Internal Financial Controls (IFC): What the Companies Act Requires
When a payment goes out without approval, a bank reconciliation sits unreviewed for months, or one employee can both create a vendor and release money to it, the problem is rarely just an accounting error. It is a control gap. The Companies Act, 2013 addresses these gaps through a set of provisions on internal financial controls under the Companies Act, and they place different responsibilities on directors, the Board and the statutory auditor.
Those obligations are not identical, and they do not apply in the same way to every company. This guide explains what the law actually requires, who it applies to, how private company exemptions work, and how a company can assess and strengthen its controls before the audit.
What Are Internal Financial Controls Under the Companies Act, 2013?
The Explanation to Section 134(5)(e) defines internal financial controls as the policies and procedures a company adopts to ensure the orderly and efficient conduct of its business, including adherence to company policies, safeguarding of assets, prevention and detection of frauds and errors, accuracy and completeness of accounting records, and timely preparation of reliable financial information. The statutory auditor’s reporting duty under Section 143(3)(i) is narrower: it covers internal financial controls with reference to financial statements.
What Are Internal Financial Controls (IFC)?
In plain terms, internal financial controls are the checks built into everyday business processes so that transactions are authorised, recorded correctly and reported reliably. They support:
- Reliable financial reporting and complete, accurate accounting records
- Safeguarding of company assets
- Prevention and timely detection of unauthorised transactions
- Compliance with internal policies and the delegation of authority
- Accountability and transparency in the finance function
Common examples include approval limits for payments, monthly bank reconciliations, segregation of duties, approval of vendor creation and changes, review of manual journal entries, inventory reconciliations, user access controls in the accounting system, and a documented period-end review of the financial statements.
These are examples of control activities. The Act does not prescribe a word-for-word checklist; each company designs controls that fit its size, processes and risks. IFC is also not the same as internal audit. Controls are operated by management every day, while internal audit evaluates them.
What Does the Companies Act, 2013 Require?
Four provisions matter most. Each serves a different purpose.
Section 134(5)(e): Directors’ Responsibility Statement (Listed Companies)
Section 134(3)(c) requires the Board’s report to include a Directors’ Responsibility Statement, and Section 134(5) sets out what it must contain. Clause (e) applies in the case of a listed company. The directors must state that they had laid down internal financial controls to be followed by the company and that such controls are adequate and were operating effectively.
The Explanation to clause (e) contains the broad definition quoted above, which goes beyond financial reporting to cover the orderly conduct of business, safeguarding of assets and fraud prevention. Separately, clause (f) requires directors of every company to state that they had devised proper systems to ensure compliance with all applicable laws, and that those systems were adequate and operating effectively.
Section 143(3)(i): Statutory Auditor’s Reporting
Section 143(3)(i) requires the auditor’s report to state whether the company has adequate internal financial controls with reference to financial statements in place, and the operating effectiveness of such controls. The phrase “with reference to financial statements” was substituted by Section 43 of the Companies (Amendment) Act, 2017, replacing the earlier wording about the internal financial controls system.
The auditor’s duty is to report, based on evidence gathered by testing both design and operating effectiveness. The ICAI’s Guidance Note on Audit of Internal Financial Controls Over Financial Reporting (revised in September 2015) provides the methodology auditors follow. Under it, a material weakness generally leads to a qualified or adverse opinion on IFC, and a scope limitation can lead to a disclaimer. This is a reporting responsibility. It is not a guarantee that every fraud or error will be detected.
Rule 8(5)(viii): Board’s Report
Rule 8(5)(viii) of the Companies (Accounts) Rules, 2014 requires the Board’s report to state the details in respect of the adequacy of internal financial controls with reference to the financial statements. This disclosure is not limited to listed companies.
However, Rule 8A, inserted in 2018 under Section 134(3A), prescribes an abridged Board’s report for One Person Companies and small companies. Its list of contents does not include a standalone IFC adequacy item. If your company is an OPC or small company, confirm which format applies with your company secretary or auditor.
Rule 10A: Historical Commencement of Auditor Reporting
Rule 10A of the Companies (Audit and Auditors) Rules, 2014, inserted on 14 October 2014, made auditor reporting on internal financial controls mandatory for financial years commencing on or after 1 April 2015, with voluntary reporting allowed for FY 2014-15. The rule still refers to the “internal financial controls system,” which predates the 2017 amendment to Section 143(3)(i). Today, the scope should be read from the amended Section 143(3)(i) and the current exemption notifications.
Related Governance Provisions
Other provisions touch on IFC. Under Section 177(4)(vii), the audit committee’s terms of reference include evaluation of internal financial controls and risk management systems; this applies to companies required to have an audit committee (listed companies and prescribed classes of public companies). Schedule IV asks independent directors to satisfy themselves that financial controls and risk management systems are robust. Listed entities also have obligations under the SEBI Listing Regulations, including the CEO/CFO certification on internal controls for financial reporting.
Which Companies Need to Comply With IFC Requirements?
Applicability depends on the type of company and on which obligation you are looking at. The summary below separates directors’ responsibilities, Board reporting and auditor reporting.
| Company category | Directors’ IFC statement (s.134(5)(e)) | Board’s report disclosure (Rule 8(5)(viii)) | Auditor reporting (s.143(3)(i)) | Important qualification |
|---|---|---|---|---|
| Listed company | Required | Required | Required | SEBI Listing Regulations and audit committee requirements also apply |
| Unlisted public company | Clause (e) does not apply; clause (f) and general duties do | Required | Required; the private company exemption does not extend to public companies | Audit committee duties apply if the company falls in a prescribed class |
| Private company (not exempt) | Clause (e) does not apply; clause (f) and general duties do | Required, unless the abridged Rule 8A format applies | Required | Check the exemption conditions every year |
| Private company meeting exemption conditions | Clause (e) does not apply; clause (f) and general duties do | Depends on whether Rule 8 or Rule 8A applies | Not applicable | Exemption from auditor reporting does not remove the need for controls |
| Government or specially regulated company | Depends on listing status | Verify | Verify | Check sector-specific law and MCA notifications for that class |
Swipe the table sideways to see all columns.
This table reflects the general legal position. Company-specific facts, such as listed debt, holding or subsidiary status, or a filing default, can change the answer.
Are Private Companies Exempt From IFC Audit Reporting?
Some are, but not all. MCA notification G.S.R. 583(E) dated 13 June 2017, which amended the private company exemption notification G.S.R. 464(E) of 5 June 2015, provides that Section 143(3)(i) does not apply to a private company that:
- is a One Person Company or a small company; or
- has turnover of less than ₹50 crore as per its latest audited financial statements and aggregate borrowings from banks, financial institutions or any body corporate of less than ₹25 crore at any point of time during the financial year.
The word “and” in the second condition was confirmed by a corrigendum dated 13 July 2017, so both limits must be met. The notification also carries a general condition: these private company exemptions apply only if the company has not committed a default in filing its financial statements under Section 137 or its annual return under Section 92 with the Registrar.
Since 1 December 2025, a small company means a private company with paid-up capital not exceeding ₹10 crore and turnover not exceeding ₹100 crore (G.S.R. 880(E)), up from ₹4 crore and ₹40 crore. Holding and subsidiary companies, Section 8 companies and companies governed by a special Act cannot be small companies. The higher thresholds mean more private companies may now qualify for the exemption through the small company route.
Keep three things separate. First, the exemption only removes the statutory auditor’s IFC reporting under Section 143(3)(i). Second, directors’ duties, the Section 134(5)(f) statement and Board reporting continue to apply as relevant. Third, every company still needs controls to prepare reliable financial statements, and auditors still consider internal control as part of the financial statement audit.
IFC vs Internal Audit vs Risk Management
| Factor | Internal financial controls | Internal audit | Risk management |
|---|---|---|---|
| Primary purpose | Controls supporting reliable financial reporting and related objectives | Objective evaluation of controls, processes and governance within its mandate | Identifying, assessing and responding to business risks |
| Legal basis | Sections 134 and 143, Rule 8(5)(viii) and related rules | Section 138 for prescribed classes; otherwise the company’s choice | Board and audit committee duties; SEBI rules for certain listed entities |
| Typical activities | Approvals, reconciliations, access controls, reporting reviews | Audit testing, process reviews, findings and recommendations | Risk registers, assessment, mitigation and escalation |
| Main responsibility | Management and the Board, with auditor reporting where applicable | Internal audit function or appointed internal auditor | Management and governance structures |
| Relationship | Controls operate within the control environment | May test the design and operation of controls | Helps decide which controls and monitoring are needed |
Swipe the table sideways to see all columns.
The three overlap but are not interchangeable. For more on the internal audit side, see our guide to internal audit for mid-size companies.
What Does an IFC Assessment or Audit Involve?
Whether management runs a self-assessment or the statutory auditor tests controls, the work usually follows a similar risk-based sequence.
- Understand the business and financial reporting risks. Review operations, systems, reporting structure, transaction cycles and where a material misstatement could arise.
- Identify key financial processes. Typically revenue and receivables, procurement and payables, inventory, payroll, treasury, fixed assets, journal entries and financial close. Selection depends on risk and materiality.
- Map risks to controls. Document each risk, control objective, control activity, owner, frequency and evidence, usually in a risk-control matrix.
- Assess control design. Ask whether the control, if performed as designed by a competent person, would prevent or detect a material misstatement.
- Test operating effectiveness. Inspect documents, observe procedures, trace transactions or reperform the control to confirm it worked throughout the period.
- Evaluate deficiencies. Document exceptions, discuss them with management and assess their potential effect on financial reporting, individually and together.
- Document findings and remediation. Record evidence, recommendations, owners and target dates. Management remains responsible for fixing controls; the auditor does not take over that role.
Illustrative Risk-Control Matrix
| Business process | Financial reporting risk | Illustrative control | Control owner | Evidence retained | Testing approach |
|---|---|---|---|---|---|
| Procurement and payables | Payments to fictitious or unapproved vendors | New vendors and bank detail changes approved by someone other than the requester | Finance manager | Approved vendor forms, system change log | Sample new and changed vendors; check approval and independence |
| Cash and banking | Unrecorded or misappropriated cash | Monthly bank reconciliation prepared and reviewed by different people | Accountant (prepare), Controller (review) | Signed reconciliations with review date | Inspect reconciliations; follow up old reconciling items |
| Revenue | Revenue recorded in the wrong period | Cut-off review of invoices and dispatches around period end | Revenue accountant | Cut-off checklist, dispatch records | Trace transactions near year end to delivery evidence |
| Journal entries | Unauthorised or unsupported manual entries | Manual journals above a set limit reviewed with supporting documents | Financial controller | Journal approval log, attachments | Sample manual journals; check support and approval |
| Inventory | Book stock differs from physical stock | Periodic physical verification and reconciliation of differences | Stores head and finance | Count sheets, reconciliation, approvals for write-offs | Observe a count; inspect reconciliation and adjustments |
| IT access | Unauthorised changes to financial data | Quarterly review of user access rights in the accounting system | IT head with finance | Access review report with sign-off | Inspect review; test leavers removed promptly |
Swipe the table sideways to see all columns.
This matrix is illustrative and not legally prescribed. Real matrices depend on the company’s processes, systems and risk profile.
Key Areas of Internal Financial Control
Use this as an illustrative risk-based checklist, not an exhaustive statutory list:
- Revenue: authorisation, invoicing, revenue recognition, credit notes and reconciliation
- Procurement and payables: vendor onboarding, purchase approvals, invoice matching and duplicate-payment checks
- Cash and banking: bank reconciliations, payment authorisation and access restrictions
- Inventory: physical verification, movement records and reconciliation with books
- Payroll: employee master-data controls, payroll approval and reconciliation
- Fixed assets: capitalisation approval, asset register, physical verification and disposals
- Journal entries: restricted access, supporting documents and independent review
- Financial close: reconciliations, review of estimates and financial statement checks
- Information systems: user access, change management and reliability of system reports
- Related-party transactions: identification, approval, documentation and disclosure
What Documents Should a Company Prepare for an IFC Review?
Documentation depends on the scope of the review, but a typical set includes:
- Process narratives and flowcharts for key cycles
- Risk-control matrices
- Delegation of authority and approval policies
- Accounting policies and financial reporting procedures
- Bank reconciliations and supporting schedules
- Vendor and customer master-data change records
- Journal entry review evidence
- System access reviews and change management records
- Period-end reconciliations and review documentation
- Internal audit reports and prior control findings, where relevant
- Corrective action plans and evidence of remediation
- Management representations and certifications, where applicable
Common IFC Weaknesses and How to Address Them
| Weakness | Practical remediation |
|---|---|
| One person can create vendors and authorise payments | Split the roles in the system; where staff is limited, add an independent review of vendor changes |
| Bank reconciliations delayed or not reviewed | Set a monthly deadline and require a dated reviewer sign-off |
| Journal entries lack supporting documents | Make attachments mandatory and review manual journals above a limit |
| System access not reviewed | Run a periodic access review and remove leavers promptly |
| Spreadsheets without version control | Lock key formulas, control versions and review critical schedules |
| Undocumented financial close | Create a close checklist with owners and deadlines |
| Control exceptions left unresolved | Track exceptions in a log with owners and target dates |
| Management reviews done but not evidenced | Record what was reviewed, by whom, when and what was followed up |
Swipe the table sideways to see all columns.
A weakness does not mean fraud has occurred, and not every weakness carries the same significance. Each needs to be assessed on its facts. If you suspect a weakness has been exploited, our article on financial fraud red flags covers the warning signs.
What Happens if an IFC Deficiency Is Identified?
The deficiency should be documented with the facts, the process affected and how it was found. Management then evaluates its potential effect on the financial statements, alone and in combination with other deficiencies. A corrective action plan should name an owner, a timeline and the evidence that will show the fix is working.
The statutory auditor reaches an independent conclusion. Depending on the nature of the deficiency and the evidence, the auditor’s report on IFC may be unmodified, qualified or adverse, and the auditor also considers the effect on the financial statement audit. A remediation plan on its own does not guarantee an unmodified conclusion, particularly if the fix was not operating for long enough before the reporting date.
How Can Companies Prepare for an IFC Audit?
The checklist below works as a practical readiness framework:
- Confirm legal applicability, including whether any private company exemption applies this year
- Identify material financial reporting risks
- Map key controls to those risks in a risk-control matrix
- Assign a named owner to every key control
- Standardise evidence and documentation for each control
- Test important controls internally before the audit
- Evaluate deficiencies and track them in an exceptions log
- Review access permissions and segregation of duties
- Coordinate finance, IT, operations and management
- Record management reviews and remediation evidence
Preparation makes the audit smoother and the conclusions better supported. It does not guarantee an unmodified opinion. Our statutory audit checklist for private limited companies covers the wider audit preparation.
Frequently Asked Questions
What are Internal Financial Controls under the Companies Act, 2013?
The Explanation to Section 134(5)(e) defines them as policies and procedures for the orderly and efficient conduct of business, including adherence to company policies, safeguarding of assets, prevention and detection of frauds and errors, accuracy and completeness of accounting records, and timely preparation of reliable financial information.
Which section of the Companies Act deals with IFC?
Section 134(5)(e) covers the directors’ statement for listed companies, and Section 143(3)(i) covers the statutory auditor’s reporting. Rule 8(5)(viii) of the Companies (Accounts) Rules, 2014 covers Board’s report disclosure, and Section 177(4)(vii) covers the audit committee’s evaluation role.
What is the difference between Section 134(5)(e) and Section 143(3)(i)?
Section 134(5)(e) requires directors of listed companies to state that they laid down internal financial controls that are adequate and operating effectively, using a broad definition. Section 143(3)(i) requires the auditor to report on internal financial controls with reference to financial statements, based on testing.
Are IFC mandatory for private companies?
The Section 134(5)(e) statement applies only to listed companies, but private companies still need controls to prepare reliable financial statements, and Board reporting and auditor reporting may apply depending on the company’s facts and any exemption.
Are private companies exempt from IFC audit reporting?
Some are. Under G.S.R. 583(E) of 13 June 2017, Section 143(3)(i) does not apply to a private company that is an OPC or small company, or that has turnover below ₹50 crore and borrowings below ₹25 crore, provided it has not defaulted in filing financial statements or annual returns.
What is the difference between IFC and internal audit?
IFC are the controls management designs and operates. Internal audit is a function that independently evaluates those controls and other processes. Internal audit is mandatory only for prescribed classes of companies under Section 138.
What does a statutory auditor check during an IFC audit?
The auditor understands financial reporting risks, identifies key controls, evaluates their design, tests their operating effectiveness and evaluates any deficiencies, following the ICAI Guidance Note on Audit of Internal Financial Controls Over Financial Reporting.
What documents are required for an IFC assessment?
Typically process narratives, risk-control matrices, approval policies, reconciliations, journal review evidence, access reviews, prior findings and remediation records. The exact set depends on the scope.
What happens if a company has weak internal financial controls?
Weak controls raise the risk of misstatement and loss. Where auditor reporting applies, material weaknesses can lead to a qualified or adverse opinion on IFC. Management should document, assess and remediate deficiencies promptly.
How can a company prepare for an IFC audit?
Confirm applicability, identify risks, map controls, assign owners, standardise evidence, test key controls in advance, track exceptions and keep records of management review and remediation.
Conclusion: Building Reliable Internal Financial Controls
Internal financial controls underpin reliable financial reporting and good governance. Directors, the Board and the statutory auditor each have distinct responsibilities, and applicability depends on the company’s type, size and current exemption status. Documented, risk-based controls, regular testing and timely remediation give management and auditors a stronger basis for their conclusions.
This article provides general information and is not a substitute for advice based on your company’s circumstances. Thresholds and exemptions are subject to amendment; confirm the current position before relying on them.
Need an IFC Assessment?
AAPT & Associates helps companies design, document and test internal financial controls, and provides statutory audit and internal audit support.
Official sources: Companies Act, 2013 (MCA) · Section 134 · Section 143 · ICAI