Legal Audit for Startups: What to Check Every Quarter

Most Indian startups get hit with MCA penalties, GST mismatches, or investor red flags not because they ignored compliance — but because they checked it once and never came back. A quarterly legal audit for startups costs a few hours every 90 days. The alternative can cost ₹50,000 to over ₹10 lakh in late fees, compounding penalties, and reinstatement costs.

Here’s exactly what to review every quarter — so legal problems don’t ambush you at the worst possible time.

What You’ll Learn

• Which MCA and ROC filings to verify every quarter — and what happens if you miss them
• The GST and TDS checks that catch 90% of tax compliance gaps before they become notices
• Contract, IP, and HR items most founders overlook until due diligence knocks
• A simple 4-area framework you can run in-house or hand to your CA in under a day

Why Quarterly — Not Annual — Is the Right Cadence

Annual compliance reviews made sense when businesses moved slowly. Startups don’t. A new co-founder joins in March, a contractor agreement expires in June, your GST turnover crosses ₹10 crore in September — and none of these trigger automatic alerts. By the time your annual audit flags the gap, the deadline has passed and the penalty clock has been running for months.

Here’s the thing: MCA charges ₹100 per day of delay on most ROC forms — with no upper cap on penalties for forms like MGT-7 (Annual Return). Miss a quarterly TDS return and you’re looking at ₹200 per day as a delay fee, plus interest on the unpaid amount. These aren’t theoretical risks. Every year, thousands of MSME and startup directors across India receive MCA strike-off notices that are entirely preventable with a basic 90-day review cycle.

The quarterly rhythm also aligns naturally with India’s GST filing calendar (monthly GSTR-1 and GSTR-3B), TDS return quarters (April–June, July–September, October–December, January–March), and advance tax payment installments. Reviewing compliance once a quarter means you’re never more than 90 days away from catching a problem early.

Check #1 — MCA and ROC Filings Status

Start every quarterly audit on the MCA21 portal — the Ministry of Corporate Affairs’ online compliance hub. Log in and pull your company’s master data. Check that your registered office address is current, all directors have active DIN (Director Identification Number) status, and no forms are showing as “pending” or “under processing” without a valid reason.

What most founders miss: the DIR-3 KYC (Director KYC form) deadline falls on September 30 every year. Miss it and your DIN gets deactivated — you can’t sign any company documents until you pay a ₹5,000 reactivation fee and file. If you have multiple directors, make sure every single one has completed their KYC for the current year before Q2 ends.

Key forms to check each quarter

• ADT-1 — Auditor appointment form. Must be filed within 15 days of the first board meeting. If your startup is in its first year and this hasn’t been done, fix it immediately.
• MGT-7 / MGT-7A — Annual Return. Due 60 days after AGM (Annual General Meeting). Small companies file the simplified MGT-7A. Late filing penalty: ₹100 per day, no cap.
• AOC-4 — Financial Statements. Due 30 days after AGM. Same per-day penalty applies.
• DPT-3 — If your company has received any loans or deposits. Due June 30 annually. Non-filing penalty: up to ₹1 crore or twice the deposit amount, whichever is lower.
• MSME-1 — If you owe money to MSME vendors for over 45 days. Filed half-yearly. Investors check this closely.

Check #2 — GST and TDS Compliance Health

GST compliance is a monthly obligation — but the quarterly audit is where you catch the mismatches that build up. Pull your GSTR-2B (auto-populated Input Tax Credit statement) for the last three months and reconcile it against your purchase register. From 2026, the GSTN (Goods and Services Tax Network) flags supplier-recipient mismatches in real time, so any unreconciled difference shows up as a risk during an inspection or investor data room review.

A quick example: if your supplier filed their GSTR-1 late and you’ve already claimed the ITC (Input Tax Credit — the GST you paid on purchases, which you can offset against your GST liability), that claim will be reversed in your next GSTR-3B. You’ll owe the tax plus interest. Catching this quarterly means you can chase the vendor before the reversal hits.

On the TDS side, verify that deductions are current for all qualifying payment categories. Let’s break this down: TDS (Tax Deducted at Source) must be deducted on professional fees above ₹30,000 at 10%, contractor payments above ₹30,000 per transaction at 2%, and rent above ₹2,40,000 per year at 10%. Quarterly TDS returns are due on July 31, October 31, January 31, and May 31. A missed quarterly return attracts ₹200 per day as a late fee — plus interest at 1.5% per month on unpaid TDS from the date it was due to be deposited.

E-invoicing threshold: are you caught yet?

From April 1, 2026, e-invoicing is mandatory for businesses with turnover above ₹5 crore. If your startup has crossed this threshold and you haven’t enabled e-invoice generation through your billing software or the GSTN portal, every B2B invoice you’ve raised without it is technically non-compliant. Check your last four quarters of turnover and confirm your e-invoicing status every time you run a legal audit.

Check #3 — Contracts, IP, and Cap Table Hygiene

This is the area that trips up investor due diligence most often — and it has nothing to do with ROC deadlines. Every quarter, pull up a simple register of your active contracts and check three things: expiry dates, IP assignment clauses, and unsigned documents sitting in email threads.

A vendor SLA that expired six months ago but is still being performed is legally murky territory. A freelance developer who built your core product but never signed an IP assignment agreement means your company doesn’t cleanly own the code — something any serious investor or acquirer will catch immediately. These aren’t edge cases. They’re among the most common closing conditions flagged in investor due diligence of Indian startups.

ESOP and cap table: reconcile every quarter

If you’ve granted ESOPs (Employee Stock Ownership Plans — equity option grants to employees), the ESOP pool on your cap table must match the scheme document and every PAS-3 filing (a form filed with the ROC whenever shares are allotted). Granted but unvested options must be disclosed separately from vested-but-unexercised options. Investors and acquirers will reconcile this in the data room — mismatches add weeks to closing timelines. Run this check once a quarter, not once a year.

Also verify your trademark status if you’ve filed one. The trademark registration process in India can take 18–24 months, and objections or oppositions during examination require a response within 30 days. Missing that window means abandonment. Set a quarterly reminder to check your application status on the CGPDTM (Controller General of Patents, Designs and Trade Marks) portal.

Check #4 — HR, Labour Law, and Data Privacy Status

If your headcount has changed in the last quarter, your labour law registrations may need updating. PF (Provident Fund) registration is mandatory once you cross 20 employees; ESIC (Employees’ State Insurance Corporation) kicks in at 10 employees in most states. Both have state-level Shops & Establishment Act registrations that require amendment when headcount, address, or working hours change.

The POSH Act (Sexual Harassment of Women at Workplace Act, 2013) requires every company with 10 or more employees to have a constituted Internal Complaints Committee (ICC). The ICC must submit an annual report to the district officer — but quarterly is a good time to confirm your ICC is still validly constituted, especially if a member has resigned or changed roles. Investors and large enterprise clients increasingly ask for proof of POSH compliance before signing.

On data privacy: if your startup collects personal data from Indian users, the Digital Personal Data Protection Act 2023 (DPDPA) is already in play. Investors are treating DPDPA readiness as a legal due diligence item, particularly for B2C, SaaS, healthtech, and edtech startups. Each quarter, verify that your privacy policy reflects current data processing practices, your consent mechanisms are active and explicit, and any data processor agreements (DPAs — contracts with third-party vendors who handle your users’ data) are in place.

If your business qualifies as an MSME, check that your MSME Udyam registration reflects your current NIC code, turnover, and investment in plant and machinery. An outdated Udyam certificate can cause you to miss government scheme benefits or create misrepresentation issues during tenders and bank loan applications.

Frequently Asked Questions

Q: Is a quarterly legal audit mandatory for startups in India?

A: A quarterly legal audit is not mandated by law, but many of the compliance deadlines it tracks — TDS returns, e-invoicing, DIR-3 KYC, and POSH reporting — fall at quarterly or semi-annual intervals. Running a structured 90-day review ensures no deadline is missed between annual statutory audits. For funded startups, most investor agreements include a covenant requiring the company to remain in good regulatory standing, which effectively makes quarterly monitoring necessary.

Q: What happens if a startup misses an ROC filing deadline?

A: The MCA charges ₹100 per day of delay on most ROC forms including MGT-7 and AOC-4, with no upper cap. If a company fails to file annual returns for two consecutive years, the Registrar of Companies can initiate a strike-off under the Companies Act 2013, which leads to the company being removed from the register. Directors of struck-off companies can be disqualified from holding directorships in any Indian company for five years under Section 164(2).

Q: How is a quarterly legal audit different from a statutory audit?

A: A statutory audit is a mandatory annual financial review conducted by an independent chartered accountant under the Companies Act 2013 — it looks at whether your financial statements are accurate. A quarterly legal audit is an internal or advisor-led compliance review that checks whether all filings, registrations, contracts, and regulatory obligations are current and complete. The two serve different purposes and should both be in your compliance calendar.

Q: Do DPIIT-recognised startups get any compliance exemptions?

A: DPIIT (Department for Promotion of Industry and Internal Trade) recognition under the Startup India scheme unlocks three consecutive years of income tax exemption under Section 80-IAC, angel tax exemption under Section 56(2)(viib) for allotments after April 1, 2024, and self-certification under six labour laws. However, core MCA filings — AOC-4, MGT-7, GST returns, and TDS obligations — are not waived. A DPIIT-recognised startup that has crossed the ₹100 crore turnover threshold without updating its status creates a misrepresentation risk that any investor will flag.

Q: What should I check in a legal audit before raising a funding round?

A: Before opening a data room for investors, run a pre-due diligence legal audit covering: clean MCA filing history with no pending defaults, all director DINs active and KYC current, ESOP pool reconciled to PAS-3 filings, all founding IP assigned to the company (not held personally by founders), GST registration active with no unreconciled GSTR-2B mismatches, valid DPIIT recognition if applicable, and POSH compliance documented. Catching and fixing these items before the term sheet is signed prevents costly closing conditions that delay and sometimes kill funding rounds.

Q: Can I do a legal audit myself or do I need a CA or lawyer?

A: Founders can run the MCA portal checks, GSTR-2B reconciliation, and contract expiry reviews themselves with a structured checklist. However, TDS return verification, statutory audit coordination, ESOP scheme compliance, and DPDPA readiness typically require a CA or legal professional for accuracy. Many startups use a combination — founders track the calendar and flag items, while a CA or compliance platform handles the actual filing and remediation. The goal of a quarterly audit is early detection, not necessarily self-filing.