Internal financial controls for unlisted and smaller companies: what applies and what 'adequate' means
IFC is often treated as a listed-company subject. The Companies Act reaches further than that. A summary of who must report, the exemption for small private companies, and what a workable control framework looks like.
Internal financial controls (IFC) are the policies and procedures a company uses to run its business in an orderly way, protect its assets, prevent and detect fraud and error, keep accurate records and prepare reliable financial information on time. Many unlisted companies assume this is only a concern for listed ones. The Companies Act, 2013 is wider.
Who has to say what
- Directors of listed companies state in the Directors' Responsibility Statement, under section 134(5)(e), that they have laid down internal financial controls and that these are adequate and operating effectively.
- Every company's Board report must give details of the adequacy of internal financial controls with reference to the financial statements, under Rule 8(5)(viii) of the Companies (Accounts) Rules, 2014.
- The statutory auditor, under section 143(3)(i), reports whether the company has adequate internal financial controls with reference to financial statements and whether they operate effectively.
The exemption for smaller private companies
By an MCA notification of June 2017, the auditor's reporting under section 143(3)(i) does not apply to a private company that is:
- a one person company or a small company, or
- a company with turnover below ₹50 crore as per its latest audited financial statements and aggregate borrowings from banks, financial institutions or bodies corporate below ₹25 crore at any time during the year.
A private service company that crosses ₹50 crore turnover therefore moves into auditor reporting on IFC, often without having prepared for it. Public companies have no such exemption, whatever their size.
A separate requirement: the internal auditor
Section 138, read with Rule 13 of the Companies (Accounts) Rules, requires an internal auditor to be appointed by:
- every listed company
- unlisted public companies with paid-up capital of ₹50 crore or more, turnover of ₹200 crore or more, outstanding loans or borrowings from banks or public financial institutions above ₹100 crore, or outstanding deposits of ₹25 crore or more
- private companies with turnover of ₹200 crore or more, or outstanding loans or borrowings from banks or public financial institutions above ₹100 crore
The limits are tested against the preceding financial year.
What "adequate" looks like in practice
An auditor testing IFC looks for evidence, and a control that is performed but leaves no trace is hard to rely on. A workable framework has five parts:
- Scoping. Identify the significant account balances and the processes that feed them: revenue, purchases, payroll, fixed assets, treasury, taxes and the financial close.
- Risk and control matrix. For each process, list what could go wrong and the control that addresses it, who performs it, how often and what evidence it leaves.
- Entity-level controls. Delegation of authority, a code of conduct, a whistle-blower mechanism where required, and Board or management review of results.
- IT general controls. User access, change management and back-ups for the accounting system. Shared passwords and ex-employees with active logins are the most frequent findings.
- Testing and remediation. Test a sample of each key control during the year, record exceptions and fix them before year end.
Mistakes that are easy to avoid
- Treating the risk and control matrix as a year-end document. Controls must operate through the year, so testing in March finds problems too late to fix.
- Copying another company's matrix. It will describe controls that do not exist in your business.
- Listing forty controls per process. A smaller set of key controls that are actually performed is stronger.
- Ignoring spreadsheets. If revenue or provisions are calculated in a spreadsheet, that spreadsheet is part of the control environment.
Why bother below the threshold
Even where the auditor's report is exempt, lenders, investors and large customers increasingly ask about controls. A company that will cross ₹50 crore in a year or two will find it far easier to build the framework gradually than in the final quarter before its first IFC audit.
This article is general information as on the date of publication. Law and practice change, and the facts of each business differ, so please take professional advice before acting on it.