Internal Financial Controls (IFC) Review: Who Needs It and Who Does Not
Two different questions sit under "do we need an IFC review". The first is whether your statutory auditor has to report on internal financial controls: for most companies the answer is yes, with an exemption for certain private companies. The second is whether you want independent assurance on your controls anyway, which is a governance choice that lenders, investors and a Board ahead of the year-end audit often make even when the auditor's IFC reporting is switched off. Listed companies have no such choice, because the Board must state in its responsibility statement that controls are adequate and operating effectively, and the CEO and CFO give a separate certification. The sections below cover who is caught, who can safely skip a full review, and how to decide. The full scope of the service is on the Internal Financial Controls (IFC) Review page.
Is an IFC Review legally mandatory for my company?
There is no law that says "commission an IFC review". What the law requires is that the statutory auditor report on internal financial controls under Section 143(3)(i) of the Companies Act 2013, and that the Board of a listed company state under Section 134(5)(e) that it has laid down adequate controls that are operating effectively; separately, Rule 8(5)(viii) of the Companies (Accounts) Rules requires the Board's report of companies other than One Person Companies and small companies (which file the shortened report under Rule 8A) to comment on the adequacy of internal financial controls. The auditor's reporting duty is switched off for certain private companies by the Ministry of Corporate Affairs notification G.S.R. 583(E) of 13 June 2017: a One Person Company or small company, and a private company whose turnover and aggregate borrowings are both below the notified limits (as clarified by the MCA corrigendum of 13 July 2017), provided it has not defaulted in filing its financial statements or annual return. The limits are set in monetary terms; confirm the current notification before relying on the exemption. If your company is not exempt, your auditor must report on IFC, and a proactive IFC Review by an independent team ahead of the audit substantially de-risks that opinion. Public companies get no benefit from the exemption, and listed companies must also satisfy the SEBI LODR CEO/CFO certification requirement.
In practice: The exemption thresholds are specific and change periodically through MCA notifications — we check your company's current applicability at the scoping stage rather than relying on a prior year's assessment, since a company can cross a threshold and lose the exemption without anyone noticing until the auditor raises it.
What framework do you use to conduct the review — is COSO mandatory?
ICAI's Guidance Note on Audit of Internal Financial Controls Over Financial Reporting recommends the COSO 2013 Internal Control – Integrated Framework as a suitable framework, and it is the framework most Indian companies and auditors use in practice, given its widespread international recognition. It is not the only permissible framework, but using an unfamiliar or internally developed framework creates friction when the statutory auditor evaluates your control documentation. PNPC builds every IFC engagement on the five COSO components: Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring Activities.
In practice: Some companies inherit a different framework from a foreign parent (SOX-aligned COSO variants are common for US-listed parent groups). We adapt our documentation to be consistent with whatever framework the parent or the statutory auditor expects, rather than forcing a mismatch.
What are IT General Controls (ITGC) and why are they part of an IFC Review?
ITGC are controls over the IT environment that support the reliable operation of application-level (financial) controls — primarily access management (who can create, approve, and post transactions in the ERP), change management (how changes to system configuration, approval workflows, and reports are authorised and tested), and backup/recovery (ensuring financial data integrity and availability). If ITGC are weak — for example, a user has both data-entry and approval rights in the ERP — then an application control that looks well-designed on paper (a two-step approval workflow) is not actually effective in practice, because the segregation it depends on can be bypassed.
In practice: ITGC is the area most often under-scoped in cheaper IFC reviews because it requires IT knowledge alongside accounting knowledge. We review ERP access listings directly rather than relying on management's description of who has what access — the two frequently do not match.
Our finance team is small — 4 people handling everything. Can we still have adequate IFC?
Yes, though the approach differs from a large finance function. Where headcount genuinely constrains full segregation of duties, the review focuses on identifying compensating controls — for example, independent Board or owner-level review of bank statements and large payments, mandatory dual authorisation for payments above a threshold even without full functional segregation, and periodic surprise reconciliation reviews by someone outside the day-to-day processing team. Adequate does not mean elaborate; it means proportionate to your risk and genuinely operating, not merely documented.
In practice: We explicitly flag compensating controls as such in the report, distinguishing them from ideal-state segregation of duties — this transparency helps the Board and auditor understand the actual risk profile rather than assume a false level of assurance.
What is a Whistle Blower Policy and is it part of the IFC scope?
A Vigil Mechanism / Whistle Blower Policy is mandatory under Section 177(9) of the Companies Act for listed companies and companies that accept deposits or have borrowed money from banks and public financial institutions above prescribed thresholds, and separately required under SEBI LODR for listed companies. While it is a governance mechanism rather than a financial reporting control in the narrow sense, we assess whether it is functioning — is it genuinely accessible to employees, are complaints logged and investigated, does the Audit Committee receive reports — because it is a key fraud detection control that intersects directly with financial reporting integrity.
In practice: We frequently find a Whistle Blower Policy exists as a document on the company website but has no evidence of any complaint log, escalation trail, or Audit Committee reporting — which functionally means the control does not operate even though it is formally in place.
We are a subsidiary of a foreign (UAE / Singapore / US) parent. Does the parent's control framework apply to us?
Often, yes, in substance if not in exact statutory form. Many multinational parent groups — particularly those with a US-listed parent subject to Sarbanes-Oxley (SOX) — expect Indian subsidiaries to operate under a group-wide control framework consistent with the parent's requirements, even where the Indian entity itself would be exempt from Section 143(3)(i) reporting on a standalone basis. PNPC scopes the review to satisfy both the Indian statutory requirement (where applicable) and the parent group's control framework expectations, avoiding duplicate documentation for two different frameworks.
In practice: We frequently see Indian subsidiaries of foreign parents receive a group-standard control template that does not map to Indian-specific statutory requirements (Companies Act provisions, GST, TDS controls). We reconcile the two rather than running parallel, disconnected exercises.
How often should an IFC Review be repeated — every year, or periodically?
For companies where auditor IFC reporting under Section 143(3)(i) is mandatory, we recommend annual refresh testing at minimum — even if the RCM itself does not need to be rebuilt from scratch, the operating effectiveness testing should be performed each year since a control that operated effectively last year is not automatically assumed to operate effectively this year. A full re-walkthrough and RCM rebuild is generally warranted every 2–3 years, or immediately upon a significant process change, ERP migration, business restructuring, or new business line launch.
In practice: ERP migrations are the single most common trigger for a full IFC re-review outside the normal cycle — a new system means new access configurations, new approval workflows, and often new control gaps that did not exist under the legacy system.
What is the ICAI Guidance Note on Audit of IFCoFR and does it apply to a management-commissioned review too?
The Guidance Note on Audit of Internal Financial Controls Over Financial Reporting, issued by ICAI, is written primarily to guide statutory auditors in forming their Section 143(3)(i) opinion. It is not a mandatory framework for a management-commissioned IFC Review in the same binding sense, but it is the most authoritative and widely accepted reference point in India for what "adequate" and "operating effectively" mean in this context — so PNPC aligns its review methodology to the Guidance Note's principles, ensuring our findings and terminology speak the same language the statutory auditor will use.
In practice: Using consistent terminology and severity classification with the Guidance Note is what allows a management-commissioned review to be genuinely useful input to the statutory audit, rather than a parallel exercise using different language that the auditor has to re-translate.
Deciding whether to commission a review
Three questions settle most cases. Is your auditor required to report on IFC this year, using the exemption test above applied to the latest audited figures? Is anyone outside the company (a lender, an incoming investor, a foreign parent, a tender authority) asking for assurance on controls? And is the finance function stable enough for a review to produce lasting documentation? If the answer to the first two is no, the statutory obligation does not attach and a full review is optional, so a short controls checklist attached to the routine accounting work will usually do. If the third answer is no, for example because the ledgers are still being cleaned up or the ERP is mid-migration, fix that first and schedule the review afterwards. A company that has just crossed the exemption limits, or has had a fraud or a serious accounting error, is the opposite case and should not wait.
The mechanics of a review are covered in the IFC review process, start to finish: scoping, entity-level controls, walkthroughs, a risk and control matrix, design and operating tests, IT general controls and a graded findings report.
What does the auditor's IFC conclusion mean for lenders and investors?
An unmodified conclusion under Section 143(3)(i) says that, in all material respects, the company has an adequate system and the controls were operating effectively at the balance sheet date. A modified one appears prominently in the audit report and is visible to anyone reading the filed financial statements. It does not by itself mean the financial statements are misstated. What lenders and investors typically look for next is a credible, time-bound remediation plan already under way; that is a commercial expectation and not a legal requirement, but a finding that arrives with no plan is a harder conversation than one that arrives with a plan.
Three exemption tests, three different answers
A company can pass one applicability test and fail another. The IFC reporting exemption is decided under the June 2017 notification described above. CARO 2020 has no clause on IFC adequacy, and its own applicability exemptions are separate, so a company can be exempt from CARO and still be reportable on IFC, or the other way round. Internal audit under Section 138 is a third test with its own class-based thresholds and belongs to a different engagement; see who needs internal audit. For the statutory audit around all three, read who needs a statutory audit.
Mistakes in deciding, not in testing
- Carrying last year's answer forward. The exemption is tested on the latest audited figures, so growth can end it without anyone noticing.
- Reading "exempt" as "no controls needed". The auditor's reporting duty may fall away, but the Board's duty to comment on internal financial controls in its report remains for companies outside Rule 8A.
- Adopting a parent's control template as the Indian answer. A group template rarely maps onto Companies Act, GST and TDS controls; use it as input, not as a substitute.
- Asking the statutory audit team to run the review. Independence questions arise when the same team reviews its own upcoming audit work, so settle who does what at the proposal stage.
Where this sits in the wider engagement
Internal Financial Controls (IFC) Review rarely arrives on its own. The statutory basis and the current requirements are set out on the Internal Financial Controls (IFC) Review service page, and the related services are grouped under Audit Assurance. For the step-by-step version and the evidence you will need, see the IFC review process, documents and evidence and a practical guide to IFC review.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Internal Financial Controls (IFC) Review we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.