Internal Financial Controls (IFC) Review

IFC are defined in the Explanation to Section 134(5)(e) as the policies and procedures adopted by a company to ensure orderly and efficient conduct of its business, adherence to company policies, safeguarding of assets, prevention and detection of frauds and errors, accuracy and completeness of accounting records, and timely preparation of reliable financial information. In simpler terms: the system of approvals, reconciliations, segregation of duties, and checks that stand between an ordinary business transaction and a misstated financial statement.

It depends on your company's category. Under Section 143(3)(i) of the Companies Act 2013 read with the Companies (Audit and Auditors) Rules 2014, the statutory auditor's requirement to report on IFC operating effectiveness carries an exemption for certain smaller/private companies meeting prescribed turnover, borrowing, and paid-up capital thresholds. If your company does not meet the exemption, your statutory auditor must report on IFC — and a proactive IFC Review by an independent team ahead of the audit substantially de-risks that opinion. Listed companies and their subsidiaries do not get this exemption and must additionally satisfy Section 134(5)(e) Board certification and SEBI LODR CEO/CFO certification requirements.

IFC under Section 134(5)(e) is broadly defined and covers the full range of policies and procedures described above — including operational efficiency and asset safeguarding, not just financial reporting accuracy. IFCoFR — the term used in ICAI's Guidance Note that auditors apply under Section 143(3)(i) — is more narrowly scoped to controls that provide reasonable assurance regarding the reliability of financial reporting specifically. In practice, most engagements (including a PNPC IFC Review) are scoped around IFCoFR because that is what the statutory auditor's opinion actually addresses, while flagging any broader operational control gap observed along the way.

ICAI's Guidance Note on Audit of Internal Financial Controls Over Financial Reporting recommends the COSO 2013 Internal Control – Integrated Framework as a suitable framework, and it is the framework most Indian companies and auditors use in practice, given its widespread international recognition. It is not the only permissible framework, but using an unfamiliar or internally developed framework creates friction when the statutory auditor evaluates your control documentation. PNPC builds every IFC engagement on the five COSO components: Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring Activities.

Section 138 mandates an internal audit function for listed companies and for public companies and certain private companies meeting prescribed turnover, borrowing, or paid-up capital thresholds. Internal audit is a broader, ongoing function covering operational efficiency, risk management, and governance across the entire business — not just financial reporting controls — and typically reports to the Audit Committee on a quarterly or half-yearly cycle. An IFC Review is narrower and more focused: a point-in-time (or periodic) assessment of the design and operating effectiveness of controls specifically over financial reporting, usually timed to support the year-end statutory audit. Many companies that have an internal audit function still commission a distinct, more technically focused IFC Review — sometimes performed by the same firm, sometimes by a different one for independence reasons.

This depends on the nature and extent of the work and applicable independence requirements under the Standards on Auditing and the ICAI Code of Ethics. Where PNPC is the statutory auditor, IFC testing performed as part of the audit itself is standard auditor work under Section 143(3)(i) — that is simply part of the audit. Where a company wants a separate, proactive, pre-audit IFC Review distinct from the audit engagement, we generally recommend this be performed by a team independent of the statutory audit engagement team, or in some cases by a different PNPC office/team with appropriate safeguards, to preserve independence and to give the Board a genuinely separate line of assurance rather than the auditor reviewing their own upcoming audit work.

These are severity classifications used in IFC reporting, aligned to how auditors classify findings. A Control Deficiency exists when a control is designed, implemented, or operated in a way that does not allow timely prevention or detection of a misstatement — the mildest category. A Significant Deficiency is a deficiency, or combination of deficiencies, that is less severe than a material weakness but important enough to merit the attention of those responsible for financial reporting oversight (typically the Audit Committee). A Material Weakness is a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis — the most severe category, and one that a statutory auditor is required to specifically report.

Under Section 143(3)(i), if the auditor identifies that IFC are not adequate or not operating effectively, this is reported in the audit report itself and typically elaborated in the Annexure on Internal Financial Controls. A material weakness reported by the auditor is a serious governance signal — it can affect lender covenants, investor confidence, and in the case of listed companies, may need specific disclosure to the stock exchanges and the Audit Committee under SEBI LODR requirements. It does not automatically mean the auditor gives an adverse opinion on the financial statements themselves (that is a separate assessment), but it is a red flag that the Board is expected to act on with a documented remediation plan.

If your statutory auditor is not required to report on IFC under Section 143(3)(i) because you meet the exemption criteria, there is no strict legal mandate for a formal IFC Review. That said, many such companies commission a lighter-touch review anyway — particularly ahead of a funding round, where investor due diligence teams routinely assess control maturity around revenue recognition, cash handling, and related-party transactions regardless of statutory exemption status, or ahead of crossing the exemption thresholds as the business scales, so the control framework is already in place rather than built under time pressure.

For a mid-sized company with 4–6 significant financial processes and a single location, a first-time review — from scoping through final report and Board presentation — typically takes 8–10 weeks. Multi-location or multi-subsidiary groups take longer, as walkthroughs and testing must be repeated (or appropriately sampled) across each significant location. Subsequent-year reviews, building on an existing Risk Control Matrix, are meaningfully faster because the documentation baseline already exists and only needs updating for process or system changes.

Fees depend on the number of significant processes in scope, the number of locations/subsidiaries, the maturity of existing documentation (a company with no SOPs costs more to review than one with well-maintained process documentation), and whether ITGC review is included. PNPC provides a fixed, written scope and fee proposal after an initial scoping conversation — we do not price blind. As a general principle, the cost of a proactive IFC Review is consistently lower than the combined cost of an extended year-end audit (caused by the auditor discovering control gaps for the first time) plus the professional and reputational cost of a qualified audit opinion or CARO adverse remark.

The Companies (Auditor's Report) Order, 2020 (CARO 2020) requires statutory auditors of specified companies to comment on a detailed list of 21 matters in their audit report under clauses 3(i) to 3(xxi) — covering fixed assets, inventory, loans, deposits, statutory dues, and more. The auditor's opinion on whether the company has an adequate internal financial controls system that is operating effectively is reported separately, under Section 143(3)(i) of the Companies Act itself — CARO 2020 does not contain a dedicated IFC-adequacy clause. What CARO 2020 does contain, and what is closely linked to IFC, is clause 3(xi) (whether any fraud has been noticed or reported during the year, including fraud enabled by control weaknesses, plus whistle-blower complaints) and clause 3(xiv) (whether the company has an internal audit system commensurate with its size and nature of business). Findings from an IFC Review commonly inform the auditor's position on all of these — the Section 143(3)(i) opinion and the related CARO clauses.

Regulation 17(8) of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 requires the CEO and CFO of a listed company to certify to the Board, among other matters, that they have evaluated the effectiveness of internal control systems and disclosed to the Auditors and the Audit Committee any deficiencies in the design or operation of internal controls, along with steps taken to rectify these deficiencies. An IFC Review gives the CEO and CFO the substantive testing evidence needed to make this certification with genuine confidence rather than as a formality.

Sample-based testing, consistent with professional auditing and internal control testing conventions. Sample sizes are determined by the frequency of the control — a control that operates daily (like a bank reconciliation review) requires a larger sample than one that operates annually (like a year-end impairment assessment). We document the sample-sizing rationale so that if your statutory auditor wants to place reliance on our work, they can assess the sufficiency of our testing methodology against their own standards.

ITGC are controls over the IT environment that support the reliable operation of application-level (financial) controls — primarily access management (who can create, approve, and post transactions in the ERP), change management (how changes to system configuration, approval workflows, and reports are authorised and tested), and backup/recovery (ensuring financial data integrity and availability). If ITGC are weak — for example, a user has both data-entry and approval rights in the ERP — then an application control that looks well-designed on paper (a two-step approval workflow) is not actually effective in practice, because the segregation it depends on can be bypassed.

Yes, though the approach differs from a large finance function. Where headcount genuinely constrains full segregation of duties, the review focuses on identifying compensating controls — for example, independent Board or owner-level review of bank statements and large payments, mandatory dual authorisation for payments above a threshold even without full functional segregation, and periodic surprise reconciliation reviews by someone outside the day-to-day processing team. Adequate does not mean elaborate; it means proportionate to your risk and genuinely operating, not merely documented.

The COSO framework and testing methodology are the same, but the significant processes and highest-risk areas differ substantially. Manufacturing entities typically carry higher inherent risk in inventory valuation, fixed asset capitalisation, and procure-to-pay given physical goods movement. Services and SaaS businesses typically carry higher inherent risk in revenue recognition (particularly around multi-element arrangements, subscription revenue recognition under Ind AS 115, and deferred revenue), accounts receivable, and — increasingly — data security controls that intersect with financial reporting (customer billing data integrity). PNPC scopes the RCM to your actual business model rather than applying a generic manufacturing-oriented template to a software company, or vice versa.

Ind AS 115 (Revenue from Contracts with Customers) is the accounting standard governing when and how much revenue a company recognises, based on a five-step model tied to the transfer of control of goods or services to the customer. For companies with complex arrangements — subscription pricing, bundled products and services, milestone-based contracts, variable consideration — the judgement involved in applying Ind AS 115 creates specific control risk: are contracts reviewed consistently for the correct recognition pattern, and is that judgement documented and approved rather than applied inconsistently by whoever processes the invoice that month?

Fraud risk is an explicit part of the scope. IFC, by definition under Section 134(5)(e), includes controls for the prevention and detection of frauds and errors. Our review specifically considers fraud risk factors — opportunity (weak segregation, unmonitored access), pressure (aggressive targets, cash flow stress), and rationalisation risk indicators — alongside standard error-prevention controls, and we test controls specifically designed to detect fraud (unusual journal entry review, vendor master data change monitoring, whistle-blower mechanism functioning) as a distinct thread within the broader review.

A Vigil Mechanism / Whistle Blower Policy is mandatory under Section 177(9) of the Companies Act for listed companies and companies that accept deposits or have borrowed money from banks and public financial institutions above prescribed thresholds, and separately required under SEBI LODR for listed companies. While it is a governance mechanism rather than a financial reporting control in the narrow sense, we assess whether it is functioning — is it genuinely accessible to employees, are complaints logged and investigated, does the Audit Committee receive reports — because it is a key fraud detection control that intersects directly with financial reporting integrity.

Related-party transactions carry elevated fraud and misstatement risk precisely because normal arm's-length commercial controls (competitive procurement, independent price benchmarking) may not naturally apply. We review whether related-party transactions are identified and flagged before execution (not just at year-end for disclosure purposes), whether they receive the Audit Committee and/or Board approval required under Section 188 of the Companies Act, and whether pricing is benchmarked and documented as being on an arm's-length basis where required.

A hybrid approach works well for most engagements — process walkthrough interviews and document review can be conducted remotely via video call and secure document sharing, but certain elements benefit from on-site presence: observing physical controls (cash handling, inventory verification, access card/biometric controls at the registered office or warehouse), and building direct rapport with process owners during walkthroughs. For clients with operations across Chennai, Bangalore, Hyderabad, and Dubai, PNPC coordinates across our offices so on-site elements are handled locally without requiring travel from a single central team.

A complete IFC engagement delivers: the Risk Control Matrix (RCM) mapping key controls to financial statement assertions and risks; a walkthrough documentation set for each significant process; the testing evidence and results for both design and operating effectiveness; a classified gap/findings report (material weakness, significant deficiency, control deficiency); a prioritised remediation roadmap with named owners and target dates; an ITGC review summary; and a Board/Audit Committee presentation deck summarising the overall assessment and the basis for the Section 134(5)(e) certification.

If PNPC is not your statutory auditor, there is no independence constraint — we can perform the IFC Review as an independent advisory engagement and share our work product with your statutory auditor for their consideration under the applicable Standards on Auditing (which govern how and to what extent an auditor may rely on the work of others). If PNPC is your statutory auditor, IFC testing performed as part of the audit itself is standard practice; a separately branded, additional advisory-style IFC review by the same engagement team raises independence and self-review considerations we assess and structure around case by case, consistent with the ICAI Code of Ethics.

If testing uncovers evidence suggestive of actual fraud (as opposed to a control weakness that merely creates the opportunity for fraud), our engagement protocol requires immediate escalation to the Audit Committee Chair or the Board, generally before the standard review report is finalised, given the statutory reporting obligations that may be triggered (including the auditor's own fraud-reporting duties under Section 143(12) of the Companies Act if a statutory auditor is separately involved). We do not sit on a live fraud indicator until the scheduled report date.

Often, yes, in substance if not in exact statutory form. Many multinational parent groups — particularly those with a US-listed parent subject to Sarbanes-Oxley (SOX) — expect Indian subsidiaries to operate under a group-wide control framework consistent with the parent's requirements, even where the Indian entity itself would be exempt from Section 143(3)(i) reporting on a standalone basis. PNPC scopes the review to satisfy both the Indian statutory requirement (where applicable) and the parent group's control framework expectations, avoiding duplicate documentation for two different frameworks.

For companies where auditor IFC reporting under Section 143(3)(i) is mandatory, we recommend annual refresh testing at minimum — even if the RCM itself does not need to be rebuilt from scratch, the operating effectiveness testing should be performed each year since a control that operated effectively last year is not automatically assumed to operate effectively this year. A full re-walkthrough and RCM rebuild is generally warranted every 2–3 years, or immediately upon a significant process change, ERP migration, business restructuring, or new business line launch.

The Guidance Note on Audit of Internal Financial Controls Over Financial Reporting, issued by ICAI, is written primarily to guide statutory auditors in forming their Section 143(3)(i) opinion. It is not a mandatory framework for a management-commissioned IFC Review in the same binding sense, but it is the most authoritative and widely accepted reference point in India for what "adequate" and "operating effectively" mean in this context — so PNPC aligns its review methodology to the Guidance Note's principles, ensuring our findings and terminology speak the same language the statutory auditor will use.

Yes, materially. The Companies Act 2013 IFC framework described throughout is an India-specific statutory requirement. UAE entities are governed by the UAE Commercial Companies Law and, for listed/regulated entities, by the relevant UAE securities or free-zone authority requirements, which do not carry an identical IFC reporting mandate structured around Section 134(5)(e)/143(3)(i). That said, UAE Corporate Tax compliance, VAT controls, and increasingly ESR (Economic Substance Regulations) documentation create their own control-discipline expectations. PNPC's Dubai office scopes UAE engagements against the correct UAE regulatory framework rather than importing Indian Companies Act requirements where they do not apply.

A prior clean opinion reflects the control environment as it existed and was tested at that time — it is not a permanent certification. New employees, system changes, new product lines, new related-party arrangements, and evolving fraud schemes all change the risk profile year to year. Auditors and Audit Committees expect operating effectiveness to be re-demonstrated each year, not assumed to continue automatically. A lighter refresh review (rather than a full ground-up rebuild) is usually appropriate where the business has been stable, but skipping the year entirely leaves the Board's certification unsupported for that year.

A clean (unmodified) opinion under Section 143(3)(i) states that the company has, in all material respects, an adequate internal financial controls system and that such controls were operating effectively as at the balance sheet date. A qualified opinion means the auditor identified one or more material weaknesses and could not conclude that controls were adequate and effective — this is disclosed prominently in the audit report and is visible to lenders, investors, and regulators reviewing the filed financial statements. It does not automatically mean the financial statements themselves are misstated, but it signals elevated risk that requires explanation to stakeholders.

Yes, always. Every PNPC IFC Review begins with a scoping discussion followed by a written engagement letter setting out the processes and locations in scope, the framework applied, the testing approach, deliverables, timeline, and fee — agreed and signed before any fieldwork begins. We do not commence testing on an undefined or open-ended scope.

A pure risk advisory firm can document a COSO-aligned RCM competently, but often lacks the depth of Indian statutory context — Companies Act nuances, CARO applicability tests, TDS and GST control interlinkages, Ind AS interpretation — that a practising CA firm brings as a matter of course. PNPC has been practising Indian company and tax law since 1986, with offices across Chennai, Bangalore, Hyderabad, and Dubai. We build the IFC Review to genuinely serve your statutory auditor's reliance decision and your Board's certification needs — not as a generic risk-consulting deliverable disconnected from the actual regulatory framework your company operates under.