Working notes

Founders hear the word "controls" and picture friction — approvals, forms, slowing down. It's backwards.

The company without controls is the slow one. It re-solves the same problems, scrambles before every deadline, and rebuilds its history every time someone asks a hard question.

So here's the build list — the first ten controls, in the order I'd actually install them. Each is cheap, each is roughly a page, each turns a recurring risk into a non-event:

1. Separate business & personal money  2. One source of truth for the books  3. Bank-payment approval rule  4. Monthly close  5. Compliance calendar with an owner  6. Document decisions as they happen  7. Reconciled cap table  8. Contract before work  9. Basic segregation of duties  10. Quarterly governance review.

The first five stop money and numbers from going wrong inside the company. The second five make the company provable to outsiders — investors, auditors, buyers.

The test of whether a control is real: does the right thing still happen if the founder forgets? If it depends on memory, it isn't installed yet — it needs an owner and a record.

The best time to build these was at incorporation. The second-best time is today.

Full list, with how to roll it out: The First 10 Controls Every Founder Should Implement. Part 4 of our startup governance series.

Most founders walk into due diligence still in pitch mode, trying to impress. That's the wrong posture — and investors can feel it.

Diligence isn't a sales meeting. It's a verification exercise. By this stage the investor has already decided they like the business. The question now is colder: "can I trust what I've been told, and what risk am I taking that I can't yet see?"

So they test five things: whether the numbers can be trusted, whether the revenue is real and durable, whether the cap table is clean, whether there are hidden liabilities, and whether your story matches your documents.

Here's the part founders miss: clean diligence rarely raises your valuation. But messy diligence quietly lowers it — through indemnities, holdbacks, escrow and re-priced terms. And one finding worth remembering: a problem you disclosed is a negotiation; the same problem the investor discovers is a trust event.

The pitch earns you the offer. The records let you keep it.

Full breakdown — what investors check, and how to be ready before you raise: What Investors Actually Look For During Due Diligence. Part 3 of our startup governance series.

The most useful question a founder can ask isn't "how do I fix this?" It's "have I fixed this before?"

Because if the same issue keeps coming back — late collections, hiring challenges, cash-flow surprises, numbers that never tie out, last-minute compliance panic — you probably don't have a people problem. You probably don't even have a business problem. You have a process problem.

In my experience, recurring issues are rarely solved by more effort. They're solved by ownership, rhythm, documentation, and systems.

A founder once told me: "we keep having collection issues." After reviewing the numbers, it became clear that collections weren't the problem. Nobody owned collections. Customers were followed up only when cash became tight. The company wasn't facing a collections problem — it was facing the absence of a collections process.

That's the theme of Part 2 of our startup governance series: Why Most Startup Problems Are Process Problems.

Companies rarely scale by becoming better firefighters. They scale because they stop needing fires to remind them what should have been a process.

Most people looked at the recent SEBI interim order involving Rajesh Exports and saw a number. ₹15.15 lakh crore.

I looked at it and saw something else. An aged receivable.

According to the order, the matter traces back to concerns raised regarding receivables that had remained outstanding for an extended period. A simple question followed: where is the cash?

From a forensic perspective, that's often where the interesting work begins. Not because an aged receivable proves anything — it doesn't. But because genuine transactions ultimately leave evidence trails: cash movements, counterparties, contracts, approvals and supporting records.

When I review a file, I don't start by asking "is the revenue real?" I start by asking: can I verify it independently? Can I trace it to source documents? Can I identify the counterparty? Can I reconcile the cash? Can I reproduce management's explanation from evidence?

The company has publicly disputed the findings in SEBI's interim order, and the matter will follow its legal and regulatory process. Regardless of the eventual outcome, the order provides an interesting case study in the types of issues that investigators, auditors, lenders, investors and boards often examine: aged receivables, revenue concentration, counterparty verification, related-party transactions, asset substantiation, documentation and audit trails.

Compliance proves that filings were made. Governance proves that transactions can be demonstrated.

And when difficult questions arrive, the most valuable asset in the room is not a presentation or an explanation. It's evidence.

Full forensic breakdown: Anatomy of a ₹15-Lakh-Crore Allegation.

I spent 10 years learning to read what isn't in the financial statements. The revenue line that looks clean but hides customer concentration risk. The expense category that's technically accurate but economically misleading. The cash flow that makes a company look solvent when it's actually months from a crisis.

Trained that way, I find it hard to look at AI adoption narratives without asking — what's not in this picture?

Still early in how this will evolve, but here's what I'm not seeing in most conversations about AI transforming finance and strategy:

Leadership teams using AI to produce better-looking outputs faster — without fixing the underlying assumptions those outputs are built on. Companies calling themselves "AI-first" who have fundamentally the same decision-making quality they had two years ago, just faster and with better decks. Founders who are excited about AI summarising their MIS instead of asking why their MIS needed summarising in the first place.

AI is a powerful amplifier. But it amplifies what's already there — good thinking gets sharper, bad thinking just gets presented more convincingly.

The most important question for any business adopting AI isn't "what can it do?" It's "what blind spots are we now running faster with?"

Would love to hear from folks in finance, advisory, or strategy roles — are you seeing this play out too?