Case Study: Access Controls & Segregation-of-Duties Audit for an NBFC
Strengthening loan-cycle controls across origination, approval, disbursement and repayment modification
Executive Mandate Summary
Key Transaction & Governance Challenges
- •The loan management system had been configured when the NBFC had only 8 employees and access rights were never redesigned as the organisation expanded to 42 employees.
- •15 loan officers could originate, approve, disburse and modify loans without system-enforced segregation.
- •4 former employees continued to have active system access.
- •One loan officer originated and disbursed ₹8 lakh to a borrower who was the officer's cousin, contrary to the NBFC's related-party lending policy.
Northrop Execution Architecture & Methodology
Executive Mandate Overview
An NBFC with ₹95 crore in assets under management had expanded from ₹12 crore AUM to ₹95 crore over four years.
Its loan management system, however, had not evolved at the same pace.
The system had originally been configured when the organisation had only eight employees. As the team expanded to 42, legacy permissions remained active.
The result was a material segregation-of-duties weakness: 15 loan officers could originate, approve, disburse and subsequently modify loans within the same system.
Northrop was engaged to assess access rights, test actual loan transactions and redesign the control environment.
Mapping the Access Risk
Northrop began by extracting the LMS access matrix and comparing system permissions against each employee's designated role.
The review identified:
- 15 users with full-cycle loan access
- 8 users with permissions outside their functional responsibilities
- 4 former employees whose system access remained active
The issue was therefore not limited to individual user behaviour.
The underlying problem was the system architecture itself: permissions had not been recalibrated as the organisation changed.
Testing the Loan Portfolio
Northrop tested approximately 1,200 loans originated during the previous 12 months.
The testing identified:
- 84 loans where the same person originated and approved the loan
- 12 loans where the same person originated, approved and disbursed the loan
- 3 loans where one individual performed all four functions
The three fully self-processed loans were investigated individually.
Two were documented emergency disbursements that were subsequently ratified.
One involved an ₹8 lakh loan to a borrower who was the originating officer's cousin, contrary to the NBFC's related-party lending policy.
The loan remained performing, but the origination represented a control and policy violation.
Rebuilding the Control Architecture
Northrop redesigned the LMS access structure around functional segregation.
Origination: Loan officers
Approval: Credit Manager and above
Disbursement: Operations team
Repayment modification: Credit Committee approval with system logging
Former employees' access was revoked.
A quarterly access-certification process was also established, requiring the compliance officer to compare the LMS access matrix against the current organisation chart.
The objective was to move segregation of duties from a policy expectation to a system-enforced control.
Verifiable Institutional Outcomes & Value Realized
- Origination, approval, disbursement and modification permissions were separated across defined roles.
- Access belonging to former employees was identified and revoked.
- Compliance now reviews system permissions against the current organisation structure every quarter.
- A formal credit policy was drafted and adopted within 30 days.
Ashish Chaudhary
Facing a Similar High-Stakes Transaction or Turnaround?
Northrop partners execute buy-side due diligence, fraud forensics, and financial restructuring with strict board confidentiality and unmatched technical rigor across Indian jurisdictions.
Case Study: Ghost Trainees and Unverified Placements in a Skill Development NGO
A skill development NGO reported that 1,200 youth had been trained and 840 placed in jobs under a programme funded through a ₹1.4 crore CSR contribution. The reported 70% placement rate prompted an independent review of beneficiary records, training delivery, placement claims and programme expenditure. Northrop Management Private Limited conducted a forensic verification covering beneficiary deduplication, attendance records, direct beneficiary calls, employer confirmations, offer letters, salary claims and the underlying financial trail.
View Full Mandate RecordNeed Guidance on Assurance & Risk Advisory?
Northrop senior partners advise boards, funds, and corporate leadership on high-stakes transactions, forensic audits, and regulatory compliance.