The Advisory Hub
The Legal Health Check
A privileged, counsel-led audit of your own company — what it covers module by module, how the review is run, what the findings memorandum looks like, and why it is cheapest before a fundraise, a sale, or a notice.
Every company is eventually read the way it never reads itself. An investor's lawyers read it in diligence. The FBR reads it in an audit. The SECP reads it after a complaint. Opposing counsel reads it in a dispute, hunting for the unsigned contract and the unfiled return. A legal health check is the decision to read the file first: a structured review of the company's whole legal position, run by counsel, reported privately to management, while every finding is still cheap to fix.
The position below is stated as of July 2026. The check itself is always run against the law standing on the day of review — which is part of its value, because thresholds and filing requirements move, and a company that was compliant at incorporation is rarely compliant by habit five years later.
What the check is, and what it is not
A health check is not the statutory audit. The audit, mandatory for most companies under the Companies Act, 2017, examines the financial statements and reports to shareholders; it will note a missing tax provision but will not read your contracts or your employment files. It is not due diligence either — diligence is conducted by a counterparty, for the counterparty, and its findings are used to reprice or restructure the deal against you. And it is not a certificate: no serious counsel will stamp a company "compliant," because compliance is a state that decays.
What it is: an internal, privileged, scoped examination that asks the questions a hostile reader would ask, in an order you control, with the answers delivered to you alone. The discipline borrows from due diligence deliberately. If the review is done honestly, the company has sat the examination before the examiner arrives.
When to commission one
Certain moments make the check close to mandatory. Six to twelve months before a fundraise or a sale, so that findings are cured before a counterparty prices them. On taking over as chief executive, CFO, or director — the Companies Act, 2017 attaches duties and, in places, personal liability to these roles, and it is rational to know what you have inherited. Before a significant bank facility, because lenders' conditions precedent increasingly resemble diligence. After a period of fast growth, an acquisition, or a new province of operations, each of which adds registrations and obligations nobody assigned. And after the first serious regulator letter, which is usually a symptom rather than the disease.
Outside these moments, a fixed cycle — every year or two — keeps the review boring, which is what a review should be.
The scope, module by module
A full-scope check for a Pakistani operating company typically covers ten areas.
Corporate record. The statutory registers, minutes, and resolutions against the company's filed record at the SECP: the annual return (Form A) for each year, financial statements where the company's class must file them, event-driven returns for changes of directors, officers, registered office, and charges, and the ultimate beneficial ownership record the law now requires [CURRENT UBO REQUIREMENTS — TO BE VERIFIED BY REVIEWING LAWYER]. Gaps here are common, mechanical, and worth fixing before anyone else counts them.
Shareholding. Every issue and transfer since incorporation, traced to its authority: the resolution, the consideration, the filing, the register entry. Defects in the cap table are the single most expensive category of finding in a later transaction.
Contracts. The top twenty by value or dependence, read for execution, stamping under the applicable provincial Stamp Act, 1899 schedule, term and renewal, liability and indemnity exposure, and termination rights — yours and theirs.
Tax. Registrations against the actual footprint: income tax, federal sales tax under the Sales Tax Act, 1990 where goods are supplied, provincial services tax where services are rendered. Then the filings under the Income Tax Ordinance, 2001 and the sales tax statutes, reconciled to the accounts; the company's performance as a withholding agent, which is where silent exposure accumulates; and every open notice, audit, or appeal with its deadline.
Employment. Contracts, policies, the anti-harassment framework the law mandates, EOBI and provincial social security registrations, and contractor arrangements that a labour court would read as employment.
Then the shorter modules: licences and sectoral permissions, with expiry dates; intellectual property, meaning registrations in the company's name and signed assignments from everyone who created anything; data, meaning where personal information sits and under what contracts; disputes, pending and threatened, honestly reserved; and insurance, tested against the risk picture the review has just built rather than the one assumed when the policies were bought.
How the review is run
The check runs through external counsel so that the work product attracts privilege, and it is framed from the first email as the seeking of legal advice [PRIVILEGE SCOPE UNDER THE QANUN-E-SHAHADAT ORDER, 1984 — TO BE VERIFIED BY REVIEWING LAWYER]. Counsel issues a document request; the company produces what exists. Verification then goes outside the company's own papers — the SECP's record of the company, the FBR's Active Taxpayers List, the trademark register — because the review is testing the file against the world, not against itself. Short interviews with finance, HR, and operations catch what the documents omit, which is usually the most interesting layer. A focused review of a mid-sized company is measured in weeks, with the exact scope and sequence set in the engagement letter.
The findings memorandum
The output is a single memorandum, graded. At the top: findings creating live legal exposure now — an expired licence, un-deposited withholding, an unlawful allotment. Next: findings that will surface as diligence or audit points and cost money then — unstamped contracts, register gaps, missing IP assignments. Last: hygiene. Every finding carries four things: the instrument it arises under, the realistic exposure, a named owner, and a date. The memorandum is presented to the board or the owners once, in person, because a finding read aloud gets fixed and a finding circulated by email gets filed.
Acting on the findings
Remediation has a natural order. Stop anything that is a continuing breach first. Cure the filing gaps next — the SECP's regime allows late filing on payment of additional fees, and the meter runs until you do. Repair contracts at their renewal points rather than by reopening live deals. Take tax findings to advisers before any notice arrives, while voluntary positions are still available. Reserve honestly against disputes.
And keep the fixed state fixed. The health check is a photograph; the compliance calendar — covered in its own article in this hub — is the mechanism that stops the picture degrading. Run together, the two are the closest thing an unlisted Pakistani company gets to an institutional legal function.
The Checklist
Legal health check scope checklist
The document and verification list a full-scope health check works through, module by module.
- Pull the company's complete filed record from the SECP and reconcile it line by line against the statutory registers kept at the registered office.
- Confirm the annual return (Form A) and financial statements have been filed for every year since incorporation, and list every gap with the additional fees now attached to it.
- Trace every share issue and transfer on the cap table to a board resolution, a filed return, and a register entry — no exceptions, including founder shares.
- Check that the ultimate beneficial ownership record and filings match who actually owns and controls the company today.
- List every related party arrangement and confirm each has the approvals and documentation the Companies Act, 2017 requires.
- Assemble the top twenty contracts by value or dependence and review each for execution, stamping, term, renewal, liability, and termination exposure.
- Verify every registration the business footprint requires — NTN, federal and provincial sales tax, EOBI, social security, professional tax — against what the company actually does and where.
- Reconcile the last three years of income tax and sales tax filings against the financial statements, and list every open notice, audit, or appeal with its deadline.
- Confirm withholding under the Income Tax Ordinance, 2001 was deducted and deposited on salaries, rent, services, and supplies, with the statements filed.
- Review the employment stack: written contracts, the mandatory anti-harassment framework, payroll registrations, and contractor arrangements that look like employment.
- List every licence, permission, and sectoral registration the business needs, with expiry dates and named renewal owners.
- Verify the company actually owns its brand, code, and content — registrations in the company's name and signed assignments from founders, employees, and contractors.
- Map where personal and customer data sits, who can access it, and what contracts govern the vendors holding it.
- List all pending and threatened disputes, demand notices, and regulator correspondence, with an honest exposure estimate against each.
- Compare insurance cover against the risks the review surfaces, not the risks the policies were bought for.
- Give every finding an owner, a cost estimate, and a completion date, and diarise the re-check before the memorandum is filed away.
Questions, Answered
What clients ask most.
The statutory audit under the Companies Act, 2017 tests whether the financial statements give a true and fair view, and it reports to shareholders. A health check tests the company's entire legal position — filings, contracts, tax, employment, IP, disputes — and reports privately to management. The auditor must qualify what it finds; the health check exists so you can fix what it finds first.
This is exactly why the check should run through external counsel, with the engagement framed as the seeking of legal advice, so the communications attract privilege under the Qanun-e-Shahadat Order, 1984 [SCOPE OF PRIVILEGE — TO BE VERIFIED BY REVIEWING LAWYER]. The real risk runs the other way: the findings exist whether or not you look. A privileged review followed by remediation is a better record than ignorance followed by discovery.
Before every fundraise or sale, after any acquisition, on a change of chief executive or CFO, and otherwise on a fixed cycle of one to two years depending on how fast the business is changing. A company that has never run one should assume the first review will be the longest; subsequent checks work from the prior memorandum and move much faster.
Very little — that is the point. Counsel issues a document request; the company produces what exists and, just as importantly, admits what does not. Pre-cleaning the file before the review defeats it. The one genuinely useful preparation is naming a single internal coordinator with authority to pull records from finance, HR, and operations.
The finding goes into the memorandum with a severity grade, and the remediation conversation starts immediately rather than at the end. Some findings are mechanical — late filings cured at a known cost. Others, such as an open tax exposure or an unlawful share issue, need a strategy decided with counsel before anything is filed or disclosed. What the company must not do is note the finding and carry on: a documented finding that was ignored is the worst version of the facts.
Prepared by The First Counsel · As of 2026-07-12 · Pending professional review — statements flagged in the text are being verified
This publication is provided for general information only. It is not legal advice, and neither reading it nor corresponding with the firm about it creates a lawyer–client relationship. The position stated must be verified against current law before it is relied upon.