Internal Control Reviews & IFC Evaluation

Internal controls, in the general sense, is a broad term covering any policy or procedure a business uses to manage risk — operational, compliance, financial, or strategic. Internal Financial Controls (IFC), as used under the Companies Act 2013, is a narrower, statutorily defined concept focused specifically on controls over financial reporting — the policies and procedures that ensure the orderly and efficient conduct of business, adherence to policies, safeguarding of assets, prevention and detection of fraud and error, accuracy and completeness of accounting records, and timely preparation of reliable financial information, as defined in the Explanation to Section 134(5)(e). The ICAI Guidance Note maps IFC evaluation to the COSO framework's five components.

The statutory auditor's obligation to report on IFC over financial reporting under Section 143(3)(i) applies broadly, but the Companies (Audit and Auditors) Rules, 2014 carve out a specific exemption from this clause for certain categories — including One Person Companies, small companies, and private companies meeting prescribed thresholds on turnover and borrowings. Whether your company is within or outside this exemption depends on your specific financials for the year and should be confirmed with your statutory auditor for the applicable financial year, since the exemption thresholds and criteria are prescribed by rule and can be amended.

The Companies (Auditor's Report) Order, 2020 (CARO 2020) is a separate reporting requirement issued under Section 143(11) that requires statutory auditors of specified classes of companies to comment on a defined list of matters in their audit report — including, among many other clauses, whether the company has an internal audit system commensurate with the size and nature of its business. CARO 2020's internal audit commentary and Section 143(3)(i)'s IFC opinion are related but distinct reporting obligations — a company can have adequate IFC over financial reporting while still needing to strengthen its internal audit function, or vice versa.

COSO (Committee of Sponsoring Organizations of the Treadway Commission) is an internationally recognised internal control framework built around five integrated components: Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring Activities. The ICAI's Guidance Note on Audit of Internal Financial Controls Over Financial Reporting explicitly references COSO (or an equivalent recognised framework) as the basis against which management should evaluate and auditors should assess IFC. Using a recognised framework, rather than an ad hoc checklist, ensures the evaluation is defensible, comprehensive, and directly usable by your statutory auditor.

These are graded severity classifications used under the ICAI Guidance Note (aligned with Standard on Auditing SA 265 concepts). A deficiency exists when a control is designed, implemented, or operated in a way that does not allow management or employees to prevent or detect misstatements on a timely basis, or when a necessary control is missing. A significant deficiency is a deficiency, or combination of deficiencies, important enough to merit attention by those charged with governance (typically the Audit Committee). A material weakness is a deficiency, or combination of deficiencies, that creates a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis — the most severe classification, and one that can affect the statutory auditor's own IFC opinion.

For a first-time evaluation of a mid-sized company with a handful of significant processes and one or two locations, PNPC typically scopes 8–10 weeks end to end — scoping, entity-level assessment, process walkthroughs, control matrix documentation, design and operating effectiveness testing, deficiency reporting, and remediation planning. Larger, multi-location, or multi-entity groups take longer, scoped based on the number of significant processes and locations in coverage. Subsequent-year reviews, once the control matrix already exists, are typically faster — around 5–6 weeks — since testing can focus on process changes and prior-year remediation follow-up rather than rebuilding documentation from scratch.

The fee depends directly on scope — the number of significant processes covered, the number of locations or business units, the complexity of the ERP/IT environment, and whether it is a first-time evaluation (requiring full documentation build) or a subsequent-year refresh (updating an existing control matrix). PNPC provides a written, fixed-fee proposal after an initial scoping conversation, so there is no ambiguity about what is covered before the engagement begins.

The engagement is typically commissioned by management (often the CFO) or directly by the Audit Committee, as a management or governance initiative — distinct from the statutory audit itself, which is commissioned by shareholders through the auditor appointment process. Some companies with an in-house internal audit function have that function perform the review; others engage an external firm like PNPC either because they lack an internal audit function of sufficient scale, or because they want an independent, external perspective distinct from both internal audit and the statutory auditor.

Independence requirements under the Companies Act and the ICAI Code of Ethics restrict a statutory auditor from performing certain non-audit services for the same client, and specific restrictions apply depending on the nature and scale of the engagement and the class of company involved. Where PNPC is the statutory auditor for a company, we assess independence requirements carefully before accepting any related internal control review engagement, and in situations where independence rules restrict us from performing both roles for the same entity, we will say so directly rather than take on a conflicted engagement.

A Risk and Control Matrix is the core working document of an IFC evaluation — for each significant process, it lists the specific financial reporting risk, the control activity designed to address that risk, whether the control is preventive or detective, whether it is manual, automated, or IT-dependent manual, the control owner, the frequency of operation, and the testing evidence gathered. The RCM is the document your statutory auditor will most directly rely on when performing their own IFC testing, and it becomes the baseline that subsequent-year reviews update rather than rebuild.

A walkthrough is a step-by-step trace of an actual transaction from initiation through recording in the financial statements, performed by observing the process and interviewing the people who actually perform it — not by reading the documented SOP. Walkthroughs consistently surface gaps between documented procedure and actual practice: a manual says a purchase order requires two approvals, but in practice a shared login means one person effectively approves both stages; a reconciliation is supposed to happen weekly but is actually done once a quarter under time pressure. These gaps are invisible if the review relies only on the written policy.

IT General Controls are the controls over the IT environment that support the reliable operation of application-level (automated) controls — covering areas like user access management, segregation of duties within the ERP system, change management for system modifications, backup and disaster recovery, and physical/logical security. Where a company's financial processes rely on automated or IT-dependent manual controls (which is the case for nearly every company using an ERP or accounting system), a proper IFC evaluation must assess the underlying ITGC — because an automated control is only as reliable as the IT environment supporting it.

The core deliverable is the RCM, the deficiency log with severity ratings, and the remediation roadmap — presented to management and, where relevant, the Audit Committee or Board. Beyond that, PNPC offers remediation support as a separately scoped follow-on engagement: designing the specific fix for a control gap (a revised approval workflow, a new reconciliation template, a system configuration change), assisting implementation, and retesting the control once implemented to confirm the deficiency is closed.

No — testing every transaction in every process would be neither practical nor necessary. PNPC applies risk-based sampling consistent with the approach described in the ICAI Guidance Note: sample sizes are calibrated to the frequency of the control (a control operating hundreds of times a month needs a larger sample than one operating monthly), the risk associated with the underlying transaction class, and whether the control is manual (requiring a larger sample to establish consistency) or automated (where testing the system configuration once, plus a smaller sample of transactions, is generally sufficient once the control is confirmed to be functioning as configured).

Yes — this is one of the most common and highest-value triggers for engaging PNPC. SEBI's disclosure and governance expectations for listed companies, combined with heightened Audit Committee, merchant banker, and investor scrutiny during the IPO process, mean that control gaps discovered during IPO readiness diligence are far more costly to fix under time pressure than gaps identified and remediated over one or two review cycles well in advance. Starting 18–24 months ahead allows deficiencies to be remediated and retested before they become a diligence finding.

An internal control review evaluates whether controls that are reasonably designed to prevent or detect fraud and error are in place and operating — for example, segregation of duties, authorisation limits, and reconciliation controls. It is a forward-looking, process-level evaluation, not an investigation into a specific suspected event. If a review or a whistleblower report raises a specific red flag — an unexplained variance, a suspicious vendor relationship, a pattern inconsistent with normal business activity — that warrants a separately scoped forensic review, which follows a different methodology (evidence preservation, targeted investigation techniques, and often legal coordination) distinct from a control-design evaluation.

Segregation of duties is the principle that no single individual should control all key stages of a transaction — initiation, approval, custody of the related asset, and recording in the books. When one person controls multiple stages, the natural cross-check that catches both error and fraud disappears. In smaller and mid-sized Indian companies, segregation of duties gaps are extremely common, particularly in finance teams that have not scaled headcount at the same pace as transaction volume — the same person who creates a vendor in the ERP also approves payments to that vendor, for example.

Yes, though the scope and depth of testing will differ. Smaller accounting systems generally have fewer built-in, system-enforced controls than a large ERP (like SAP or Oracle), which means more of the control burden sits on manual review, approval workflows outside the system, and reconciliation discipline. The evaluation approach adapts accordingly — more emphasis on manual control testing and process discipline, proportionately less on system configuration testing — but the underlying COSO framework and the need for a documented RCM apply regardless of which accounting platform you use.

A management letter (sometimes called a report to those charged with governance) is the formal written communication of findings from the internal control review — typically addressed to the CFO or management team, with a summary version presented to the Audit Committee or Board. It documents the scope of the review, the significant deficiencies and material weaknesses identified, management's response to each finding, and the agreed remediation timeline. This is distinct from, though often coordinated with, any management letter your statutory auditor separately issues as part of the audit.

Where a company already has an in-house or co-sourced internal audit function operating under Section 138, that function typically performs ongoing, cyclical assurance across operational and compliance areas as well as financial controls. An IFC evaluation can either be performed by that internal audit function directly (if it has the requisite expertise in the COSO/IFC methodology) or by an independent external party like PNPC, whose findings then feed into or complement the internal audit's broader risk-based plan. We coordinate scope explicitly with any existing internal audit function to avoid duplicated testing and ensure clear ownership of each control area.

Section 138 of the Companies Act 2013, read with the Companies (Accounts) Rules 2014, prescribes specific thresholds — based on criteria such as paid-up share capital, turnover, outstanding loans/borrowings, and outstanding deposits — above which every listed company and certain classes of unlisted public companies and private companies are required to appoint an internal auditor. Whether your company currently meets or is approaching these thresholds should be checked against the current Rules for your specific financial figures, since the applicable thresholds are prescribed by rule and should be verified for the relevant year rather than assumed.

Yes, and many do — most commonly ahead of a fundraise, a bank credit facility renewal, or simply as a governance discipline exercise once the founders recognise the business has scaled past the point where informal, trust-based controls are adequate. A voluntary review can be scoped more lightly than a full statutory-grade IFC evaluation if there is no auditor reliance requirement — for example, focused only on the two or three highest-risk processes rather than the full COSO-mapped scope.

Recurring patterns across first-time reviews include: absence of a formal, board-approved delegation of authority matrix (approvals happening on an informal, unwritten basis); inadequate segregation of duties in the procure-to-pay and payroll cycles; bank reconciliations performed inconsistently or with significant unreconciled items outstanding for extended periods; manual journal entries posted without a documented review and approval trail; and IT user access rights that have not been reviewed since the ERP was first configured, often still granting former employees or over-privileged current employees access well beyond their role.

As part of the risk assessment component of the COSO framework, we do consider fraud risk factors — incentive/pressure, opportunity, and rationalisation, the three elements of the classic fraud triangle — particularly when assessing entity-level controls like the whistleblower mechanism, the tone at the top, and management override risk. This is a risk-assessment lens applied within the control review, not a full forensic fraud risk assessment, which is typically a more detailed, separately scoped exercise if a company wants a dedicated fraud risk assessment rather than a general control review.

Management override refers to the risk that a person in a position of authority — typically someone senior enough to bypass a control that would stop others — deliberately circumvents an otherwise well-designed control, for example approving a transaction outside normal authorisation limits or instructing an accounting entry that does not reflect the underlying transaction. Standards on Auditing and the COSO framework treat this as a distinct, elevated risk category precisely because a control that relies on the same person it is meant to constrain provides no real protection. We specifically assess whether compensating controls — such as Audit Committee oversight of related-party transactions or a whistleblower channel independent of management — exist to address this risk.

No. The internal control review is a private engagement between PNPC and the company (or, where scoped that way, the Audit Committee). Findings are not filed with MCA, SEBI, or any regulator, and are not made public. The exception is your own statutory auditor, with whom we share findings only with management's consent, specifically to support their independent IFC opinion under Section 143(3)(i) — the auditor's own report (which may reference IFC adequacy) is what becomes part of the public financial statements filed with MCA, not PNPC's underlying working papers.

For multi-location or multi-entity groups, we scope coverage based on materiality and risk — typically prioritising locations or subsidiaries that represent the largest share of consolidated revenue or assets, or that carry elevated risk factors (a newly acquired entity, a location with a recent history of control issues, or one with a thinner finance team). Entity-level controls are assessed at the parent/group level as well as locally, since group-wide policies (delegation of authority, whistleblower mechanism, code of conduct) need to be consistently cascaded and actually followed at each location, not merely exist on paper at head office.

A preventive control is designed to stop an error or irregularity from occurring in the first place — for example, a system-enforced credit limit that blocks an order exceeding a customer's approved credit. A detective control identifies an error or irregularity after it has occurred — for example, a monthly reconciliation that surfaces a discrepancy. Both are legitimate and necessary; a well-designed control environment uses a mix, since preventive controls alone are rarely sufficient (they can be bypassed or may not cover every scenario) and relying solely on detective controls means errors are caught late, after they may already have caused financial or operational impact.

Control awareness and process-owner training is not a default inclusion in the base IFC evaluation scope, but it is a common and valuable add-on, particularly after significant remediation — helping the process owners who will actually operate a newly redesigned control understand not just the mechanics but the underlying risk it addresses, which improves consistency of operation over time. We can scope this as part of the remediation phase if management wants it.

The underlying methodology — COSO framework, RCM documentation, design and operating effectiveness testing, severity-graded findings — follows the same recognised professional standards regardless of firm size, since these are set by ICAI guidance and Standards on Auditing, not by firm brand. Where PNPC differentiates is in continuity and accessibility: the same senior CA team that performs your review is available for the remediation conversation afterward, for your statutory audit coordination, and for the following year's refresh — rather than a large engagement team that rotates and requires re-briefing each cycle. We also scope fees proportionate to genuine mid-market company needs, without the overhead structure of a large multinational firm.

This can happen, since professional judgement is inherently involved in severity classification, and the statutory auditor is required to form their own independent opinion regardless of PNPC's assessment. Where this arises, we proactively engage with the auditor to walk through our testing evidence and rationale — often the disagreement resolves once the underlying evidence and context are compared, and where it does not fully resolve, the auditor's opinion is the one that governs the statutory audit report, since that is their independent statutory responsibility, not PNPC's.

A documented, independently reviewed control environment can support a stronger credit conversation, since lenders assessing larger facilities increasingly factor in governance and control maturity as part of qualitative credit risk assessment, alongside the financial ratios. It is not a guaranteed mechanism for better pricing or terms — that ultimately depends on the lender's own credit policy and your overall financial profile — but a company that can produce a clean RCM and a track record of proactive remediation presents a materially stronger governance picture than one that cannot.

Section 143(3)(i) IFC reporting and the COSO-based methodology described here apply specifically to Indian company law requirements for the Indian entity. For the UAE parent or affiliate entities, control review would follow UAE regulatory and governance expectations rather than the Companies Act 2013 framework — these are distinct regulatory regimes and should not be conflated. With operating offices in Chennai, Bangalore, Hyderabad, and Dubai, PNPC can coordinate a control review across both the Indian subsidiary (under the IFC/COSO methodology described here) and UAE group entities (scoped to UAE-specific requirements) under a single coordinated engagement, so group management gets one consistent view rather than two disconnected reports from separate advisors.

For companies within the Section 143(3)(i) reporting scope, an annual refresh aligned to the statutory audit cycle is the practical minimum, since the auditor forms a fresh IFC opinion every year and needs current-year evidence, not an evaluation from several years prior. Companies undergoing significant change — a new ERP implementation, a major acquisition, rapid headcount growth, or entry into a new business line — should consider a more frequent, targeted refresh of the specific affected processes rather than waiting for the next annual cycle, since these events are exactly when control gaps are most likely to be introduced.

An Audit Committee is only mandatory under the Companies Act for specified classes of listed and larger public companies; the majority of private companies PNPC works with do not have one and are not required to. For those companies, findings and the remediation roadmap are presented directly to the Board or to the promoter-management team, structured with the same rigour and severity grading as a formal Audit Committee presentation, simply addressed to whichever governance body actually exists and makes decisions in your company.

A Control Self-Assessment is a technique where process owners themselves evaluate and document the effectiveness of the controls they operate, typically using a structured questionnaire, before or alongside an independent review. PNPC sometimes uses a light CSA exercise as an efficient way to gather initial process information and surface areas the process owner themselves already recognises as weak — but a CSA on its own is not a substitute for independent walkthrough and testing, since self-assessed control effectiveness tends to be more favourable than what independent testing subsequently confirms, a well-documented bias in practice.