Do You Need Internal Control Reviews & IFC Evaluation? A Practical Starting Point
Internal Financial Controls are no longer a checkbox for the audit file — they are a statutory representation your Board and your auditor must make every single year, and a regulator, a lender, or an investor's diligence team can test at any time. At PNPC Global, we have evaluated and documented internal controls for companies across manufacturing, services, trading, and financial businesses since 1986. We do not hand you a generic control matrix downloaded from a template library.
What You're Really Buying
An Internal Control Review is a structured evaluation of the policies, procedures, and control activities that a company has put in place to ensure the reliability of financial reporting, the safeguarding of assets, the prevention and detection of fraud and error, and adherence to laws and management policies. In India, the concept carries specific statutory weight through Internal Financial Controls (IFC) — defined under Section 134(5)(e) of the Companies Act 2013 (for the Board's responsibility statement) and referenced in Section 143(3)(i), which requires the statutory auditor of every company (other than certain exempted small companies, OPCs, and private companies meeting specified thresholds) to report on whether the company has an adequate internal financial controls system in place and whether such controls were operating effectively.
IFC evaluation is broader than a general 'internal controls' review in common usage — the Institute of Chartered Accountants of India's Guidance Note on Audit of Internal Financial Controls Over Financial Reporting frames it around the globally recognised COSO framework (Committee of Sponsoring Organizations of the Treadway Commission), covering five components: Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring Activities.
For the full scope, current process and what PNPC includes, see the dedicated Internal Control Reviews & IFC Evaluation service page.
When You'd Need This
- Your company falls within the scope of Section 143(3)(i) — the statutory auditor is required to report on IFC over financial reporting and you need this evaluated and documented before the audit, not discovered during it
- You are a listed company, a large private company, or a company approaching an IPO, where control maturity is scrutinised by SEBI, the Audit Committee, and prospective investors
- A recent instance of fraud, error, or a near-miss has exposed that a control assumed to exist either does not exist or is not operating as designed
- You are preparing for a private equity round, strategic sale, or debt facility where the counterparty's diligence team will test your control environment as part of financial and operational due diligence
Before You Assume You Need This
- A very early-stage startup with minimal transaction volume and no institutional investors — basic financial hygiene and a simple approval workflow may be sufficient until scale or funding triggers a fuller review
- A small private company that is statutorily exempt from Section 143(3)(i) IFC reporting (based on the size and other thresholds prescribed under the Companies Act) and has no lender or investor requirement for one
- You need routine bookkeeping accuracy checks rather than a control-design evaluation — a monthly accounting review or reconciliation service may address the immediate need more directly
Common Questions
What exactly is an Internal Financial Control (IFC) and how is it different from 'internal controls' generally?
Internal controls, in the general sense, is a broad term covering any policy or procedure a business uses to manage risk — operational, compliance, financial, or strategic. Internal Financial Controls (IFC), as used under the Companies Act 2013, is a narrower, statutorily defined concept focused specifically on controls over financial reporting — the policies and procedures that ensure the orderly and efficient conduct of business, adherence to policies, safeguarding of assets, prevention and detection of fraud and error, accuracy and completeness of accounting records, and timely preparation of reliable financial information, as defined in the Explanation to Section 134(5)(e). The ICAI Guidance Note maps IFC evaluation to the COSO framework's five components.
Is Internal Financial Controls reporting mandatory for every company?
The statutory auditor's obligation to report on IFC over financial reporting under Section 143(3)(i) applies broadly, but the Companies (Audit and Auditors) Rules, 2014 carve out a specific exemption from this clause for certain categories — including One Person Companies, small companies, and private companies meeting prescribed thresholds on turnover and borrowings. Whether your company is within or outside this exemption depends on your specific financials for the year and should be confirmed with your statutory auditor for the applicable financial year, since the exemption thresholds and criteria are prescribed by rule and can be amended.
What is CARO 2020 and how does it relate to internal controls?
The Companies (Auditor's Report) Order, 2020 (CARO 2020) is a separate reporting requirement issued under Section 143(11) that requires statutory auditors of specified classes of companies to comment on a defined list of matters in their audit report — including, among many other clauses, whether the company has an internal audit system commensurate with the size and nature of its business. CARO 2020's internal audit commentary and Section 143(3)(i)'s IFC opinion are related but distinct reporting obligations — a company can have adequate IFC over financial reporting while still needing to strengthen its internal audit function, or vice versa.
Getting This Right From the Start
Talk to a senior PNPC CA about scoping your Internal Financial Controls evaluation before your next statutory audit cycle — not after your auditor raises a finding you did not see coming.
PNPC Global has advised Chennai, Bangalore and Hyderabad businesses since 1986. Explore the full Risk Advisory practice for related services, or go straight to the Internal Control Reviews & IFC Evaluation page for specifics.
This is a general explainer, not a substitute for checking today's rules with PNPC or the relevant authority — figures and deadlines move, so none are quoted here as fixed.