How to Conduct a Corporate Legal Health Check Before a Crisis

A practical early-warning framework for promoters, boards, CFOs, general counsel, HR heads, compliance teams and operational leaders who want to identify legal exposure before it becomes litigation, regulatory intervention, fraud loss, data breach or business disruption.

Executive takeaway

Most corporate crises do not begin as crises. They begin as small exceptions: an unsigned contract, a vendor bank change, a delayed statutory notice, an employee retaining system access, a related-party relationship not disclosed, a licence renewal missed, a complaint handled informally, or a dispute that nobody has diarised for limitation.

A corporate legal health check is designed to identify these early signals while management still has options. It is narrower and faster than a full legal due-diligence exercise, but broader than a compliance calendar. Its value lies in finding concentrated legal risk, control breakdown and evidence gaps before they converge into a costly event.

1. What Is a Corporate Legal Health Check?

A corporate legal health check is a structured diagnostic review of the company’s most material legal exposures. It is usually undertaken over a defined period and focuses on whether the business can answer three questions:

1. Where can legal damage arise quickly?
2. Which controls are weak, undocumented or dependent on one individual?
3. What should management fix now, before the issue becomes external?

The exercise should not be confused with a statutory audit. Nor should it become a 500-item tick-box review detached from business reality. The purpose is to create an executive view of risks that can affect cash flow, operations, reputation, regulatory standing or transaction readiness.

For the broader annual framework, see our Corporate Legal Risk Audit in India and Legal Compliance Audit for Private Limited Companies in India.

2. When a Health Check Should Be Triggered

A preventive review is particularly valuable when the company is approaching a moment of change or when warning signs have already appeared.

3. Start With a 360-Degree Risk Map

The first stage should map risk by business function, not merely by statute. The health check team should identify where the company can lose money, lose evidence, lose a licence, miss a limitation period or become unable to explain a transaction.

• Board and governance: authority, conflicts, related parties, reserved matters and statutory records.
• Finance and treasury: payment authority, bank mandates, write-offs, unusual journal entries and recovery exposure.
• Sales: customer contracts, discounts, incentives, representations, credit terms and disputed receivables.
• Procurement: vendor onboarding, ownership, bank changes, pricing anomalies, emergency purchases and conflicts.
• HR: employee documentation, complaints, BGV, disciplinary process, exits and access revocation.
• IT/data: system access, data flows, security incidents, retention and third-party processors.
• Operations: licences, inventory, logistics, claims, warehousing, safety and local permissions.
• Legal: litigation, notices, arbitration, limitation, settlements, legal holds and investigations.

The Corporate Risk & Compliance Resources hub provides deeper topic-specific modules for these areas.

4. Governance Health Check

Corporate crises often worsen because management cannot establish who had authority, what the board knew and when the issue was escalated. The health check should therefore examine the governance record before looking at individual departments.

• Are the Memorandum and Articles aligned with the current ownership and business?
• Can the company produce a current delegation-of-authority matrix?
• Do board minutes record material approvals, disclosures and risk discussions?
• Are director interests and related parties periodically disclosed and updated?
• Can management identify contracts, borrowings and transactions requiring board/shareholder approval?
• Are statutory filings consistent with board records and financial statements?
• Are urgent or retrospective approvals becoming routine?

Section 166 of the Companies Act, 2013 is an important governance reference point for directors’ duties. The current Act and rules should be verified through the Ministry of Corporate Affairs.

5. Contract Stress Test

A health check should identify contracts that can create disproportionate exposure in the next six to twelve months.

• Top customer and vendor contracts by value.
• Contracts with uncapped or one-sided indemnities.
• Agreements approaching renewal, lock-in or termination milestones.
• Customer agreements with service credits, penalties or aggressive warranties.
• Vendor agreements without audit, confidentiality or data obligations.
• Contracts signed by persons whose authority is unclear.
• Agreements where commercial practice differs from written terms.
• Large receivables without clear acceptance evidence or dispute mechanism.
• Oral variations and WhatsApp/email instructions that have never been formalised.

A deeper review is available in our Contract Risk Audit in India.

6. Vendor and Payment Red-Flag Review

Procurement and payment data often reveal problems earlier than policy reviews. The health check should sample high-value and high-risk transactions rather than simply confirm that a vendor policy exists.

• Duplicate vendors, bank accounts or addresses.
• Recent vendor bank-detail changes.
• Single-source or emergency procurement.
• Split purchase orders below approval thresholds.
• Repeat round-value invoices.
• Unusual price variation for comparable goods or services.
• Vendor concentration linked to one employee or business unit.
• Invoices without purchase order, receipt or performance evidence.
• Payments made despite expired contract or unresolved quality issues.

See Vendor & Procurement Fraud Risk and Third-Party Risk Management in India.

7. Workforce and HR Legal Health Check

Employee disputes are frequently symptoms of weak process rather than isolated disagreement. A preventive review should look for structural weaknesses that can create litigation or investigation risk.

• Outdated or unsigned appointment letters.
• Consultants functioning as employees without documentation aligned to reality.
• Inconsistent notice periods, bonus or incentive structures.
• PoSH Internal Committee defects or informal complaint handling.
• BGV gaps in sensitive roles.
• Disciplinary matters without charge, evidence or inquiry record.
• High-risk exits where customer data, code, pricing or confidential information may leave with the employee.
• Former employees retaining system access.
• Large final settlements or severance decisions without authority trail.

The four Labour Codes have been effective from 21 November 2025. Companies should verify current implementation material from the Ministry of Labour & Employment and applicable state requirements.

8. Data and Cyber Health Check

Data risk should be reviewed even if the company has never suffered a public breach. The DPDP Act and the Digital Personal Data Protection Rules, 2025 use a staggered commencement model, making 2026 a critical transition period for data mapping, contract remediation and operating-process design.

• What personal data does the company hold?
• Which departments and vendors can access it?
• Which systems contain customer, employee or sensitive commercial data?
• Is privileged access reviewed and logged?
• Do former employees and vendors lose access promptly?
• Are cloud and SaaS vendors contractually controlled?
• Can the company identify and preserve evidence after an incident?
• Does the incident-response plan include legal, IT, management and communications escalation?

The current DPDP framework and enforcement timeline should be checked on the Ministry of Electronics and Information Technology. For incident planning, see our Cyber & Data Incident Legal Response.

9. Litigation and Regulatory Early-Warning Review

Every health check should test whether disputes are being managed as a portfolio rather than as individual files.

• List every court case, arbitration, legal notice, regulator notice and inspection.
• Record next dates and non-negotiable deadlines.
• Separate claimed value from realistic assessed exposure.
• Identify limitation dates for claims not yet filed.
• Review interim orders, undertakings and continuing obligations.
• Check whether evidence is preserved and whether key witnesses remain available.
• Identify cases where commercial settlement may be more rational than continued litigation.
• Review recurring disputes to determine whether the root cause is contractual or operational.

10. Licence and Regulatory Continuity Check

A missed renewal can stop a business faster than a lawsuit. The health check should maintain a consolidated licence register showing issuing authority, legal basis, location, expiry date, renewal lead time and accountable owner.

• Factory, pollution, fire and environmental approvals.
• Shops and establishment or equivalent registration.
• Trade and municipal permissions.
• FSSAI, legal metrology, import/export, telecom, transport or warehousing approvals where applicable.
• RBI, SEBI, IRDAI or other financial-sector permissions for regulated entities.
• Customer-mandated certifications that are contractually material.

11. Evidence Preservation: The Most Overlooked Part of Crisis Prevention

When a problem escalates, the company often discovers that the evidence needed to defend itself has already disappeared. A health check should therefore test evidence readiness.

• Can executed contracts be located?
• Are board and approval records searchable?
• Are access logs retained long enough to investigate misuse?
• Are CCTV, email and system-retention periods known?
• Can finance retrieve transaction-level supporting documents?
• Is there a process for legal hold and preservation once litigation is anticipated?
• Are investigation interviews and findings documented?
• Can the company distinguish original documents from altered or unsigned copies?

12. A 30-Day Corporate Legal Health-Check Model

The exact timetable should be adjusted to company size and risk. A regulated enterprise or multi-location business may require a longer diagnostic cycle.

13. The Five Levels of Legal Risk

• Immediate crisis: active fraud, regulatory raid, data incident, injunction, licence suspension or criminal exposure.
• Critical latent risk: known issue capable of becoming external quickly, such as expired licence, severe governance defect or material undisclosed related party.
• High control risk: repeated failures in payments, vendor onboarding, contracting, HR or data access.
• Medium process risk: policy and documentation weaknesses that have not yet produced material loss.
• Low housekeeping risk: minor record inconsistencies with limited impact.

The central objective is to prevent Level 3 and Level 4 weaknesses from becoming Level 1 events.

14. What Management Should Receive

A useful health check should end with a concise decision document, not an indiscriminate document dump.

• Top 10 enterprise legal risks.
• Critical actions required within 7 days.
• 30-day remediation actions.
• 90-day structural improvements.
• Overdue statutory and contractual obligations.
• High-risk contracts and vendors.
• Open litigation and limitation deadlines.
• Licences approaching expiry.
• Data and access-control gaps.
• Issues requiring investigation or privileged legal review.

Where the issue is systemic, management should move from the rapid health check to a deeper enterprise legal risk mitigation programme.

Frequently Asked Questions

Is a legal health check the same as legal due diligence?

No. Due diligence is typically transaction-driven and often involves a deeper verification exercise for a buyer, lender or investor. A legal health check is management-driven and designed to identify urgent internal risk before a crisis or transaction.

How long should it take?

A focused review can often be structured over a few weeks. Larger, regulated or multi-location businesses require more time and sampling.

Which department should own it?

The legal or compliance function can coordinate, but the review must involve finance, HR, procurement, IT, operations and management. Many risks sit between functions.

What is the first thing to check if management suspects fraud?

Evidence preservation and access control should be addressed immediately, followed by a scoped investigation. Routine document cleanup should not destroy or alter potentially relevant evidence.

Should employees be told that a health check is happening?

That depends on scope. A routine compliance review may be transparent. A suspected fraud, data leak or misconduct investigation may require restricted disclosure to preserve evidence and avoid interference.

Early-stage legal-risk and compliance scoping

Businesses may use the enquiry form to identify the broad scope of a governance, compliance, contract, vendor, workforce, data, investigation or operational-risk concern for an initial conflict and scope review. This does not constitute solicitation or create an advocate-client relationship.

Open Corporate Enquiry Form