Internal Financial Controls (IFC) Review

What are internal financial controls?

Internal financial controls (IFC) are the policies and procedures a company uses to make sure its business runs in an orderly way, its assets are safeguarded, fraud and errors are prevented and detected, its records are accurate and complete, and its financial information is reliable and timely.

The Companies Act, 2013 makes directors responsible for them, and requires the statutory auditor of many companies to report on whether the company has adequate IFC over financial reporting and whether they operated effectively. An IFC review documents, tests, and strengthens those controls.

The key terms

A few terms describe how IFC works:

IFC over financial reporting

Controls that make sure the financial statements are reliable. This is what the statutory auditor reports on.

Auditor's IFC report

Under Section 143(3)(i), the auditor reports on the adequacy and operating effectiveness of IFC over financial reporting.

Private company exemption

Auditors needn't report on IFC for private companies with turnover below ₹50 crore or borrowings below ₹25 crore, and for OPCs and small companies.

Directors' responsibility

Directors of listed companies state in their report that they've laid down adequate IFC that are operating effectively.

Risk and control matrix

A document listing each significant risk in a process and the control that addresses it.

Design and operating effectiveness

Whether a control is designed to address the risk, and whether it actually worked throughout the period.

Material weakness

A deficiency serious enough that a material misstatement might not be prevented or detected. It leads to an adverse IFC opinion.

Why it matters

Strong controls protect the company and support the audit:

Auditor reporting

Once the exemption no longer applies, the auditor reports on IFC every year. Weak controls lead to a modified opinion.

Directors' responsibility

Directors are responsible for IFC, and for listed companies state so in their report.

Fraud prevention

Controls like approvals, segregation of duties, and reconciliations are the main defence against fraud.

Reliable numbers

Good controls mean fewer errors in the accounts and a faster close.

Investor and lender comfort

An adverse IFC opinion is a red flag in due diligence.

Scaling

Controls that worked informally in a small team break down as the company grows.

Audit efficiency

When controls can be relied on, the auditor can do less detailed testing.

Who is this for?

Our IFC review is separate from the statutory audit. The statutory auditor still forms its own opinion; our work helps the company be ready for it.

IFC review vs. internal audit vs. statutory audit

Three related but different activities:

What we'll need from you

Process owners

Access to the people who run each key process.

Policies and approvals

Existing policies, delegation of authority, and approval matrices.

System access

Read access to the accounting system and user access lists.

Previous audit reports

Earlier statutory and internal audit observations.

Financial statements

The latest accounts, to identify significant accounts and processes.

Sample documents

Documents for testing, like purchase orders, invoices, and approvals.

Fees depend on the number of processes and locations and whether the work is first-time documentation or annual testing.

How an IFC review works

A first-time IFC exercise usually runs like this:

1. 1

   Scope

   Significant accounts and the processes behind them are identified from the financial statements.

2. 2

   Document

   Each process is walked through and documented, with risks and controls captured in risk and control matrices.

3. 3

   Assess design

   Each control is assessed for whether it actually addresses its risk.

4. 4

   Test effectiveness

   Controls are tested on samples to see whether they worked throughout the period.

5. 5

   Remediate

   Gaps are fixed, with new or strengthened controls, and retested.

6. 6

   Report

   The board receives a summary of the controls, test results, and any remaining deficiencies.

Keeping controls effective

IFC isn't a one-time exercise:

Annual testing

Retest key controls every year, since the auditor's opinion covers each year.

Update for changes

Update documentation when processes, systems, or people change.

IT controls

Review user access, changes to systems, and backups, which underpin many financial controls.

Segregation of duties

Make sure no one person can initiate, approve, and record the same transaction.

Training

Make sure process owners understand the controls they operate.

Board oversight

Report control status to the board or audit committee periodically.

Benefits and responsibilities