder	Examples
01 Company records	Incorporation, PAN, GST, board/shareholder records, registered office.
02 Ownership and equity	Cap table, founder agreements, share issuance, ESOP.
03 Finance and tax	Invoices, bank statements, filings, reconciliations, management reports.
04 Customers	Contracts, SOWs, renewals, amendments, data/security addendums.
05 Vendors and contractors	Agreements, invoices, IP/confidentiality terms.
06 People	Offer letters, payroll, contractor records, exits, access removal.
07 IP and brand	Assignments, trademarks, domains, licenses, open-source notes.
08 Security and data	Data map, access review, incident notes, vendor processing.
09 Fundraising and governance	Decks, memos, investor docs, board notes, approvals.

Name files with date, party, and document type. Clean naming saves hours during diligence.

Diligence readiness table

Use this before fundraising, debt, strategic partnership, or acquisition conversations.

Area	Green	Yellow	Red
Company records	Organized and current	Mostly present, some missing links	Scattered or unclear
Cap table	Current and reconciled	Needs advisor review	Founder/investor ownership unclear
Contracts	Signed versions stored	Some unsigned or email-only terms	Material contracts missing
IP	Founder/employee/contractor assignments organized	Some older gaps	Core IP ownership uncertain
Finance	Revenue, invoices, bank, and accounting reconcile	Manual cleanup needed	Numbers conflict across sources
Payroll/people	Records and exits clean	Some paperwork missing	Salary, contractor, or exit disputes
Security/data	Access and data map known	Partial review	Unknown access or customer data exposure risk

Yellow is normal early. Red should become a founder priority before the company enters a high-trust transaction.

Compliance operating review

Once a month, ask:

What was due?
What was completed?
What is blocked?
Which documents are missing?
Which contracts need renewal or closure?
Which payments or invoices need reconciliation?
Which founder decision needs professional review?

This can take fifteen minutes if the system is clean. It can take weeks if ignored.

Compliance severity ladder

Not every compliance issue deserves the same founder attention. Use this ladder to decide what gets handled by the team, what needs advisor review, and what needs founder escalation.

Severity	Example	Response
Low	Missing document link, outdated folder name, minor contract metadata gap.	Assign owner and cleanup date. Review in the next operating review.
Medium	Invoices not reconciled, unsigned vendor paperwork, contractor records incomplete, access removal not confirmed.	Put into weekly review until closed. Ask advisor if legal, tax, IP, or payroll interpretation is needed.
High	Founder equity unclear, core IP assignment missing, customer data obligations unknown, tax/GST issue unresolved, investor diligence mismatch.	Founder owns the cleanup plan. Professional advisor reviews before fundraising, enterprise sale, or expansion.
Critical	Regulated activity uncertainty, legal notice, customer data incident, payroll dispute, major tax demand, misleading investor/customer document.	Stop casual handling. Bring in qualified professional support, document facts, and communicate deliberately.

The point is not to panic. The point is to stop treating all issues as the same. A missing folder link and an unclear founder equity promise do not belong in the same queue.

Compliance evidence log

For every meaningful compliance item, keep evidence. “Our CA handled it” is not evidence unless the company can find the confirmation, filing, receipt, document, or workpaper.

Item	Evidence to save
Filing completed	Acknowledgement, receipt, form copy, advisor confirmation, date completed.
Contract signed	Fully executed PDF, amendment history, renewal date, owner.
Tax/invoice review	Advisor note, invoice sample, classification decision, open questions.
Employee/contractor onboarding	Signed offer or agreement, IP/confidentiality terms, identity/payroll documents where applicable.
Board/shareholder approval	Meeting note, resolution, consent, filing link if any.
Access review	Tool list, admin list, removed users, exceptions, next review date.

Use one simple rule: if the company later needs to prove that something happened, save the proof now.

Founder compliance dashboard

Founders do not need a complex governance system early. They need a clear dashboard.

Metric	Green	Warning
Compliance calendar	All current-month items have owner and due date.	Due dates live only with an external advisor.
Contract repository	Signed contracts are searchable by customer/vendor/date.	Important terms are buried in email or WhatsApp.
IP paperwork	Founders, employees, and contractors have documented ownership/assignment where relevant.	Core product work was done without clear paperwork.
Finance reconciliation	Revenue, invoices, bank collections, and receivables are reviewed monthly.	Numbers differ between deck, model, invoices, and bank.
Access hygiene	Admin access is reviewed and offboarding removes access quickly.	Ex-employees, contractors, or agencies retain access.
Advisor cadence	CA/CS/legal questions are batched and reviewed before key events.	Professional review happens only during crisis.

Review this dashboard monthly, and before fundraising, enterprise procurement, debt, strategic partnership, or acquisition conversations.

Red flags

Treat these as urgent cleanup signals:

No single source for company documents
Founder equity not documented clearly
Contractors built core IP without proper assignment
Revenue numbers do not match invoices and bank collections
Important contracts exist only in email threads
Employees or vendors retain access after leaving
Compliance due dates are known only to one external person
Investors ask diligence questions and the team scrambles

Founder operating principle

Compliance work should be boring, visible, and owned.

Use this rhythm:

Rhythm	Action
Weekly when messy	Clean missing records, invoices, contracts, and access.
Monthly when stable	Review calendar, payments, contracts, payroll, and advisor questions.
Before fundraising	Run diligence readiness table and close red gaps.
After major events	Update records after funding, share issuance, hiring, exits, major contracts, or product data changes.

The goal is not to become a compliance expert. The goal is to make the company trustworthy and easy to review.

Advisor meeting pack

When you meet a CA, CS, lawyer, payroll advisor, or sector specialist, bring a clean pack. It saves time and reduces vague advice.

Advisor topic	Bring
Company records	Incorporation documents, cap table, board/shareholder notes, current questions.
Tax/accounting	Revenue model, invoice samples, bank statements, expense categories, open tax/GST/TDS questions.
Contracts	Customer/vendor templates, unusual clauses, renewal dates, unsigned or email-only agreements.
Employment/contractors	Offer/contractor templates, IP/confidentiality terms, payroll records, exits, ESOP questions.
Data/security	Product data map, customer data handled, access list, subprocessors/vendors, incident questions.
Fundraising	Current cap table, past instruments, proposed terms, investor residency/type, use of funds.

Do not ask advisors, “Is everything okay?” Ask specific questions with documents in front of them.

Event-triggered compliance review

Run a review when these events happen.

Event	Review
First paid customer	Invoice/tax treatment, contract terms, payment path, data/security obligations.
First hire or contractor	Offer/contract, payroll/advisor setup, IP/confidentiality, access provisioning.
Fundraise starts	Cap table, filings, data room, financials, contracts, previous instruments.
Enterprise deal	Security, data, liability, SLA, procurement, commercial terms, support promise.
New regulated feature	Legal/sector review before launch, not after customer complaints.
Founder equity change	Documentation, approvals, tax/legal/advisor review.
Shutdown or asset sale	Stakeholder obligations, records, data, vendors, employees, investors, filings.

Calendars catch routine work. Event triggers catch the moments when the company changes shape.

Compliance decision memo

For material issues, write a short memo.

Field	Notes
Issue
Business decision affected
Facts known
Documents reviewed
Advisor consulted
Options
Chosen path
Risk accepted
Owner and date
Evidence saved

This memo is not a substitute for professional advice. It is a way to make founder decisions traceable.

Founder escalation map

Some compliance questions can wait for a routine review. Others need immediate advisor attention.

Situation	Escalation
First version of routine customer/vendor contract	Scheduled lawyer review.
First hire, ESOP promise, or contractor IP arrangement	Lawyer/HR/payroll advisor before signing.
Fundraise, share issuance, or investor instrument	Lawyer, CS, and tax/accounting review before execution.
Customer data, regulated data, financial/health/children data, or breach concern	Legal/security/sector expert review immediately.
Tax notice, legal notice, employee dispute, customer claim, or regulator communication	Professional advisor immediately.
Shutdown, asset sale, founder exit, or major equity change	Lawyer, CS, accountant, and board/investor process review.

Use this triage:

Risk level	Founder action
Low	Record the issue, owner, and next review date.
Medium	Ask advisor before repeating the activity or signing more agreements.
High	Pause the action until advice is received and documented.

The most expensive compliance issues often begin as “small exceptions.” Escalate when the exception could affect ownership, money, data, employees, customers, regulated activity, or fundraising diligence.

90-Day Compliance Cleanup Sprint

If the company already has scattered documents, unclear owners, or pending advisor questions, do not try to fix everything in one weekend. Run a focused 90-day cleanup sprint.

Period	Focus	Output
Days 1-15	Inventory	List company records, contracts, finance files, people records, IP documents, access lists, and open advisor questions.
Days 16-30	Risk sort	Mark each gap low, medium, high, or critical using the severity ladder. Founder owns high and critical items.
Days 31-45	Ownership	Assign internal owner, external advisor, due date, evidence location, and next decision for each important gap.
Days 46-60	Core cleanup	Close missing founder, equity, IP, contract, payroll, invoice, and access items that could affect fundraising, sales, or disputes.
Days 61-75	Process setup	Create the compliance calendar, repository structure, naming convention, and monthly review habit.
Days 76-90	Diligence rehearsal	Run the diligence readiness table and ask: what would still embarrass us if an investor, enterprise customer, bank, or acquirer asked tomorrow?

The sprint should produce fewer open loops, not a beautiful folder with the same unresolved risks. Track each issue until it has one of four outcomes: closed, advisor-reviewed, accepted risk, or blocked with next action.

Compliance Owner Map

Compliance fails when everyone assumes the CA, CS, lawyer, founder, or finance person is handling it. Write an owner map.

Area	Internal owner	External reviewer	Review rhythm
Company records and filings	Founder/ops	CS/lawyer where needed	Monthly and event-based
Accounting and tax	Finance/founder	CA/tax advisor	Monthly
Payroll and people records	People/ops	Payroll advisor/lawyer	Monthly and on every joiner/exit
Contracts	Founder/sales/ops	Lawyer	Before signing and renewal
IP and brand	Founder/product/ops	Lawyer/IP advisor	On new contractor, employee, vendor, or brand asset
Data and security	Founder/engineering	Legal/security advisor when sensitive	Quarterly or before enterprise deals
Fundraising/data room	Founder/finance	Lawyer, CS, CA	Before and during raise

The internal owner does not need to be an expert. They need to know what is due, where evidence lives, which advisor to ask, and when the founder must decide.

Diligence Gap Closure Board

When fundraising, enterprise procurement, debt, acquisition, or a serious partnership starts, compliance gaps stop being abstract. They become blockers, valuation pressure, delay, or trust loss. Use a closure board instead of a vague “cleanup” list.

Gap	Why it matters	Risk level	Advisor/reviewer	Evidence needed
Missing founder IP assignment	Core product ownership may be questioned.	High	Lawyer	Signed assignment or advisor-reviewed fix
Unsigned customer pilot terms	Revenue and obligations may be unclear.	Medium/High	Lawyer/sales	Executed agreement or cleanup note
Revenue does not match bank collections	Investor/acquirer may distrust financials.	High	CA	Reconciliation and explanation
Contractor access still active	Security and IP risk.	Medium	Engineering/ops	Access removal proof
ESOP promise not documented	Employee trust and cap table risk.	High	Lawyer/CS	Grant record, board approval, employee communication
Data subprocessors not listed	Enterprise/security review risk.	Medium	Legal/security	Vendor list and data-use note

Run the board weekly until every material item has one of four states:

State	Meaning
Closed	Evidence exists and is stored.
Advisor-reviewed	Risk is understood and documented, even if no perfect fix exists.
Accepted risk	Founder, board/advisors, and relevant stakeholders understand the risk.
Blocked	The next action, owner, and escalation are explicit.

Do not mark a gap as closed because someone “will handle it.” A gap closes when the company can show the document, reconciliation, approval, advisor note, or evidence trail.

Questions To Ask Advisors

Founders often underuse advisors by asking broad questions like “Is this okay?” Better questions create better answers.

Area	Better advisor question
Incorporation and structure	Given our funding plan, customer geography, and founder situation, what structure creates the least avoidable future friction?
GST/tax/invoicing	What exactly should our invoice look like for this revenue type, and what records should we save every month?
Contractor and IP	Does this agreement clearly assign the work product to the company, and what happens if the contractor reuses code or assets?
ESOP	What should employees understand about grant size, vesting, exercise, tax, and liquidity before we make promises?
Customer contracts	Which clauses create disproportionate risk for our stage, and what fallback language should we use?
Data/security	What data are we collecting, who processes it, and what minimum policy, access, and incident records should exist now?
Fundraising	What documents must be clean before sending the data room, and which gaps could slow closing?
Shutdown or sale	What obligations survive after operations stop, and what records must be preserved?

After every advisor meeting, write a short note:

Question asked:
Documents reviewed:
Advisor answer:
Decision for the company:
Risk accepted:
Owner:
Evidence saved at:
Review trigger:

This keeps professional advice connected to operating decisions. It also prevents founders from relying on vague memory months later when investors, customers, employees, or acquirers ask for proof.

Fundraising diligence mini-audit

Before sharing a data room, run this mini-audit. It is designed for founders, not lawyers. The goal is to catch trust-breaking gaps before an investor, enterprise customer, bank, or acquirer catches them.

Diligence question	Proof to prepare	Owner	Do not say
Who owns the company?	Current cap table, share issuance records, founder agreements, investor instruments, ESOP summary.	Founder/CS/lawyer	”The cap table is roughly this.”
Who owns the product/IP?	Founder, employee, contractor, agency, and vendor IP/confidentiality documents; domain and repository ownership.	Founder/legal/product	”Our developer built it, so it is ours.”
Are revenues real and reconciled?	Invoices, bank collections, receivables aging, refunds/credits, revenue recognition note.	Finance/CA/founder	”MRR is what we expect to collect.”
Are customer obligations clear?	Signed contracts, SOWs, pilots, SLAs, data/security addendums, renewal dates, support promises.	Sales/ops/legal	”The agreement is in email somewhere.”
Are people and ESOP promises clean?	Offer letters, contractor agreements, payroll records, exits, ESOP grants/promises, vesting communication.	Founder/people/legal	”We verbally promised equity but will sort it later.”
Are taxes and filings current enough?	GST/TDS/income tax/accounting status, advisor notes, open demands, pending filings, reconciliation.	Finance/CA	”Our CA has everything” without evidence.
What customer/user data do you handle?	Data map, privacy policy, access list, vendor/subprocessor list, incident record, retention/deletion policy.	Founder/engineering/legal	”We do not have data risk” before mapping data.
Are there hidden disputes or notices?	Legal notices, tax notices, employee/vendor/customer disputes, settlement notes, advisor position.	Founder/legal/finance	”Nothing material” without asking the right owners.
Is the round use of funds credible?	Runway model, hiring plan, milestone plan, burn assumptions, bridge scenario, board/founder approval where needed.	Founder/finance	”We will use it for growth.”

48-hour diligence readiness check

If a serious investor asked for diligence tomorrow, the founder should be able to answer these in 48 hours:

Check	Pass condition
Single source of truth	The latest deck, memo, model, cap table, and CRM use the same numbers and definitions.
Proof folder	Every important claim has a supporting file, note, contract, metric export, or advisor-reviewed explanation.
Open gaps list	Known gaps are listed with risk level, owner, advisor, and expected closure date.
Advisor context	CA, CS, lawyer, and key operators know a raise or diligence event is happening.
Founder answer bank	The founder can explain top risks honestly without improvising or hiding.

If the company fails this check, do not panic. Create a two-week diligence cleanup sprint and tell investors what is true. Trust is built faster by clear gaps than by confident confusion.