The Statutory Certification
Section 134(5)(e) requires the directors’ responsibility statement to state that internal financial controls have been laid down and that such controls are adequate and operating effectively. The certification is signed by the board and is a personal statement of the directors, not a delegation to the auditor. A board that signs the statement without an IFC testing record is certifying without evidence.
The IFC Framework
The IFC framework should cover: the control environment; risk assessment; control activities; information and communication; and monitoring. The company should maintain a risk-control matrix that maps each significant financial-reporting risk to the control that mitigates it, the control owner, the testing frequency, and the test result. A matrix that lists controls without testing evidence is a design document, not an operating-effectiveness record.
The Audit Committee’s Oversight
The audit committee should receive the IFC testing report, the management’s remediation plan, and the status of open deficiencies. The committee should review whether the deficiencies are significant or material, and whether the remediation timeline is adequate. The committee’s minutes should record the specific deficiencies discussed and the agreed remediation dates.
The Statutory Auditor’s Reporting
For companies where the auditor is required to report on IFC, the auditor’s report must state whether the company has adequate IFC with reference to the financial statements. The auditor’s testing is not a substitute for the board’s certification. A board that relies solely on the auditor’s IFC report without its own testing record is not discharging the Section 134(5) responsibility.
The CEO/CFO Certification
For listed entities, the CEO and CFO must certify the IFC effectiveness. The certification should be supported by the IFC testing report and the management’s representation letter. A certification that is not backed by a testing record is a false certification risk.
Documentation for the Board
The board should receive: the IFC framework document; the risk-control matrix; the testing report; the remediation tracker; the audit committee’s recommendation; and the auditor’s IFC report. The board’s discussion should be minuted, including the specific deficiencies and the board’s direction on remediation.
Call to Action: For IFC framework design, testing documentation, or directors’ responsibility statement support, contact office@anujdesaiassociates.com or 9619456656. Website: https://anujdesaiassociates.com. LinkedIn: linkedin.com/in/ca-anuj-desai-122547230.