IFC (Internal Financial Controls)
The policies and procedures a company puts in place to make its financial reporting reliable, which directors must report on and auditors of most companies must separately opine on.
In short
- Required under the Companies Act, 2013 for reporting on the reliability of financial reporting.
- Directors report on the adequacy and operating effectiveness of the controls.
- The statutory auditor gives a separate opinion on IFC over financial reporting for companies within scope.
- One person companies and small companies are outside the auditor's IFC reporting requirement.
- Adequacy and operating effectiveness are two distinct tests, and a control can pass one and fail the other.
Internal financial controls are the systems a company builds to give reasonable assurance that its financial reporting is reliable, its assets are safeguarded, its transactions are properly authorised and recorded, and errors or fraud are prevented or detected in good time. In practice they are the approval matrices, reconciliations, segregation of duties, access restrictions, and review procedures that sit around the accounting process.
The concept became a formal reporting obligation under the Companies Act, 2013. Directors are required to state, in the directors' responsibility statement, that internal financial controls were laid down and were adequate and operating effectively. Separately, the statutory auditor of a company within scope must give an opinion on the adequacy and operating effectiveness of internal financial controls with reference to financial statements, and that opinion is reported alongside the main audit opinion rather than folded into it.
Applicability is where most of the practical questions arise, and the answer differs depending on which obligation is being asked about. The directors' responsibility statement obligation applies broadly to companies preparing that statement. The auditor's separate IFC reporting requirement is narrower: one person companies and small companies, as defined in the Act, are exempted from it, which removes a very large number of private companies from the auditor's IFC opinion while leaving the underlying governance expectation intact.
Two tests are frequently collapsed into one and should not be. Adequacy asks whether a control has been designed to address the risk it is meant to address, and whether the design would work if the control were performed. Operating effectiveness asks whether the control was actually performed, consistently, throughout the reporting period. A monthly reconciliation that is well designed but performed in only seven months of the year is adequate in design and ineffective in operation, and the reporting has to reflect that distinction.
For auditors, IFC testing means understanding the entity's processes, identifying the controls that matter to financial reporting, evaluating their design, and then testing samples across the period to see whether they operated. Deficiencies are graded by severity, and a deficiency serious enough to mean a material misstatement might not be prevented or detected on a timely basis is reported as a material weakness, which qualifies the IFC opinion. The distinction between a control failure and a material weakness is a judgement call, and it is the part of IFC work that generates the most discussion between auditor and management.
Also referred to as: IFC, internal financial controls over financial reporting, IFCoFR, IFC applicability.
Frequently asked questions
What is IFC applicability?
It depends which obligation you mean. The directors' responsibility statement on internal financial controls applies broadly. The auditor's separate opinion on internal financial controls over financial reporting is narrower: one person companies and small companies as defined in the Companies Act, 2013 are exempt from that auditor reporting requirement.
What is the difference between IFC and internal control?
Internal control is the broader concept covering all of a company's operational, compliance, and reporting controls. Internal financial controls are the subset directed at the reliability of financial reporting, and it is that subset the Companies Act, 2013 reporting obligations attach to.
Are small companies exempt from IFC?
They are exempt from the auditor's separate IFC reporting requirement, along with one person companies. That exemption removes the audit opinion, not the underlying expectation that a company maintains controls appropriate to its size and business.
What is the difference between adequacy and operating effectiveness?
Adequacy asks whether the control is designed to address the risk it targets. Operating effectiveness asks whether it was actually performed consistently across the period. A well-designed control performed in only some months is adequate in design but ineffective in operation.
What is a material weakness in IFC?
A deficiency, or combination of deficiencies, severe enough that a material misstatement of the financial statements might not be prevented or detected on a timely basis. Identifying one qualifies the auditor's IFC opinion, and grading a deficiency to that level is a matter of judgement.
Disclaimer
This glossary entry is for general informational purposes only and does not constitute professional tax, legal, or financial advice. Rules and rates change, so consult a qualified Chartered Accountant for advice specific to your situation.