Internal Financial Controls explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
The directors assert that controls were adequate and effective. This provision makes the auditor test the assertion.
The requirement
As per Section 143(3)(i) of the CA, 2013 the auditor is required to state the adequacy of internal financial control systems and its operating effectiveness. Also, the auditors are required to report on Internal Financial Control with reference to financial statements.
It has two limbs, and they are different tests. Adequacy asks whether the controls, as designed, would prevent or detect misstatement. Operating effectiveness asks whether they actually worked during the period.
A control can be perfectly designed and never performed. A reconciliation prescribed monthly and done twice in the year is adequate in design and ineffective in operation, and the auditor must report on both.
It closes a loop with the directors' responsibility statement. Section 134(5) requires the directors to state that internal financial controls were laid down and were adequate and operating effectively. Without section 143(3)(i), that would be an unverified assertion in the Board's report. With it, the auditor independently states a view on the same question.
Note the qualification with reference to financial statements. The reporting is confined to controls bearing on financial reporting — it is not an opinion on operational controls generally, on efficiency, or on compliance controls unrelated to the accounts.
The exemption is drawn to spare companies where the cost would exceed the benefit: a private company that is a start-up or a One Person Company, or has turnover less than rupees fifty crores per the latest audited financial statement, or aggregate borrowings from banks or financial institutions or body corporate at any point of time during the financial year less than rupees twenty five crores.
Two points on the exemption. It is available only to a private company — no public company escapes, whatever its size. And the borrowing test is measured at any point of time during the financial year, so a company that borrowed heavily mid-year and repaid before the balance sheet date is outside the exemption.
The exemption
| Condition | Detail |
|---|---|
| Company type | Must be a private company |
| Start-up or OPC | Exempt |
| Turnover | Less than INR 50 crore per the latest audited financial statement |
| Aggregate borrowings | Less than INR 25 crore from banks, financial institutions or any body corporate, at any point of time during the financial year |
Note that the borrowing test here reaches any body corporate, not only banks and public financial institutions as in some other thresholds. Inter-corporate borrowings count.
How it sits with the other reporting layers
- Management designs and operates the controls.
- Internal audit, where applicable, tests adherence during the year.
- The audit committee receives internal audit findings and must satisfy itself on internal controls and the relevant risks.
- The directors assert adequacy and effectiveness in the responsibility statement under section 134(5).
- The statutory auditor states a view under section 143(3)(i).
Each layer tests the one below it, and the auditor's statement is the only one made by a person outside the company.
Common mistakes
- Reading adequacy and operating effectiveness as a single test.
- Applying the internal financial controls exemption to a public company.
- Testing the borrowing threshold at the year end rather than at any point during the year.
- Excluding inter-corporate borrowings from the aggregate.