Internal Financial Controls explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
The directors assert that controls were adequate and effective. This provision makes the auditor test the assertion.
The requirement
As per Section 143(3)(i) of the CA, 2013 the auditor is required to state the adequacy of internal financial control systems and its operating effectiveness. Also, the auditors are required to report on Internal Financial Control with reference to financial statements.
It has two limbs, and they are different tests. Adequacy asks whether the controls, as designed, would prevent or detect misstatement. Operating effectiveness asks whether they actually worked during the period.
A control can be perfectly designed and never performed. A reconciliation prescribed monthly and done twice in the year is adequate in design and ineffective in operation, and the auditor must report on both.
It closes a loop with the directors' responsibility statement. Section 134(5) requires the directors to state that internal financial controls were laid down and were adequate and operating effectively. Without section 143(3)(i), that would be an unverified assertion in the Board's report. With it, the auditor independently states a view on the same question.
Note the qualification with reference to financial statements. The reporting is confined to controls bearing on financial reporting — it is not an opinion on operational controls generally, on efficiency, or on compliance controls unrelated to the accounts.
The exemption is drawn to spare companies where the cost would exceed the benefit: a private company that is a start-up or a One Person Company, or has turnover less than rupees fifty crores per the latest audited financial statement, or aggregate borrowings from banks or financial institutions or body corporate at any point of time during the financial year less than rupees twenty five crores.
Two points on the exemption. It is available only to a private company — no public company escapes, whatever its size. And the borrowing test is measured at any point of time during the financial year, so a company that borrowed heavily mid-year and repaid before the balance sheet date is outside the exemption.
The exemption
| Condition | Detail |
|---|---|
| Company type | Must be a private company |
| Start-up or OPC | Exempt |
| Turnover | Less than INR 50 crore per the latest audited financial statement |
| Aggregate borrowings | Less than INR 25 crore from banks, financial institutions or any body corporate, at any point of time during the financial year |
Note that the borrowing test here reaches any body corporate, not only banks and public financial institutions as in some other thresholds. Inter-corporate borrowings count.
How it sits with the other reporting layers
- Management designs and operates the controls.
- Internal audit, where applicable, tests adherence during the year.
- The audit committee receives internal audit findings and must satisfy itself on internal controls and the relevant risks.
- The directors assert adequacy and effectiveness in the responsibility statement under section 134(5).
- The statutory auditor states a view under section 143(3)(i).
Each layer tests the one below it, and the auditor's statement is the only one made by a person outside the company.
Common mistakes
- Reading adequacy and operating effectiveness as a single test.
- Applying the internal financial controls exemption to a public company.
- Testing the borrowing threshold at the year end rather than at any point during the year.
- Excluding inter-corporate borrowings from the aggregate.
Key Facts About Internal Financial Controls
- Applies in: All states across India, under the relevant central law.
- Mode: Mostly online via the official government portal.
- Typical timeline: Ranges from a few days to a few weeks depending on the case.
- Non-compliance: May attract penalties, interest or late fees.
- Expert help: TaxClue completes the entire process end to end for you.
What must the auditor state?
Under section 143(3)(i), the auditor is required to state the adequacy of internal financial control systems and their operating effectiveness, and to report on internal financial controls with reference to financial statements.
Which companies are exempt?
Section 143(3)(i) does not apply to a private company which is a start-up company or a One Person Company, or which has turnover of less than rupees fifty crores as per the latest audited financial statement, or which has aggregate borrowings from banks, financial institutions or any body corporate at any point of time during the financial year of less than rupees twenty five crores.
Over 90% of compliance penalties in India arise from missed due dates — timely handling can save businesses thousands of rupees each year.
Internal Financial Controls: a key compliance topic in Indian tax and corporate law that businesses and individuals must understand to remain compliant.