Internal Financial Controls (IFC) Audit & ICFR Testing
Section 143(3)(i) of the Companies Act, 2013 asks your statutory auditor whether the company has adequate internal financial controls over financial reporting, and whether they work. We document your controls, test them through the year and fix the gaps before the auditor signs.
What it is
Internal financial controls are the everyday checks that make your numbers trustworthy. Think of them as house rules for money. Who approves a purchase order, who releases a payment, how stock is counted: each is a control. An internal financial controls audit (IFC audit) asks two questions. Is each key control designed properly? And did it actually operate through the year?
The Explanation to Section 134(5)(e) of the Companies Act, 2013 defines them as the policies and procedures for the orderly and efficient conduct of the business, including safeguarding assets, preventing and detecting frauds and errors, and timely, reliable financial information. The auditor reports only on controls over financial reporting (ICFR), following the ICAI Guidance Note issued in September 2015.
Who it applies to
Listed and unlisted public companies
Every public company’s auditor reports on internal financial controls under Section 143(3)(i), whatever the company’s size.
Larger private companies
Above the 2017 exemption limits in the table below, the same report applies.
Boards and audit committees
Listed company directors confirm the controls work (Section 134(5)(e)); audit committees evaluate them (Section 177(4)(vii)).
Does your company need IFC reporting?
| Type of company | Auditor reports on IFC under Section 143(3)(i)? |
|---|---|
| Listed company | Yes. Directors also give the Section 134(5)(e) statement. |
| Unlisted public company | Yes, whatever its size. |
| Private company that is an OPC or a small company | No, provided it has not defaulted in filing financial statements (Section 137) or annual returns (Section 92). |
| Private company with turnover below ₹50 crore, or aggregate borrowings below ₹25 crore at all times in the year | No, on the same filing condition. |
| Private company above both limits, or one in default of its annual filings | Yes. |
These exemptions come from the MCA notification of 13 June 2017 (G.S.R. 583(E)). Turnover comes from the latest audited accounts; borrowings include loans from banks, financial institutions and any body corporate. Since 1 December 2025 a small company can have paid-up capital up to ₹10 crore and turnover up to ₹100 crore, so many more private companies are now outside IFC reporting. Here is the catch: a holding or subsidiary company cannot be a small company. Picture a Faridabad auto-parts maker, a subsidiary of the family’s holding company, with turnover above ₹50 crore. Its exemption now rests on borrowings staying below ₹25 crore all year. One large term loan, and the IFC report is back.
Why it matters
Keep your audit report clean
A strong internal financial controls audit keeps your audit report clean. Weak controls lead to a qualified or adverse IFC opinion, and lenders read that paragraph.
Catch frauds and errors early
Maker-checker approval and monthly reconciliations catch duplicate payments and fake vendors long before the year-end audit. If the same clerk can create a vendor and release its payment, you have no control at all.
Close your books faster
With a documented owner and checklist for every process, closing takes days, not weeks, especially with books kept up to date every month.
Documents required
Policies and structure
- Organisation chart and delegation of authority
- Accounting, purchase, sales and HR policies
- Software users and their access rights
Process records
- Purchase orders, GRNs and payment approvals
- Sales orders, credit limits and dispatch records
- Bank, GST and stock reconciliations
- Fixed asset register and verification reports
Prior findings
- Last year’s audit report
- Reports from your internal audit
- Management letters and any CARO remarks
How it works
Scope the significant accounts
We pick the accounts and processes that are material to your financial statements.
Build the risk and control matrix
For each process we record what can go wrong, the control that stops it, who performs it and how often. This matrix becomes your standing IFC file.
Walk through the design
We trace one transaction end to end to confirm each control exists and can catch the risk.
Test operating effectiveness
We test samples from across the year and record every exception. In practice, that means pulling payment vouchers from every quarter and checking each carries the second approval your policy demands.
Report gaps and help fix them
You get a ranked list of deficiencies, each with a fix and an owner. We retest after remediation, before the year closes.
Timelines
Start in the first half of the year
A control tested only in March proves little. Finish documentation and design tests by September to leave time for fixes before 31 March.
Test again before year-end
A last-quarter round confirms the fixes work.
Report with the audited accounts
The IFC report is an annexure to the audit report, signed with the accounts and filed in AOC-4 within 30 days of the AGM, as part of your annual ROC filings.
What happens if controls fail
Your auditor modifies the IFC opinion
With a material weakness at year-end, the auditor cannot call controls effective. The qualified or adverse opinion is visible to anyone who downloads your filings.
The company faces a Section 134(8) penalty
If the board’s report does not comply with Section 134, the company is liable to a penalty of ₹3 lakh and every officer in default to ₹50,000.
The auditor may have to report fraud
Section 143(12) requires the auditor to report certain frauds to the Central Government, and CARO 2020 clause 3(xi) asks about frauds noticed during the year.
Frequently asked questions
Is an IFC audit mandatory for a private limited company?
Only for larger private companies. Under the MCA notification of 13 June 2017, a private company needs no IFC report if it is an OPC or small company, has turnover below ₹50 crore, or kept borrowings below ₹25 crore all year, provided it has not defaulted in filing its financial statements or annual return. If you fit any exempt category and your filings are current, the report is not required.
What is the difference between IFC and ICFR?
IFC is the wider term; ICFR is the part the auditor reports on. Section 134(5)(e) defines internal financial controls to cover orderly conduct of the business, safeguarding of assets and fraud prevention as well as accounting. The Section 143(3)(i) report covers only controls with reference to financial statements, called ICFR. We document both.
Can our statutory auditor also set up our controls?
No, not for the same company. Section 144 bars the statutory auditor from providing internal audit, design of a financial information system, accounting and management services to the company it audits. So documentation and testing for management should come from a different firm. Your auditor then runs its own independent IFC audit, using that documentation to plan its work.
What is a material weakness?
A material weakness is a deficiency, or a mix of deficiencies, serious enough that a material misstatement in the financial statements may not be prevented or caught in time. One unapproved payment is usually just a deficiency. No review of journal entries all year could be a material weakness. Spotted early, most can be fixed before year-end.
How long does IFC documentation take?
The time depends mostly on how many processes, locations and systems you run, and on how much is already written down. A single-site company with tidy records finishes first-year documentation and design testing sooner than a multi-site group. Later years are quicker, because the matrix only needs updating for changes. Starting in the first half of the year leaves room for testing and fixes.
Which processes are usually covered?
IFC work usually covers sales to receipts, purchase to payment, payroll, inventory, fixed assets, treasury and financial closing. IT general controls, such as user access in your accounting software, run across all of them. We choose the list from the accounts that are material to your financial statements, so a small trading company gets a shorter list than a manufacturer.
Does an audit committee have to review internal controls?
Yes. Under Section 177(4)(vii), the audit committee must evaluate internal financial controls and risk management systems. Listed companies must have one, and so must public companies with paid-up capital of ₹10 crore or more, turnover of ₹100 crore or more, or loans, debentures and deposits of ₹50 crore or more. Our test reports are written to be placed before it.
Are small companies still asked about internal controls?
Yes, in a lighter way. Even without the Section 143(3)(i) report, CARO 2020 asks the auditor of a covered company about its internal audit system and its records of fixed assets and inventory. Small companies and OPCs are outside CARO altogether. Basic controls still protect your money, so a simple approval matrix and monthly reconciliations are worth having at any size.
What it costs
Our fee plus the government fee that applies to your case, quoted before you commit. Tell us the situation and we will price it exactly.
IFC documentation and testing carry no government fee.
Ready to begin?
Send your last audit report. Our internal financial controls audit shows you the gaps before your auditor does.