Section 143(3)(i) of the Companies Act, 2013 (“the Act”) requires the auditor to report on whether the company has adequate internal financial controls with reference to the financial statements and whether those controls are operating effectively. The IFC reporting is a separate opinion, and it is included in the audit report.
The Scope of IFC
The internal financial controls are the policies and procedures that the company has designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with the applicable accounting standards. The controls include the control environment, the risk assessment process, the control activities, the information and communication systems, and the monitoring activities.
The auditor must evaluate the design and the operating effectiveness of the controls. The evaluation is based on the auditor's understanding of the company's processes, and it involves testing the controls where the auditor intends to rely on them.
The Framework
The auditor may use the COSO framework or any other recognised framework to evaluate the IFC. The framework must be appropriate to the company's size and complexity, and the auditor must document the evaluation.
The Exemptions
The IFC reporting requirement applies to every company, but the auditor's reporting on the operating effectiveness of the controls is not required for a small company or a one person company. The exemption is based on the size of the company, and it is intended to reduce the compliance burden on smaller entities.
The Material Weakness
Where the auditor identifies a material weakness in the IFC, the auditor must report it. A material weakness is a deficiency, or a combination of deficiencies, in the IFC such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis. The board must address the material weakness and disclose the remedial steps in the board's report.
A company that does not have adequate IFC, or whose controls are not operating effectively, is exposed to the risk of financial misstatement and to the auditor's adverse report. The IFC is not a compliance formality; it is the foundation of reliable financial reporting.
Call to Action
Anuj Desai & Associates advises companies and audit committees on the IFC framework—from the design of the controls and the documentation to the auditor's evaluation and the remediation of a material weakness. If your company's IFC is under scrutiny, we can help you strengthen the controls and respond to the auditor.
📧 office@anujdesaiassociates.com
📞 9619456656
🌐 https://anujdesaiassociates.com
🔗 linkedin.com/in/ca-anuj-desai-122547230
Article 161