IFC (Internal Financial Controls)

Internal financial controls are the systems a company builds to give reasonable assurance that its financial reporting is reliable, its assets are safeguarded, its transactions are properly authorised and recorded, and errors or fraud are prevented or detected in good time. In practice they are the approval matrices, reconciliations, segregation of duties, access restrictions, and review procedures that sit around the accounting process.

The concept became a formal reporting obligation under the Companies Act, 2013. Directors are required to state, in the directors' responsibility statement, that internal financial controls were laid down and were adequate and operating effectively. Separately, the statutory auditor of a company within scope must give an opinion on the adequacy and operating effectiveness of internal financial controls with reference to financial statements, and that opinion is reported alongside the main audit opinion rather than folded into it.

Applicability is where most of the practical questions arise, and the answer differs depending on which obligation is being asked about. The directors' responsibility statement obligation applies broadly to companies preparing that statement. The auditor's separate IFC reporting requirement is narrower: one person companies and small companies, as defined in the Act, are exempted from it, which removes a very large number of private companies from the auditor's IFC opinion while leaving the underlying governance expectation intact.

Two tests are frequently collapsed into one and should not be. Adequacy asks whether a control has been designed to address the risk it is meant to address, and whether the design would work if the control were performed. Operating effectiveness asks whether the control was actually performed, consistently, throughout the reporting period. A monthly reconciliation that is well designed but performed in only seven months of the year is adequate in design and ineffective in operation, and the reporting has to reflect that distinction.

For auditors, IFC testing means understanding the entity's processes, identifying the controls that matter to financial reporting, evaluating their design, and then testing samples across the period to see whether they operated. Deficiencies are graded by severity, and a deficiency serious enough to mean a material misstatement might not be prevented or detected on a timely basis is reported as a material weakness, which qualifies the IFC opinion. The distinction between a control failure and a material weakness is a judgement call, and it is the part of IFC work that generates the most discussion between auditor and management.