ICFR Applicability in India: Companies Act Requirements, Exemptions & Audit Process

Strong internal financial controls help businesses maintain accurate accounting records, protect company assets, and reduce the risk of financial errors or fraud. In India, Internal Controls over Financial Reporting (ICFR) are an important part of corporate governance under the Companies Act, 2013. Understanding ICFR applicability enables companies to identify their legal responsibilities, assess control effectiveness, and prepare for statutory audit requirements. ASC Group provides professional guidance to businesses seeking to strengthen their internal financial control systems.

What Is ICFR?

Internal Controls over Financial Reporting refer to policies, procedures, and processes designed to support reliable financial reporting. These controls help ensure that transactions are properly authorised, accounting records are accurate, assets are safeguarded, and financial statements are prepared in accordance with applicable requirements.

Examples include purchase approvals, revenue recognition checks, bank reconciliations, inventory verification, payroll controls, and access restrictions within accounting systems.

Legal Framework for ICFR in India

The Companies Act, 2013 establishes key requirements relating to internal financial controls:

• Section 134(5)(e): Requires the Directors’ Responsibility Statement of a listed company to address the establishment, adequacy, and operating effectiveness of internal financial controls.

• Section 143(3)(i): Requires the statutory auditor to report on whether adequate internal financial controls with reference to financial statements are in place and operating effectively, subject to applicable exemptions.

• Rule 8(5)(viii) of the Companies (Accounts) Rules, 2014: Addresses disclosure of the adequacy of internal financial controls with reference to financial statements in the Board’s report.

These provisions establish responsibilities for management, directors, and auditors within their respective roles.

ICFR Applicability: Which Companies Are Covered?

ICFR requirements depend on the company’s legal status and the specific provision being considered.

Listed companies have explicit responsibilities regarding internal financial controls under Section 134(5)(e). Statutory auditor reporting under Section 143(3)(i) generally applies to companies within its scope, subject to notified exemptions.

Companies should distinguish between their responsibility to maintain appropriate controls and the separate requirement for the statutory auditor to report on those controls. An exemption from auditor reporting does not automatically remove every internal control or governance obligation.

Exemptions from ICFR Auditor Reporting

Under the Ministry of Corporate Affairs notification dated 13 June 2017, certain private companies are exempt from the auditor reporting requirement under Section 143(3)(i), subject to the prescribed conditions.

These include:

• One Person Companies (OPCs).

• Small companies.

• Eligible private companies with turnover below ₹50 crore and aggregate borrowings from banks, financial institutions, or any body corporate below ₹25 crore at any point during the financial year.

The relevant private company must also meet the applicable condition regarding defaults in filing its financial statements under Section 137 or annual returns under Section 92.

Eligibility should be checked against the applicable notification and the company’s current circumstances. These exemptions concern the specified auditor reporting requirement and should not be interpreted as a blanket exemption from all internal financial control obligations.

ICFR Audit Process in India

An ICFR Audit evaluates whether relevant financial controls are appropriately designed and operating effectively. The process generally includes:

1. Identify Financial Reporting Risks: Review key processes such as sales, purchases, payroll, inventory, fixed assets, and financial closing.

2. Document Existing Controls: Record approval procedures, reconciliations, responsibilities, system access, and supporting evidence.

3. Evaluate Control Design: Assess whether the controls are appropriately designed to address identified financial reporting risks.

4. Test Operating Effectiveness: Examine samples of transactions and supporting records to determine whether controls operated as intended during the relevant period.

5. Report Findings: Document control weaknesses, assess their potential impact, and communicate recommendations to management.

6. Implement Improvements: Establish corrective measures, assign responsibilities, and monitor remediation where required.

The scope and testing approach depend on the company’s operations, risk profile, and applicable audit requirements.

How ASC Group Supports ICFR Compliance

ASC Group assists businesses in understanding ICFR requirements and strengthening financial reporting processes. Support may include internal control reviews, risk identification, control documentation, testing assistance, gap analysis, and recommendations for improving control effectiveness.

Professional guidance can help management improve financial reporting discipline and prepare relevant documentation for discussions with statutory auditors.

Conclusion

Understanding ICFR applicability is essential for companies seeking reliable financial reporting and effective corporate governance. By reviewing the Companies Act requirements, checking applicable exemptions, and evaluating internal controls, businesses can better manage financial reporting risks.

ASC Group provides consultancy support to help organisations assess their internal financial controls and address relevant compliance requirements in India. Original Source