IFC applicability in India is frequently misunderstood because the Companies Act, 2013 creates different responsibilities for boards, management and statutory auditors. The widely discussed ?50 crore turnover and ?25 crore borrowing thresholds relate specifically to an exemption from statutory auditor reporting for certain private companies. They should not be interpreted as meaning that smaller companies have no responsibility for sound financial controls.

What Is IFC Applicability Under the Companies Act?

IFC applicability depends on the specific statutory requirement being considered. Listed-company directors have an express responsibility regarding internal financial controls under Section 134(5)(e), while Section 143(3)(i) requires statutory auditors to report on internal financial controls with reference to financial statements, subject to prescribed exemptions for certain private companies.

This distinction is essential when determining whether an IFC audit, Board-level disclosure or internal testing programme is required.

What Are Internal Financial Controls?

Section 134 of the Companies Act, 2013 describes internal financial controls as policies and procedures designed to support the orderly and efficient conduct of business. The definition covers adherence to company policies, safeguarding assets, preventing and detecting fraud and error, maintaining accurate accounting records and preparing reliable financial information on time.

In practice, Internal Financial Controls (IFC) can cover areas such as:

• Revenue and receivables
• Procurement and payables
• Inventory
• Payroll
• Fixed assets
• Treasury and banking
• General ledger and financial close
• Tax processes
• Journal entries
• Information technology access
• Financial reporting
• Entity-level governance controls

For statutory auditor reporting under Section 143(3)(i), the Act now specifically refers to internal financial controls with reference to financial statements.

This narrower financial-reporting focus is often described as IFC over financial reporting or IFCFR.

IFC Applicability in India: Who Is Responsible?

The legal framework is easier to understand when responsibilities are separated.

Area	Primary responsibility	Key requirement
Establishing controls	Management and Board	Design and operate controls appropriate to the organisation
Directors’ Responsibility Statement	Directors of listed companies	State that IFCs have been laid down and are adequate and operating effectively
Board’s Report	Companies covered by the applicable Board-reporting rules	Address adequacy of IFC with reference to financial statements
Statutory auditor reporting	Statutory auditor	Report on adequacy and operating effectiveness of IFC with reference to financial statements, unless an exemption applies
IFC testing	Management, internal assurance teams and statutory auditor as applicable	Assess design and operating effectiveness using evidence
Remediation	Management/control owners	Correct identified deficiencies and establish sustainable controls

Section 134(5)(e) specifically applies the Directors’ Responsibility Statement requirement regarding IFC to listed companies.

Separately, Rule 8(5)(viii) of the Companies (Accounts) Rules requires the Board’s Report, where Rule 8 applies, to contain details regarding the adequacy of internal financial controls with reference to the financial statements.

Section 143(3)(i) then places a reporting obligation on statutory auditors, subject to specific private-company exemptions.

IFC Applicability Thresholds for Private Companies

The most important threshold issue concerns auditor reporting under Section 143(3)(i).

The Ministry of Corporate Affairs notification G.S.R. 583(E), dated 13 June 2017, introduced an exemption for specified private companies. A corrigendum issued on 13 July 2017 changed the relevant wording from “or” to “and”.

Accordingly, Section 143(3)(i) auditor reporting does not apply to a private company that is:

1. A One Person Company (OPC); or
2. A small company; or
3. A private company that satisfies both of these conditions:
   • Turnover is less than ?50 crore according to the latest audited financial statements; and
   • Aggregate borrowings from banks, financial institutions or any body corporate are less than ?25 crore at any point during the financial year.

The exemption is also subject to the private company not having committed a default in filing its financial statements under Section 137 or annual return under Section 92 with the Registrar.

IFC Audit Applicability: Quick Decision Table

Company situation	Section 143(3)(i) auditor reporting
Listed company	Applicable
Public company	Generally applicable
Private company with turnover of ?50 crore or more	Applicable
Private company with borrowings of ?25 crore or more at any point during the year	Applicable
Private company below both ?50 crore turnover and ?25 crore borrowing thresholds	Exemption may apply, subject to conditions
One Person Company	Exempt under the private-company notification
Small company	Exempt under the private-company notification

The turnover and borrowing thresholds should therefore be read as an exemption test for statutory auditor reporting, rather than as a universal definition of whether internal controls matter.

Why IFC Applicability Is Often Misinterpreted

A common mistake is to state that “IFC does not apply” when a private company falls below the thresholds.

A more precise conclusion is:

The statutory auditor may be exempt from reporting under Section 143(3)(i), provided the prescribed conditions are satisfied.

This matters because companies still need reliable accounting processes, safeguarding controls, fraud-prevention mechanisms, statutory compliance and accurate financial reporting.

Lenders, investors, holding companies and group auditors may also require a stronger control environment even where a specific statutory auditor-reporting exemption exists.

IFC Audit vs Internal Audit: They Are Not the Same

An IFC audit and internal audit serve different purposes.

IFC Audit

An IFC audit under the Companies Act focuses on whether relevant internal financial controls with reference to financial statements are adequately designed and operating effectively.

Internal Audit

Internal audit has a broader governance and risk mandate. Depending on the audit plan, it can assess operational processes, regulatory compliance, fraud risk, cybersecurity, procurement, business continuity and other areas outside financial reporting.

Section 138 and the Companies (Accounts) Rules prescribe separate thresholds for mandatory appointment of an internal auditor.

Organisations should therefore avoid using internal financial controls applicability and internal-audit applicability interchangeably.

For the separate statutory thresholds, see MindBridge’s guide to internal audit applicability in India.

What Does an IFC Testing Programme Actually Examine?

IFC testing normally addresses two fundamental questions.

Design Effectiveness

Is the control designed appropriately to address the identified financial-reporting risk?

For example, suppose vendor bank-account changes create a risk of fraudulent payment. A control requiring independent verification and authorised approval may address that risk.

If the procedure merely records that a change occurred without validating the request, the control may not be adequately designed.

Operating Effectiveness

Was the control actually performed as designed during the period?

Testing may assess:

• Who performed the control
• Whether the performer had appropriate authority
• When the control occurred
• Which transactions or population were covered
• What evidence was retained
• Whether exceptions were investigated
• Whether review was sufficiently precise
• Whether remediation was completed

A well-written policy is not proof that the control operated effectively.

The Institute of Chartered Accountants of India (ICAI) provides a Guidance Note on Audit of Internal Financial Controls Over Financial Reporting, which addresses the auditor’s approach to assessing and testing these controls.

A Practical IFC Testing Methodology

1. Define the Financial-Reporting Scope

Start with material financial-statement areas and significant processes.

Typical processes include:

• Procure-to-Pay
• Order-to-Cash
• Record-to-Report
• Inventory
• Payroll
• Treasury
• Tax
• Fixed assets

The scope should reflect actual financial-reporting risks rather than adopting another company’s control matrix without modification.

2. Identify Risks

For each process, identify what could cause a material error or unreliable financial reporting.

Examples include:

• Duplicate vendor payments
• Unauthorised journal entries
• Incorrect revenue recognition
• Unrecorded liabilities
• Incorrect payroll changes
• Inaccurate reconciliations
• Unauthorised system access

3. Map Risks to Controls

Every key control should address an identified risk.

The Risk and Control Matrix (RCM) should document the process, risk, control objective, control description, frequency, owner, evidence and whether the control is manual, automated or IT-dependent.

4. Perform Walkthroughs

Follow selected transactions from initiation through accounting and financial reporting.

Walkthroughs help determine whether documented procedures reflect actual operations and whether important control gaps or undocumented system dependencies exist.

5. Test Control Design

Evaluate whether the control can reasonably prevent or detect the relevant error.

Consider segregation of duties, review precision, system configuration, escalation criteria and competence of the control owner.

6. Test Operating Effectiveness

Select appropriate transactions or control occurrences and examine whether the control operated throughout the relevant period.

The nature and extent of IFC testing depend on control frequency, risk, automation and professional judgement.

7. Evaluate Deficiencies and Remediation

Not every control exception has the same significance.

Management should assess:

• Root cause
• Frequency
• Potential financial impact
• Compensating controls
• Systemic implications
• Whether similar processes are affected

Corrective actions should have named owners, due dates and retesting requirements.

Information Technology Controls Are Part of IFC Testing

Modern financial reporting depends heavily on Enterprise Resource Planning (ERP) systems, automated workflows, interfaces and spreadsheets.

IFC testing may therefore include Information Technology General Controls (ITGCs) covering:

• User access
• Privileged access
• Joiner, mover and leaver processes
• Segregation of duties
• Program changes
• System operations
• Interfaces
• Backups and recovery

Where a financial control depends on a system-generated report, management should also establish that the report is complete and accurate for its intended use.

Weak technology controls can affect reliance on multiple automated financial controls at once.

IFC Readiness and Testing Checklist

Use this checklist before management testing, statutory audit or a control-readiness review.

Scope and Governance

• Confirm whether Section 143(3)(i) auditor reporting applies.
• Verify any private-company exemption against turnover, borrowings and filing status.
• Identify significant financial-statement accounts and disclosures.
• Assign accountable process and control owners.
• Establish an approved IFC or Risk and Control Matrix.

Process Documentation

• Document major transaction cycles and reporting processes.
• Update process narratives and flowcharts for current operations.
• Link each key financial-reporting risk to an identified control.
• Record control frequency, owner and required evidence.
• Identify automated and IT-dependent controls.

Control Testing

• Complete walkthroughs for significant processes.
• Assess design effectiveness before testing operation.
• Define appropriate test populations and samples.
• Retain evidence showing performance and review.
• Test management-review controls at an appropriate level of precision.
• Validate information used in key controls.

Technology

• Review system and privileged-access controls.
• Test joiner, mover and leaver processes.
• Review segregation-of-duty conflicts.
• Assess change-management controls.
• Validate critical reports and interfaces.

Deficiency Management

• Maintain a central control-exception register.
• Perform root-cause analysis for failures.
• Assign remediation owners and deadlines.
• Retest corrected controls.
• Escalate significant unresolved issues to management or the Board.

Periodic IFC Testing vs Continuous Controls Monitoring

Traditional IFC testing normally evaluates controls at defined intervals. Continuous Controls Monitoring (CCM), by contrast, can analyse defined transactions or control conditions more frequently.

Examples include automated monitoring for:

• Duplicate payments
• Approval-limit breaches
• Segregation-of-duty conflicts
• Unusual journal entries
• Vendor-master changes
• Overdue reconciliations

CCM can improve visibility, but it does not eliminate the need for risk assessment, control ownership or statutory IFC testing.

MindBridge’s guide to continuous controls monitoring explains how automated monitoring can complement periodic testing rather than replace it.

How MindBridge Supports IFC Readiness and Control Review

MindBridge supports organisations with internal control assessment, process reviews, risk mapping, control testing, exception analysis, remediation tracking and management reporting.

Its Management Review and Reporting services are designed to strengthen control visibility, financial-process governance, continuous monitoring and management assurance.

Organisations reviewing IFC applicability, preparing for an IFC audit or strengthening an existing control framework can use the readiness checklist above as an initial diagnostic and request a control review to identify gaps in documentation, design, evidence and testing.

Final statutory interpretations and auditor conclusions should remain with the company’s authorised management, statutory auditor and appropriately qualified professional advisers.

Frequently Asked Questions

Conclusion

IFC applicability in India cannot be determined from a single turnover threshold. Enterprises must distinguish directors’ responsibilities, Board reporting and the statutory auditor’s requirement under Section 143(3)(i).

For qualifying private companies, the ?50 crore turnover and ?25 crore borrowing thresholds relate specifically to the auditor-reporting exemption and must be considered together with company classification and filing status.

A structured IFC readiness review covering process risks, control design, testing evidence, technology dependencies and remediation can help management identify weaknesses before the statutory audit cycle and strengthen financial-reporting governance.

Follow MindBridge

Follow MindBridge on Instagram
Connect with MindBridge on LinkedIn
Watch MindBridge on YouTube
Follow MindBridge on Facebook