The document discusses internal financial controls (IFC), including key requirements, frameworks, implementation steps, and roles. It defines IFC and outlines requirements according to the Companies Act. It also describes the COSO framework components, implementation roadmap, and roles of different lines of defense. Process flows are provided for IFC implementation, including scoping, design assessment, remediation, testing, and reporting. Risk control matrices and current IFC status are also mentioned.

1. 1
INTERNAL FINANCIAL
CONTROL REPORTING
UNDERSTANDING AND IMPLEMENTATION STEPS
Internal Financial Control (IFC)
Knowledge Sharing Session

2. Content
1. Introduction of Internal Financial Controls (IFC)
 Requirements As Per Companies Act, 2013
 Key Elements / IFC Framework
 Steps For establishing Efficient Internal Financial Controls
 IFC Roadmap
2. Why IFC is required : Few Case studies of Satyam / Enron
3. Role of Finance Team to ensure IFC Compliances
4. IFC Process Flow
5. IFC Execution Plan & current Status
2

3. 1. Introduction of Internal Financial Controls (IFC)
 Requirements As Per Companies Act, 2013
 Key Elements / IFC Framework
 Steps For Establishing Efficient Internal Financial Controls
 IFC Roadmap
3

4. Introduction of Internal Financial Controls (IFC)
Definition Guidance notes issued by Institute of Chartered Accountant of India on September 2015
states that Internal financial control over financial reporting shall mean :
 A process designed to provide reasonable assurance regarding the reliability of financial
reporting and
 Preparation of financial statements for external purposes in accordance with generally accepted
accounting principles.
As per section 134 of Companies Act, 2013 the term internal financial control means :
 policies and procedures adopted by company for ensuring orderly and efficient conduct of its
business,
 including adherence to companies policies,
 safeguarding of its assets,
 prevention and detection of fraud and errors,
 accuracy and completeness of accounting records and
 timely preparation of reliable financial information.
Thus, internal financial control includes internal financial control over financial reporting,
operational control and controls for prevention of fraud.
4

5. Requirements As per Companies Act, 2013
5
In case of a listed company, the Directors’ Responsibility states that directors, have laid down IFC to be
followed by the company and that such controls are adequate and operating effectively.
The auditor’s report should also state whether the company has adequate IFC system in place and the
operating effectiveness of such controls.
1. Audit committee may call for comments of auditors about internal control systems before their
submission to the Board and may also discuss any related issues with the internal and statutory auditors and
the management of the company
2. Audit committee should act in accordance with the terms of reference specified in writing by the board,
which should, inter alia, include evaluation of IFC and risk management systems
The independent directors should satisfy themselves on the integrity of financial information and
ensure that financial controls and systems of risk management are robust and defensible.
Note : Please note Ministry of Corporate Affairs (MCA) has notified that Section 143(3)(i) of the Companies Act
2013 shall not be applicable for those audit reports of private limited companies /One-person companies
(OPC) which has Annual turn over of less than Rs 50 Crores or has aggregate borrowings of less than
25 Crores from banks, Financial institutions or body corporate at any time during the financial year issued
after 13th June 2017.
SEC 134
SEC 177
SEC 143
SCHEDULE IV

6. Introduction of Internal Financial Controls (IFC)
6
As per Section 134 of Companies Act, 2013:
The term Internal Financial Control means:
• Policies and procedures adopted by company for ensuring orderly and efficient conduct of its
business, including adherence to company’s policies
• Safeguarding of its assets
• Prevention and detection of fraud and errors
• Accuracy and completeness of the accounting records, and
• Timely preparation of reliable financial information
Internal control
over financial
reporting (ICFR)
Operational
control
Fraud
prevention
Internal
Financial
Control
Sales reporting
Revenue recognition
Correct disclosure
Correct Channel
partner selection
as per approved
guidelines
Access of control
rights
Pricing + discount
Incentives

7. Components of Internal Controls : COSO Framework
7

8. Who all need to be involved in Implementation of IFC
 The “Three Lines of Defense” model provides a simple and effective way to enhance
communications on Internal Financial Controls by clarifying roles and duties.
 The first line is responsible for setting up the controls, mitigation of risk and defining
policies and procedures to be complied with
 The second line monitors compliance with the laid down controls. It is not an independent
assurance function, but a monitoring tool for the management
 The third line provides the independent assurance on the activities of first and second lines of
defense
 Audit Committee and board of directors provide overall direction and oversight
8

9. • Define controls, policy and procedures
• Develop delegation of Authority
• Review of policies and procedures
Control Policies and
Procedures
• Assess Adequacy of protection and use of Assets
• Carry out periodic Physical Verification of Assets
Safeguarding of Assets
• Implement Anti-Fraud Program
• Carry out fraud Risk Assessment
Prevention and Detection of
Fraud and Errors
• Perform an assessment of:
• Entity level controls
Accuracy and Completeness
of Accounting Records
• Develop accounting Policy manual
• Develop a robust financial close process with inbuilt control for
oversight and monitoring
Timely preparation of Reliable
Financial Information
• Process Level Control • IT Control
What Companies Need to do for IFC

10. Key Elements / IFC Framework
 Values
 Vision and Mission
 Code of Ethics
 Code of Conduct
 Culture
 Communication
Entity Level Controls
 Policies and Procedures
 Organisation Structure
 Authority Matrix
 Performance Objectives
 Budgetary Controls
Governance Standards
Design
 Role & Responsibilities
 Risk
Assessment/Identification
Operation
 Control Systems
 Continuous improvement
Monitoring
• Monitor controls
• Monitor Compliance
Control Systems
10

11. Internal Financial control – Road map
11

12. Implementation process road map
One time
Reporting
Control T
esting
Seek
confirmation for
changes
Change
Management
Reporting
Prepare test
strategy & plan
Corrective
action
Validate &
Document
design
Detailed scope
On going
One time
Corrective
action

13. Detailed Analysis (Implementation)
SCOPING
• Map / identify significant processes / location
• Segregate the processes between business process / IT process
• Discuss / align the scope with external auditor
• Define materiality
• Finalize scope exclusions
• Define process and activities / processes performed by third
parties
• Nominate the IFC process leader across process / location
• Align audit committee and company board
• Finalize template, standards, SOP’s, reporting process
• Conduct training work shop with process owner.
(For detailed analyses refer Para 87 (Page 33) ICAI Guidance
Note, September 2015)

14. Detailed Analysis (Implementation)
DESIGN ASSESSMENT
• Finalize process owner for each process
• Perform and document the walkthrough
• Document the process maps (input, output, risk/controls, IPE)
• Segregate the controls into entity/ process/IT
• Perform segregation of duties analysis
• Perform IT General Control
• Identify the design gaps based on walkthroughs, interviews, discussions
• Benchmark IFC controls – consolidate and remove redundancy

15. Detailed Analysis (Implementation)
DESIGN GAP REMEDIATION
• Prioritize financial gaps into material / non-material
• Prioritize operational gaps into High/ Medium/Low
• Co-develop remedies with owners and implementation timeline
• Periodic monitoring of remedial plans
• Enhance / optimize IT controls
• Standardize / centralize process
• Interim testing to confirm remediated gaps

16. Detailed Analysis (Implementation)
OPERATIVE EFFECTIVENESS & TESTING
• Align sampling strategy with external auditor
• Prepare the testing plans with templates, formats
• Timing of testing – mid year, roll forward
• Resourcing – competency, independence, objectivity
• Documenting testing results
• Identify the testing gaps into material / non-material
ASSESSMENT & REPORTING
• Finalize material weakness
• Update the executive management
• Report to audit committee & Board

17. Risk control matrix
Risk control Matrix is a matrix which defines the various levels of risk and the harm
probability and the associated controls design by the organization to mitigate the risk.
The risk control matrix should ideally cover the following areas for effective analysis of risk
and the related controls
Process Fraud
risk
Risk
Control
Objective
Sub
Process
Risk
category
High/Mediu
m/Low
Key/Non-
Key
Preventive/
Detective
Automated/
Non-
Automated
Assertions

18. 2. Why IFC is required : Few Case studies of Satyam / Enron
3. Role of Finance Team
18

19. Risk control matrix

20. 2. IFC Process flow
20

21. 21
IFC Process Flow
Review of
Financials &
Define
materiality
Mapping
financials with
processes
Identifying risks
in processes
Evaluating risks &
its impact
Identifying
existing controls
gaps
Designing
improved controls
Implement
improved
processes
Conduct gap
analysis, define
roadmap &
communicate
Periodic
Management
Testing of Control

22. 2. IFC Execution Plan & Current Status
22

23. IFC Execution plan with time lines
Phase 2
Phase 1