Internal Financial Control for Financial Reporting: formula sheet

Key formulas

Definition of IFC (Explanation to section 134(5)(e))

IFC = policies and procedures for (1) orderly and efficient conduct of business, (2) safeguarding of assets, (3) prevention and detection of fraud and error, (4) accuracy and completeness of accounting records, (5) timely preparation of reliable financial information

Write all five objectives. Examiners usually give one mark per objective.

COSO components

Control environment + Risk assessment + Control activities + Information and communication + Monitoring activities

Memory aid: C-R-C-I-M. The control environment is the foundation.

Who does what

Board: lays down IFC and states adequacy and operating effectiveness | Auditor: reports on adequacy and operating effectiveness of IFC over financial reporting

The directors' statement in the board's report is for listed companies; the auditor's IFC reporting is part of the audit report.

Meaning of IFC (Explanation to section 134)

IFC = policies and procedures for orderly and efficient conduct of business + adherence to company policies + safeguarding of assets + prevention and detection of frauds and errors + accuracy and completeness of accounting records + timely preparation of reliable financial information

Learn the six parts as a list. Questions often ask you to define IFC.

Directors' responsibility statement

Section 134(5)(e): directors of a listed company state that they laid down IFC and the IFC are adequate and were operating effectively

The condition 'listed company' is part of the rule.

Auditor's reporting duty

Section 143(3)(i): report whether the company has adequate IFC with reference to financial statements AND the operating effectiveness of such controls

Two limbs: adequacy and operating effectiveness.

Reasons for negative answer

Section 143(4): if any matter in the report is answered in the negative or with a qualification, the report shall state the reasons

A bare 'No' or qualification earns no marks without reasons.

Fraud reporting

Section 143(12): auditor with reason to believe an offence involving fraud is being or has been committed against the company by officers or employees must report as prescribed

Weak IFC findings may lead here. Fraud below the specified amount goes to the audit committee or the Board.

Preventive control

Control acts BEFORE the transaction is completed

Examples: authorisation limits, segregation of duties, access passwords, system validation.

Detective control

Control acts AFTER the transaction to find errors

Examples: bank reconciliation, variance review, stock count, exception reports.

Entity-level vs process-level

Entity-level = company-wide tone and oversight; Process-level = specific transaction cycle

Entity-level controls often work indirectly; process-level controls work directly on transactions.

Risk of material misstatement

Risk of material misstatement = Inherent risk + Control risk (combined assessment)

This is a conceptual combination, not an arithmetic sum. Inherent risk is susceptibility before controls; control risk is the chance controls fail to prevent or detect it.

Manual vs automated

Manual = person-dependent; Automated = system-embedded

Automated controls depend on IT general controls such as access and change management.

Constitution (s.132(1))

Central Government may, by notification, constitute NFRA

The word is 'may', not 'shall'. Functions run through prescribed divisions (s.132(1A)).

Composition (s.132(3))

Chairperson + other members not exceeding 15 (part-time and full-time)

Chairperson: person of eminence with expertise in accountancy, auditing, finance or law, appointed by the Central Government.

Cooling-off for full-time persons

No association with any audit firm during appointment + 2 years after

Applies to chairperson and members in full-time employment with NFRA.

Core functions (s.132(2))

(a) recommend standards; (b) monitor and enforce compliance; (c) oversee quality of service of professions; (d) other prescribed functions

Clause (a) is recommendation only. The Government prescribes standards.

Penalty on proof of misconduct (s.132(4)(c)(A))

Individuals: not less than ₹1,00,000, up to 5 times the fees received. Firms: not less than ₹5,00,000, up to 10 times the fees received

The firm minimum was substituted from ten lakh rupees by the 2018 amendment, as the footnote shows.

Debarment (s.132(4)(c)(B))

Minimum 6 months, up to 10 years

From auditor or internal auditor appointments, audits, or valuation under section 247.

Appeal (s.132(5))

Aggrieved person appeals to the Appellate Tribunal against a s.132(4)(c) order

As prescribed for manner and fee.

Accounts audit (s.132(14))

NFRA accounts audited by the Comptroller and Auditor-General of India

Annual report is laid before each House of Parliament (s.132(15)).

Quick revision

• IFC covers orderly business conduct, safeguarding assets, preventing and detecting fraud and error, accurate records and timely reliable financial information.
• Directors are responsible for laying down and maintaining IFC and for ensuring it is adequate and operating effectively.
• Auditors report on whether adequate IFC exists and whether it operated effectively; they do not design the controls.
• Management designs and runs controls; the auditor independently tests and reports.
• Preventive controls stop errors before they occur; detective controls find them afterwards.
• Segregation of duties, authorisation limits and reconciliations are standard examples of controls.
• Weak controls raise the risk of misstatement, fraud and loss of assets.
• Controls have limits: collusion, management override and human error can defeat them.
• NFRA is the authority under the Companies Act, 2013 concerned with accounting and auditing standards and audit quality.
• Check exact NFRA composition and powers from the Act before the exam rather than relying on memory.

Common mistakes

• Saying IFC is the auditor's responsibility. Fix: Write that directors design, implement and maintain IFC. The auditor only reports on adequacy and operating effectiveness.
• Listing only three or four objectives of IFC. Fix: Break the definition into five bullets and count them before moving on.
• Saying the auditor is responsible for designing and maintaining IFC. Fix: Remember that management and the Board own the controls. The auditor only tests and reports on them.
• Writing only 'adequacy' and forgetting 'operating effectiveness' in the auditor's duty. Fix: Always write both limbs. Adequacy is about design, operating effectiveness is about working in practice.
• Calling a bank reconciliation a preventive control. Fix: It happens after transactions are recorded and finds differences, so it is detective.
• Assuming automated means preventive and manual means detective. Fix: Classify separately. An automated report of exceptions is detective; a manager's approval is a manual preventive control.
• Saying NFRA itself prescribes accounting standards. Fix: Write that NFRA makes recommendations to the Central Government. The Central Government prescribes them under section 133.
• Writing that members total fifteen including the chairperson, or exactly fifteen. Fix: The text says a chairperson and other members not exceeding fifteen.

Exam tips

• Always write the five objectives of IFC as bullets. It is the most predictable scoring point.
• In MCQs, watch for options that shift IFC responsibility wholly to the auditor. Those are wrong.
• For case questions, name the COSO component first, then the fault, then the fix.
• Mention section 134(5)(e) by number only for the definition and the directors' statement.
• Write both limbs of section 143(3)(i) every time: adequacy and operating effectiveness, with reference to financial statements.
• Keep the three roles in separate lines: directors lay down and state, the audit committee evaluates, the auditor tests and reports.
• Mention 'listed company' when you cite the directors' responsibility statement under section 134(5)(e).
• In MCQs, watch for options that make the auditor responsible for designing controls. These are wrong.