Internal Financial Controls in India: What Directors and Auditors Must Report

The Companies Act, 2013 put internal financial controls — IFC — on the agenda of every board. Directors are responsible for them, and many companies' auditors must report on them each year. This guide explains what IFC means and who has to report on it.

What IFC Means

The Act describes internal financial controls as the policies and procedures a company adopts to ensure the orderly and efficient conduct of its business, including adherence to its policies, safeguarding of its assets, prevention and detection of frauds and errors, accuracy and completeness of accounting records, and timely preparation of reliable financial information.

Directors' Responsibility

Under Section 134(5)(e), the directors' responsibility statement of a listed company must state that the directors have laid down internal financial controls to be followed by the company, and that they are adequate and operating effectively. More broadly, directors of every company are responsible for the company's controls.

The Auditor's IFC Report

Under Section 143(3)(i), the statutory auditor reports on whether the company has adequate internal financial controls with reference to financial statements, and on their operating effectiveness. The ICAI has issued a Guidance Note on how this audit is performed.

Exemptions

The auditor's IFC report isn't required for:

• One Person Companies and small companies.
• Private companies with turnover below ₹50 crore as per the latest audited financial statement, or with aggregate borrowings from banks, financial institutions or any body corporate below ₹25 crore at any point during the financial year.

Possible Opinions

• Unmodified: controls are adequate and operating effectively.
• Qualified: there are material weaknesses in specific areas.
• Adverse: material weaknesses are pervasive, and the company doesn't have adequate, effective controls.
• Disclaimer: the auditor couldn't obtain enough evidence.

What a Material Weakness Looks Like

• No review of the financial close, so errors go undetected.
• One person able to create vendors and approve payments.
• No reconciliation of key accounts.
• No control over changes in the accounting system.

Preparing for IFC Reporting

1. Identify significant accounts and the processes behind them.
2. Document the risks and controls in each process.
3. Test that controls actually work, and fix those that don't.
4. Review IT controls — access, changes and backups.
5. Repeat the testing each year.

Getting Help

Think Filing documents and tests internal financial controls, and helps companies prepare for the auditor's IFC report.