Internal Financial Controls (IFC) Review: Documents and Evidence
Most delay on Internal Financial Controls (IFC) Review comes down to paperwork that was not ready, so it is worth knowing what will be asked for. The questions below are the ones raised most often in practice; the full scope of the service is on the Internal Financial Controls (IFC) Review page.
Do you test 100% of transactions or a sample?
Sample-based testing, consistent with professional auditing and internal control testing conventions. Sample sizes are determined by the frequency of the control — a control that operates daily (like a bank reconciliation review) requires a larger sample than one that operates annually (like a year-end impairment assessment). We document the sample-sizing rationale so that if your statutory auditor wants to place reliance on our work, they can assess the sufficiency of our testing methodology against their own standards.
In practice: A common shortcut some providers take is testing only 2–3 instances of every control regardless of frequency, which does not meet the sample-size expectations a statutory auditor will apply when deciding whether to rely on the work — meaning the client effectively pays twice.
Can the IFC Review be conducted remotely, or does someone need to be on-site?
A hybrid approach works well for most engagements — process walkthrough interviews and document review can be conducted remotely via video call and secure document sharing, but certain elements benefit from on-site presence: observing physical controls (cash handling, inventory verification, access card/biometric controls at the registered office or warehouse), and building direct rapport with process owners during walkthroughs. For clients with operations across Chennai, Bangalore, Hyderabad, and Dubai, PNPC coordinates across our offices so on-site elements are handled locally without requiring travel from a single central team.
In practice: For UAE clients with an India subsidiary or vice versa, we coordinate the two-jurisdiction review under one engagement — our Dubai and India teams share findings and methodology so the group-level report is consistent rather than two disconnected assessments.
What deliverables do we actually receive at the end of the engagement?
A complete IFC engagement delivers: the Risk Control Matrix (RCM) mapping key controls to financial statement assertions and risks; a walkthrough documentation set for each significant process; the testing evidence and results for both design and operating effectiveness; a classified gap/findings report (material weakness, significant deficiency, control deficiency); a prioritised remediation roadmap with named owners and target dates; an ITGC review summary; and a Board/Audit Committee presentation deck summarising the overall assessment and the basis for the Section 134(5)(e) certification.
In practice: We hand over the RCM as an editable, living document — not a static PDF — so your finance team can maintain and update it as processes evolve, rather than starting from zero at the next annual review.
What if the review finds a serious issue — like evidence of actual fraud, not just a control gap?
If testing uncovers evidence suggestive of actual fraud (as opposed to a control weakness that merely creates the opportunity for fraud), our engagement protocol requires immediate escalation to the Audit Committee Chair or the Board, generally before the standard review report is finalised, given the statutory reporting obligations that may be triggered (including the auditor's own fraud-reporting duties under Section 143(12) of the Companies Act if a statutory auditor is separately involved). We do not sit on a live fraud indicator until the scheduled report date.
In practice: Evidence of intentional wrongdoing is distinct from a genuine control design or operating gap; the escalation protocol exists and is communicated to the client at the start of every engagement so there is no ambiguity about our obligations.
Why should we engage PNPC rather than a generic risk advisory firm for this review?
A pure risk advisory firm can document a COSO-aligned RCM competently, but often lacks the depth of Indian statutory context — Companies Act nuances, CARO applicability tests, TDS and GST control interlinkages, Ind AS interpretation — that a practising CA firm brings as a matter of course. PNPC has been practising Indian company and tax law since 1986, with offices across Chennai, Bangalore, Hyderabad, and Dubai. We build the IFC Review to genuinely serve your statutory auditor's reliance decision and your Board's certification needs — not as a generic risk-consulting deliverable disconnected from the actual regulatory framework your company operates under.
In practice: We are frequently asked to review IFC documentation prepared by a prior generic consultant that reads well but does not map cleanly to Indian statutory assertions or the specific CARO/Section 143(3)(i) language the statutory auditor needs — requiring rework that costs more than getting it right the first time.
Where this sits in the wider engagement
Internal Financial Controls (IFC) Review rarely arrives on its own. The statutory basis and the current requirements are set out on the Internal Financial Controls (IFC) Review service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Internal Financial Controls (IFC) Review we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.