A Practical Guide to Internal Financial Controls (IFC) Review
Internal Financial Controls (IFC) are not a compliance checkbox — they are the operating discipline that keeps your financial statements honest, your fraud risk low, and your auditor's report clean. Under the Companies Act 2013, your Board must certify that adequate IFC exist and operate effectively, and your statutory auditor must independently report on that same control environment. At PNPC Global, we have supported Boards and audit committees across India and the UAE since 1986 — designing control frameworks that actually work on the shop floor and in the ERP, not just on paper, and standing behind the auditor's opinion that follows.
What This Actually Covers
Internal Financial Controls, as defined in Section 134(5)(e) read with the Explanation to Section 134 of the Companies Act 2013, are the policies and procedures adopted by a company to ensure orderly and efficient conduct of its business, including adherence to company policies, safeguarding of assets, prevention and detection of frauds and errors, accuracy and completeness of accounting records, and timely preparation of reliable financial information. In practice, an IFC Review is a structured engagement — usually built on the globally recognised COSO 2013 Internal Control – Integrated Framework — that documents your company's key financial processes (revenue, procurement, payroll, treasury, fixed assets, financial close), identifies the controls embedded in each process, tests whether those controls are designed adequately (design effectiveness) and are actually being followed (operating effectiveness), and reports gaps with a remediation roadmap.
The review sits at the intersection of two distinct but related statutory requirements.
For the full scope, current process and what PNPC includes, see the dedicated Internal Financial Controls (IFC) Review service page.
Signs This Applies to You
- Your company is a listed entity, or a subsidiary/associate of one, where Section 143(3)(i) auditor reporting on internal financial controls (alongside related CARO 2020 clause 3(xi) fraud/whistle-blower reporting and clause 3(xiv) internal audit system reporting) is mandatory for the statutory auditor
- Revenue, borrowings, or paid-up capital have crossed the thresholds that remove the small/private company exemption from mandatory auditor IFC reporting under the Companies (Audit and Auditors) Rules
- You are preparing for a Series A/B funding round or PE investment and investors' due diligence teams will scrutinise the control environment around revenue recognition, related-party transactions, and cash controls
- Your statutory auditor has flagged control deficiencies in a prior year's management letter and you want them remediated before the next audit cycle, not discovered again
When It Isn't the Right Fit
- Very early-stage startups with a handful of transactions a month, no external investors, and no near-term funding plan — a lighter internal control checklist embedded in the accounting engagement is more proportionate than a formal COSO-based review
- One Person Companies, small companies, and private companies meeting the Companies (Audit and Auditors) Rules exemption criteria for auditor IFC reporting, with no investor or lender requirement for control assurance — the statutory obligation simply does not attach
- Businesses where the immediate priority is a books-and-records clean-up or a first-time statutory audit — in these cases, a basic accounting system review and audit readiness engagement should precede a formal IFC exercise
Questions We're Actually Asked
What exactly are Internal Financial Controls (IFC) under the Companies Act 2013?
IFC are defined in the Explanation to Section 134(5)(e) as the policies and procedures adopted by a company to ensure orderly and efficient conduct of its business, adherence to company policies, safeguarding of assets, prevention and detection of frauds and errors, accuracy and completeness of accounting records, and timely preparation of reliable financial information. In simpler terms: the system of approvals, reconciliations, segregation of duties, and checks that stand between an ordinary business transaction and a misstated financial statement.
Is an IFC Review legally mandatory for my company?
It depends on your company's category. Under Section 143(3)(i) of the Companies Act 2013 read with the Companies (Audit and Auditors) Rules 2014, the statutory auditor's requirement to report on IFC operating effectiveness carries an exemption for certain smaller/private companies meeting prescribed turnover, borrowing, and paid-up capital thresholds. If your company does not meet the exemption, your statutory auditor must report on IFC — and a proactive IFC Review by an independent team ahead of the audit substantially de-risks that opinion. Listed companies and their subsidiaries do not get this exemption and must additionally satisfy Section 134(5)(e) Board certification and SEBI LODR CEO/CFO certification requirements.
What is the difference between IFC and Internal Financial Controls over Financial Reporting (IFCoFR)?
IFC under Section 134(5)(e) is broadly defined and covers the full range of policies and procedures described above — including operational efficiency and asset safeguarding, not just financial reporting accuracy. IFCoFR — the term used in ICAI's Guidance Note that auditors apply under Section 143(3)(i) — is more narrowly scoped to controls that provide reasonable assurance regarding the reliability of financial reporting specifically. In practice, most engagements (including a PNPC IFC Review) are scoped around IFCoFR because that is what the statutory auditor's opinion actually addresses, while flagging any broader operational control gap observed along the way.
Getting This Right From the Start
Speak directly with a PNPC Chartered Accountant before your next audit cycle begins. Not a generic risk-consulting deck — a practising CA firm that has stood behind Board certifications and auditor opinions across India and the UAE since 1986, and that stays engaged long after the report is delivered.
PNPC Global has advised Chennai, Bangalore and Hyderabad businesses since 1986. Explore the full Audit & Assurance practice for related services, or go straight to the Internal Financial Controls (IFC) Review page for specifics.
Rates, thresholds and filing dates are set by the relevant authority and revised periodically. Treat anything numeric here as "ask PNPC for the current figure," not as a quoted fact.