Internal Financial Controls (IFC) Review: The Process, Start to Finish

Internal Financial Controls (IFC) Review: The Process, Start to Finish

An internal financial controls review checks whether the controls behind your financial statements are well designed and are actually being followed, grades any gaps by severity, and ends with a dated plan to fix them and a report to the Audit Committee or Board. It usually runs in this order: scope the review, assess entity-level controls, walk through each significant process, build a Risk Control Matrix, test design and operation, review IT general controls, grade the findings, then remediate and re-test. For the review to be useful it has to finish before the statutory audit begins, because a report that lands during audit fieldwork documents problems with no time left to fix them.

The questions below are the ones raised most often in practice; the full scope of the service is on the Internal Financial Controls (IFC) Review page.

The IFC review, step by step

• Scoping and materiality. Agree the framework (usually COSO 2013), the review period, the significant processes and locations, and the report format the statutory auditor will want. Scope around what could misstate the financial statements, not a generic list of forty processes.
• Entity-level controls. Assess the control environment, risk assessment, information flow and monitoring first. A process-level matrix built on a weak foundation gives false comfort.
• Process walkthroughs. Walk revenue, procure-to-pay, payroll, treasury, fixed assets and financial close end to end with the person who runs each. The aim is to find the gap between the written procedure and what happens, such as an approval sent by email instead of recorded in the ERP workflow.
• Risk Control Matrix. Map each financial statement assertion to a specific control, against your own chart of accounts and ERP workflow, not a template.
• Design and operating tests. First ask whether the control, as designed, could prevent or detect the risk; an approval limit set so high it never triggers a second signature fails on design however faithfully it is followed. Then test a documented, representative sample through the period, with sample size tied to how often the control runs.
• IT general controls. Review user access, change management and backup and recovery, because a good approval matrix means nothing if the ERP lets a junior user bypass it.
• Grading the gaps. Classify each finding as a control deficiency, significant deficiency or material weakness, and record why.
• Draft report and remediation plan. Discuss each finding with its process owner before finalising, then set named owners, target dates and interim compensating controls for anything that cannot be fixed before year-end.
• Audit Committee presentation and auditor coordination. Present the findings as the evidence behind the Board's statement on internal financial controls, share the matrix and testing evidence with the statutory auditor where the Standards on Auditing permit, and re-test remediated controls near year-end.

What to have ready

• The finance and operations organisation chart and the delegation of authority or approval-limit policy, often the most revealing single document about how formal the control environment is.
• Board and Audit Committee minutes for the period, and the previous year's audit report, CARO report and management letter.
• Written procedures for the main processes where they exist, the chart of accounts, and an overview of ERP modules, approval workflows and user roles.
• The current ERP user access list, joiner and leaver records, the system change log and the backup policy.
• The journal entry approval policy, the related-party register with approvals, and the fixed asset register with physical verification records.

Common mistakes and how to avoid them

• Using a template matrix. It misses the controls unique to your business and gives the Board false assurance. Build it from walkthroughs.
• Testing two or three instances and calling it done. Thin samples produce a clean report the auditor cannot rely on, so they re-perform the testing at your cost, closer to year-end.
• Grading findings by gut feel. Over-grading alarms the Board over minor items; under-grading lets a genuine material weakness surface first in the statutory audit.
• Accepting "done" as verified. A remediation marked complete by a process owner is not the same as a fix that is operating. Re-test.
• Treating the review as a one-off. If the matrix is not kept current, next year starts from zero.

Who probably does not need a full review

A full COSO-style review is excessive for a very early-stage business with a handful of transactions a month, no outside investors and no funding plan; a lighter control checklist inside the accounting engagement is more proportionate. It is also the wrong first step where the real priority is cleaning up the books or preparing for a first statutory audit. And where a private company falls within the MCA exemption notification under Section 462 (G.S.R. 583(E), 13 June 2017), for example a one person company or a small company, the auditor's IFC reporting obligation may not attach, although lenders or investors may still ask for control assurance. Confirm the current notification and your own eligibility before relying on it. Check which category you are in before commissioning anything.

What is the difference between IFC and Internal Financial Controls over Financial Reporting (IFCoFR)?

Internal financial controls, as defined in Section 134(5)(e) read with the Explanation to Section 134, cover the policies and procedures that keep the business running in an orderly and efficient way. That includes adherence to company policies, safeguarding of assets, prevention and detection of fraud and error, accuracy and completeness of accounting records and timely preparation of reliable financial information. IFCoFR — the term used in ICAI's Guidance Note that auditors apply under Section 143(3)(i) — is more narrowly scoped to controls that provide reasonable assurance regarding the reliability of financial reporting specifically. In practice, most engagements (including a PNPC IFC Review) are scoped around IFCoFR because that is what the statutory auditor's opinion actually addresses, while flagging any broader operational control gap observed along the way.

In practice: This distinction matters when scoping the engagement — an overly broad IFC review that tries to cover every operational control dilutes focus on the controls the auditor will actually test and report on.

How is an IFC Review different from an internal audit under Section 138?

Section 138 mandates an internal audit function for listed companies and for public companies and certain private companies meeting prescribed turnover, borrowing, or paid-up capital thresholds. Internal audit is a broader, ongoing function covering operational efficiency, risk management, and governance across the entire business — not just financial reporting controls — and typically reports to the Audit Committee on a quarterly or half-yearly cycle. An IFC Review is narrower and more focused: a point-in-time (or periodic) assessment of the design and operating effectiveness of controls specifically over financial reporting, usually timed to support the year-end statutory audit. Many companies that have an internal audit function still commission a distinct, more technically focused IFC Review — sometimes performed by the same firm, sometimes by a different one for independence reasons. See our note on internal audit eligibility for the Section 138 side.

In practice: Where a company already has a competent internal audit function, the IFC Review can build on and extend internal audit's existing process documentation rather than duplicating it from scratch, which reduces cost and disruption to process owners.

What is a Material Weakness versus a Significant Deficiency versus a Control Deficiency?

These are severity classifications used in IFC reporting, aligned to how auditors classify findings. A Control Deficiency exists when a control is designed, implemented, or operated in a way that does not allow timely prevention or detection of a misstatement — the mildest category. A Significant Deficiency is a deficiency, or combination of deficiencies, that is less severe than a material weakness but important enough to merit the attention of those responsible for financial reporting oversight (typically the Audit Committee). A Material Weakness is a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis — the most severe category, and one that a statutory auditor is required to specifically report.

In practice: Classification is not a mechanical exercise — it requires judgement about likelihood and magnitude of potential misstatement. We document the rationale behind every classification so it can withstand scrutiny from the Audit Committee and, if needed, the statutory auditor's own assessment.

How long does a first-time IFC Review take?

It depends on the number of significant financial processes, the number of locations or subsidiaries, and how much process documentation already exists. Multi-location or multi-subsidiary groups take longer, as walkthroughs and testing must be repeated (or appropriately sampled) across each significant location. Subsequent-year reviews, building on an existing Risk Control Matrix, are meaningfully faster because the documentation baseline already exists and only needs updating for process or system changes. We give a timeline after scoping, not before.

In practice: Start the first IFC Review well before your statutory audit fieldwork begins, so there is real time to remediate and re-test findings — rather than compressing everything into audit season, which produces a report that documents problems without time to fix them.

What does an IFC Review typically cost?

Fees depend on the number of significant processes in scope, the number of locations/subsidiaries, the maturity of existing documentation (a company with no SOPs costs more to review than one with well-maintained process documentation), and whether ITGC review is included. PNPC provides a fixed, written scope and fee proposal after an initial scoping conversation — we do not price blind. The reason to review early is to find control gaps while there is time to fix them, instead of having the auditor find them for the first time during year-end audit, where they can lead to an extended audit or a qualified opinion.

In practice: Ask any firm quoting you a fee whether ITGC (IT general controls) review is included — it is a common scope exclusion that surfaces later as a costly add-on once access-control and ERP configuration issues are discovered mid-engagement.

What is CARO 2020 and how does it relate to IFC?

The Companies (Auditor's Report) Order, 2020 (CARO 2020) requires statutory auditors of specified companies to comment on a detailed list of 21 matters in their audit report under clauses 3(i) to 3(xxi) — covering fixed assets, inventory, loans, deposits, statutory dues, and more. The auditor's opinion on whether the company has an adequate internal financial controls system that is operating effectively is reported separately, under Section 143(3)(i) of the Companies Act itself — CARO 2020 does not contain a dedicated IFC-adequacy clause. What CARO 2020 does contain, and what is closely linked to IFC, is clause 3(xi) (whether any fraud has been noticed or reported during the year, including fraud enabled by control weaknesses, plus whistle-blower complaints) and clause 3(xiv) (whether the company has an internal audit system commensurate with its size and nature of business). Findings from an IFC Review commonly inform the auditor's position on all of these — the Section 143(3)(i) opinion and the related CARO clauses.

In practice: CARO applicability itself has its own threshold exemptions distinct from the Section 143(3)(i) IFC exemption. We check both applicability tests separately for every client — a company can be CARO-exempt but still IFC-reportable, or vice versa, depending on how the specific thresholds are met. Those thresholds have been revised in recent years, so confirm the current position with PNPC or the MCA before relying on an older exemption.

What is the CEO/CFO certification under SEBI LODR and how does IFC feed into it?

Regulation 17(8) of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 requires the CEO and CFO of a listed company to certify to the Board, among other matters, that they have evaluated the effectiveness of internal control systems and disclosed to the Auditors and the Audit Committee any deficiencies in the design or operation of internal controls, along with steps taken to rectify these deficiencies. An IFC Review gives the CEO and CFO the substantive testing evidence needed to make this certification with genuine confidence rather than as a formality.

In practice: The risk is signing this certification on informal assurance from department heads, with no underlying testing. That carries real personal exposure if a subsequent control failure or restatement occurs — the certification is a personal representation, not a company-level statement alone.

How does an IFC Review differ across a manufacturing company versus a services/SaaS company?

The COSO framework and testing methodology are the same, but the significant processes and highest-risk areas differ substantially. Manufacturing entities typically carry higher inherent risk in inventory valuation, fixed asset capitalisation, and procure-to-pay given physical goods movement. Services and SaaS businesses typically carry higher inherent risk in revenue recognition (particularly around multi-element arrangements, subscription revenue recognition under Ind AS 115, and deferred revenue), accounts receivable, and — increasingly — data security controls that intersect with financial reporting (customer billing data integrity). PNPC scopes the RCM to your actual business model rather than applying a generic manufacturing-oriented template to a software company, or vice versa.

In practice: An off-the-shelf IFC template can apply full inventory-cycle testing to a pure SaaS business with no physical inventory, wasting review time on a non-existent risk area while under-scoping revenue recognition testing, which is where SaaS companies actually carry the highest control risk.

What is Ind AS 115 and why does it matter for the IFC Review?

Ind AS 115 (Revenue from Contracts with Customers) is the accounting standard governing when and how much revenue a company recognises, based on a five-step model tied to the transfer of control of goods or services to the customer. For companies with complex arrangements — subscription pricing, bundled products and services, milestone-based contracts, variable consideration — the judgement involved in applying Ind AS 115 creates specific control risk: are contracts reviewed consistently for the correct recognition pattern, and is that judgement documented and approved rather than applied inconsistently by whoever processes the invoice that month?

In practice: Revenue recognition under Ind AS 115 is one of the most common areas where we identify design gaps — companies have a policy stating the recognition approach but no control ensuring every contract is actually reviewed against that policy before revenue is booked.

Where this sits in the wider engagement

Internal Financial Controls (IFC) Review rarely arrives on its own. The statutory basis and the current requirements are set out on the Internal Financial Controls (IFC) Review service page, and the related services are grouped under Audit Assurance. To check whether a formal review applies to your company, read who needs an IFC review; the papers to gather are listed in the IFC documents note, and the IFC review guide gives the wider picture. The statutory audit that follows is covered in the Companies Act audit process.

What PNPC does

PNPC Global has practised since 1986 across India and the UAE. On Internal Financial Controls (IFC) Review we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.