CMA Intermediate · Corporate Accounting and Auditing

Report on Internal Financial Control over Financial Reporting: formula sheet

Full chapter guide

Key formulas

Meaning of IFC (explanation to Section 134(5)(e)): IFC = policies and procedures for (1) orderly and efficient conduct of business, (2) safeguarding assets, (3) preventing and detecting frauds and errors, (4) accuracy and completeness of accounting records, (5) timely preparation of reliable financial information; Learn the five limbs as a list. Questions often ask you to define IFC or to name its objectives.
Directors' duty: Section 134(5)(e): Directors of a listed company must state in the Directors' Responsibility Statement that they have laid down IFC and that such controls are adequate and operating effectively; This applies to listed companies. Do not say it applies to every company under this clause.
Auditor's duty: Section 143(3)(i): Auditor's report states whether the company has an adequate IFC system over financial reporting and whether it operated effectively; Reporting is on financial reporting controls. It is an opinion, not a guarantee.
Two tests for the auditor: Adequacy (design) + Operating effectiveness (functioning); Both must be assessed. A control can be adequate in design yet not effective in operation.
Scope of IFC audit: Controls over financial reporting that address the risk of material misstatement in the financial statements; Operational controls with no link to reporting are outside the main scope.
Integrated audit: Financial statement audit + audit of IFC, planned and performed together; Evidence from one supports the other, but two separate opinions are given.
Opinion test: Adequate design + effective operation = unmodified opinion on IFC; A material weakness in design or operation leads to a modified (qualified or adverse) opinion on IFC, depending on the significance of the material weakness.
Deficiency grading: Control deficiency → significant deficiency → material weakness; Material weakness means a reasonable possibility that a material misstatement will not be prevented or detected on time.
Management and auditor roles: Management establishes and assesses controls; auditor expresses an opinion on them; The auditor does not design the controls for the company.
Five COSO components: Control environment + Risk assessment + Control activities + Information & communication + Monitoring; Write all five in order; the control environment is the base and sets the tone.
Entity-level vs process-level: Entity-level = company-wide, often indirect | Process-level = specific process, direct on transactions; Strong entity-level controls do not replace testing process-level controls for significant risks.
Control effectiveness test: Effective IFC = Adequate design AND Operating effectiveness; A well-designed control that is not followed fails; a control followed but badly designed also fails.
RCM columns: Process → Risk → Control objective → Control → Type → Frequency → Owner → Test result; Use this layout to earn presentation marks.
Control classification: Preventive vs Detective | Manual vs Automated vs IT-dependent; Automated controls can often be tested with a small number of instances (often one) if effective IT general controls show the program has not changed during the period.
Control deficiency: Control missing, badly designed, or not operating as designed → misstatement may not be prevented or detected on time; Lowest level. Report to management; it does not by itself change the opinion.
Material weakness: Deficiency (or combination) + reasonable possibility of material misstatement not prevented or detected on a timely basis; Leads to a modified (adverse) opinion on the adequacy of the IFC system and/or its operating effectiveness, depending on whether the weakness lies in design, operation or both.
Significant deficiency: Deficiency less severe than a material weakness but important enough for those charged with governance; Communicate to the audit committee or board. Does not by itself make the opinion adverse.
Severity judgement framework: Severity depends on the likelihood of misstatement and the magnitude of the potential misstatement (a judgement, not a literal multiplication); Judged on potential, not on whether a misstatement actually occurred. Consider compensating controls.
Audit sequence: Plan → Understand flow (walkthrough) → Evaluate design → Test operating effectiveness → Evaluate deficiencies → Report; Use this order as the skeleton of any descriptive answer.
Statutory basis: Section 143(3)(i), Companies Act, 2013; Auditor must report whether adequate IFC over financial reporting exists and operated effectively.
Unmodified opinion: Adequate IFC system + operating effectively at reporting date; No material weakness identified; criteria set by the company consider the essential components of IFC in the Guidance Note.
Adverse opinion: One or more material weaknesses exist; State that the company has not maintained adequate IFC or that controls were not operating effectively. Describe each weakness in the basis paragraph.
Qualified opinion: Material but not pervasive limitation of scope; Use 'except for the possible effects of' wording and describe the limitation in the basis paragraph.
Disclaimer: Unable to obtain sufficient appropriate evidence; possible effect material and pervasive; Auditor does not express an opinion.
Material weakness: Deficiency with reasonable possibility that a material misstatement will not be prevented or detected on a timely basis; Under the Guidance Note, its existence means the company has not maintained adequate IFC, so an adverse opinion is ordinarily given.

Quick revision

IFC are policies and procedures for orderly, efficient conduct of business, safeguarding assets, preventing and detecting fraud and error, accurate and complete records, and timely reliable financial information.
Directors are responsible for establishing and maintaining IFC; the auditor reports on them.
The auditor's opinion covers whether an adequate IFC system over financial reporting exists and whether it operated effectively. Reporting is against criteria established by the company, considering the essential components of internal control in the Guidance Note.
The five components are control environment, risk assessment, control activities, information and communication, and monitoring. They come from the COSO framework, which companies often use; the Guidance Note does not prescribe them as a fixed list.
Design effectiveness asks whether a control, if operated as planned, can meet its objective.
Operating effectiveness asks whether the control actually operated as designed during the period, and by a competent person.
A deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their functions, to prevent or detect misstatements on time, or when a necessary control is missing.
A material weakness is a deficiency, or combination, with a reasonable possibility that a material misstatement will not be prevented or detected on time.
The audit of IFC is carried out together with the audit of the financial statements.
Test of controls uses inquiry, observation, inspection and re-performance; inquiry alone is not enough.
The opinion on IFC may be unmodified, qualified, adverse or a disclaimer. A material weakness generally leads to an adverse opinion, or a qualified opinion if the weakness is material but not pervasive. A mere deficiency does not lead to a modified opinion.
Inherent limitations mean IFC give reasonable, not absolute, assurance.

Common mistakes

Swapping the sections, giving Section 143(3)(i) for directors and Section 134(5)(e) for the auditor. Fix: Link 134 with the Board's report and 143 with the auditor's report. Directors report, auditors audit.
Saying Section 134(5)(e) applies to all companies. Fix: Write that the clause applies to listed companies. Always state the condition with the rule.
Treating internal control and internal financial control as the same thing. Fix: Say internal control is broader, covering operations and compliance too. IFC is a subset tied to financial reporting, asset safeguarding and fraud prevention, as defined in section 134(5)(e) of the Companies Act, 2013.
Saying the IFC audit is a separate audit done after the main audit. Fix: Write that it is integrated: planned and performed together, with two separate opinions.
Putting a bank reconciliation under control environment. Fix: Reconciliations, approvals and segregation of duties are control activities. Control environment is about tone and structure.
Confusing design effectiveness with operating effectiveness. Fix: Design asks if the control could stop the risk on paper. Operating asks if it actually ran correctly and consistently during the period.
Treating a walkthrough as a test of operating effectiveness over the whole year. Fix: Say a walkthrough confirms understanding and design for one transaction; operating effectiveness needs a sample across the period.
Grading a deficiency only on whether a misstatement actually occurred. Fix: Grade on the reasonable possibility and potential magnitude of misstatement, even if none has occurred.
Treating the IFC report as part of the main audit opinion paragraph. Fix: Remember it is a separate annexure to the audit report, referred to under the Report on Other Legal and Regulatory Requirements.
Saying the auditor is responsible for designing and maintaining controls. Fix: Management designs, implements and maintains. The auditor only expresses an opinion.

Exam tips

Write section numbers with the person: directors with 134(5)(e), auditor with 143(3)(i). This earns easy marks.
In theory answers, quote all five limbs of the IFC definition and then add one example for each if marks allow.
For MCQs, watch for options that say 'all companies' for 134(5)(e) or 'guarantee' for the auditor. These are usually wrong.
In case questions, label each weakness as a design gap or an operation failure before you conclude.
Keep answers in short numbered points. Step marks go to clear identification, the section, and the consequence.
Write the Companies Act, 2013 elements of IFC as a short list. Examiners reward complete listing.
For difference questions, give at least four paired points and keep each to one line.
Always state that the auditor gives a separate IFC opinion. Do not merge it with the financial statements opinion.