Auditing and Ethics · Risk Assessment and Internal Control

Internal Financial Controls (IFC) and Walkthrough Tests

Updated 4 October 2026 · Fact-checked

Internal financial controls are the policies and procedures a company uses to run its business in an orderly way, protect assets, prevent and detect fraud, keep accurate records and prepare reliable financial information. The auditor reports on their adequacy and operating effectiveness. A walkthrough traces one transaction end to end to confirm your understanding of a process.

Understand Internal Financial Controls (IFC) and Walkthrough Tests

Internal financial controls (IFC) are the policies and procedures a company adopts for orderly and efficient conduct of its business. They cover adherence to company policies, safeguarding of assets, prevention and detection of frauds and errors, accuracy and completeness of accounting records, and timely preparation of reliable financial information. This is the wording of the Companies Act, 2013 definition in the Explanation to Section 134(5)(e).

The duties sit on different people. Under Section 134(5)(e), the directors of a listed company must lay down IFC and ensure they are adequate and operating effectively. The Board's report of every company must state the details of the adequacy of IFC with reference to the financial statements (Section 134(3)(q) read with Rule 8(5)(viii) of the Companies (Accounts) Rules, 2014). The auditor, under Section 143(3)(i), must state in the report whether the company has adequate internal financial controls with reference to financial statements in place and whether they are operating effectively. This auditor duty applies to all companies, subject to exemptions. The auditor does not design controls. The auditor reports on them.

The auditor gives this IFC report in a separate Annexure to the auditor's report. It is not part of the opinion on the financial statements in the main report.

Two words matter in the report: adequacy and operating effectiveness. Adequacy asks: is the control appropriately designed and in place (implemented) to stop or catch a misstatement? Operating effectiveness asks: did the control actually work as designed through the period? A well-designed control that staff skip is adequate but not effective. The auditor also looks at controls over financial reporting, not every operational control.

The ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting guides how to do this audit. It follows the idea that the auditor understands the controls, assesses the risk of material weakness, tests design and operation, and then forms an opinion. A material weakness is a deficiency, or a combination of deficiencies, such that there is a reasonable possibility that a material misstatement will not be prevented or detected on time.

A walkthrough test is one tool in this work. You pick one transaction, for example a sales invoice, and follow it through the whole process from origin to recording in the books. You inquire, observe and inspect documents at each step. It confirms that you understand the process and that the controls are in place. It is not enough on its own to prove controls operate effectively. For that you need tests of controls on a sample over the period. Substantive procedures are different: they test the amounts and disclosures in the financial statements directly.

Key rules to remember

Auditor's duty on IFC: Section 143(3)(i): report whether adequate IFC with reference to financial statements exist AND whether they operate effectively; Both limbs must appear in your answer: adequacy and operating effectiveness. The duty applies to all companies, subject to exemptions. The report is given in a separate Annexure to the auditor's report.
Directors' responsibility: Section 134(5)(e): directors of a listed company lay down IFC and ensure they are adequate and operating effectively. Section 134(3)(q) read with Rule 8(5)(viii) of the Companies (Accounts) Rules, 2014: the Board's report of every company states the adequacy of IFC; Responsibility for IFC is management's. The auditor only reports.
Tests of controls vs substantive procedures: Tests of controls → whether controls operated effectively. Substantive procedures → whether amounts and disclosures are misstated (tests of details + substantive analytical procedures); Results of tests of controls decide how much substantive testing you need.
Walkthrough: Walkthrough = trace one transaction end to end using inquiry, observation and inspection; Confirms understanding and design. It does not alone prove operating effectiveness.

How to solve Internal Financial Controls (IFC) and Walkthrough Tests questions

Use this order for any question on IFC reporting, walkthroughs or control testing.

1Identify what is asked: the duty (director or auditor), the report, a walkthrough, or the test type.
2State the legal or standard basis in plain words: Section 143(3)(i) for the auditor, Section 134(5)(e) and Section 134(3)(q) read with Rule 8(5)(viii) for directors, and the ICAI Guidance Note for the method.
3Separate adequacy (controls appropriately designed and in place to address the risk of misstatement) from operating effectiveness (working as designed through the period).
4Link the procedure to the control objective: understand the process, identify risks of misstatement, identify the controls that address them.
5Name the procedure: walkthrough for understanding and design, tests of controls for operation, substantive procedures for amounts.
6Apply it to the facts: name the transaction, the documents, and the control being checked.
7Conclude: control effective or deficient, effect on substantive procedures, and effect on the report or opinion.

Quickest way: Four-line answer for IFC and walkthrough questions

When to use it: Use it for short written answers and for eliminating options in MCQs.

MCQ: if an option says the auditor designs or implements IFC, reject it. Management does that.
MCQ: if an option says a walkthrough alone proves controls worked all year, reject it.
MCQ: tests of controls check control operation. Substantive procedures check balances and transactions. Match the option to this split.
Written: write Law, Meaning, Application, Conclusion in four short blocks. Use the key words adequacy, operating effectiveness and material weakness. Each correct point earns a step mark.

Common mistakes in Internal Financial Controls (IFC) and Walkthrough Tests

Saying the auditor is responsible for designing and maintaining IFC.
Students mix the auditor's reporting duty with the management's duty.
Fix: Write: directors of a listed company lay down and maintain IFC (Section 134(5)(e)), and the Board's report of every company covers the adequacy of IFC (Rule 8(5)(viii)); the auditor evaluates and reports under Section 143(3)(i).
Writing only about adequacy and forgetting operating effectiveness.
Adequacy sounds like the whole question.
Fix: Always give both limbs, and explain the difference with a one-line example.
Treating a walkthrough as a full test of controls.
It involves following a transaction, so it feels like testing.
Fix: Say a walkthrough confirms understanding and design using one transaction. Operating effectiveness needs a sample over the period.
Confusing tests of controls with substantive procedures.
Both involve looking at documents.
Fix: Ask what you are checking. If it is whether a control worked, it is a test of controls. If it is whether an amount is right, it is substantive.
Assuming that effective controls remove the need for substantive procedures.
Students think good controls mean no misstatement.
Fix: Effective controls reduce the extent of substantive work. They do not remove it for material balances. Controls also have inherent limitations.
Ignoring material weakness in the answer on reporting, or treating the IFC opinion as part of the main opinion on the financial statements.
Students only describe the clean report and forget that the IFC report is a separate Annexure to the auditor's report.
Fix: Say that the IFC opinion is given in a separate Annexure to the auditor's report. If one or more material weaknesses exist, the auditor expresses an adverse opinion on the company's IFC over financial reporting as at the balance sheet date. Before concluding, the auditor considers whether compensating controls reduce the effect of a deficiency so that it is not a material weakness. Where there is a scope limitation, the auditor qualifies the opinion or disclaims it, as the Guidance Note requires. A deficiency that is not a material weakness does not lead to an adverse opinion. The effect of any material weakness on the audit of the financial statements is considered separately.

Worked examples

Example 1

Explain the auditor's responsibility regarding internal financial controls under the Companies Act, 2013. How does it differ from the directors' responsibility?

Show the solution

Basis: Section 143(3)(i) requires the auditor's report to state whether the company has adequate internal financial controls with reference to financial statements in place and whether such controls are operating effectively. This applies to all companies, subject to exemptions. The report on IFC is given in a separate Annexure to the auditor's report.
Meaning of adequacy: the controls are appropriately designed and in place (implemented) to address the risk of material misstatement in financial reporting.
Meaning of operating effectiveness: the controls actually worked as designed during the period.
Method: the auditor follows the ICAI Guidance Note. This means understanding the controls, assessing the risk of material weakness, testing design and operation, and forming an opinion.
Contrast: the directors of a listed company must lay down IFC and ensure they are adequate and operating effectively (Section 134(5)(e)). The Board's report of every company must state the adequacy of IFC (Section 134(3)(q) read with Rule 8(5)(viii) of the Companies (Accounts) Rules, 2014). Management owns the controls.
Conclusion: the auditor does not design or maintain controls. The auditor evaluates them and reports.

Answer: The auditor reports on both the adequacy and the operating effectiveness of IFC over financial reporting under Section 143(3)(i), in a separate Annexure to the auditor's report. Directors of a listed company are responsible for laying down and maintaining the controls.

Example 2

During the audit of a trading company, you trace one sales invoice from the customer order to dispatch, invoicing, ledger posting and receipt of cash. Then you select 40 invoices across the year and check approval and matching with dispatch records. Identify each procedure and explain its purpose.

Show the solution

Step 1 is a walkthrough. You follow a single transaction through the entire process.
Purpose of the walkthrough: confirm your understanding of the sales process, identify where risks of misstatement arise, and confirm that the controls identified exist and are designed to address them.
Step 2 is a test of controls. You check a sample of 40 invoices over the period for approval and matching with dispatch records.
Purpose of the test of controls: obtain evidence that the control operated effectively through the year, not just on one transaction.
Link to the audit: if the test shows the control worked, you can reduce the extent of substantive procedures on sales and receivables. If exceptions arise, you increase substantive work and consider whether there is a deficiency in IFC.
Note that neither step directly tests whether the sales figure is correct. That is the job of substantive procedures, such as tests of details and analytical procedures.

Answer: The first procedure is a walkthrough that confirms understanding and design. The second is a test of controls that checks operating effectiveness over the period. Substantive procedures still follow for sales and receivables.

Exam tips

Write both words every time: adequacy and operating effectiveness. Examiners look for them.
Quote Section 143(3)(i) for the auditor and Section 134(5)(e) for directors of listed companies. Use section numbers only for these provisions.
For differentiation questions, use a two-column mindset: purpose, timing, sample size, what it proves.
Use a short example in the answer, such as a sales invoice or a purchase order, to show application.
In MCQs, look for absolute words like only, always and alone. Walkthrough and control statements with these are usually wrong.

Practice questions from Risk Assessment and Internal Control

Internal Financial Controls (IFC) and Walkthrough Tests in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Financial Controls (IFC) and Walkthrough Tests: frequently asked questions

What does Section 143(3)(i) require from the auditor?

It requires the auditor's report to state whether the company has adequate internal financial controls with reference to financial statements in place and whether those controls are operating effectively. The report is on controls over financial reporting and is given in a separate Annexure. It is not an opinion on every business control.

What is a walkthrough test in auditing?

A walkthrough is tracing one transaction from start to finish through the entity's process. You use inquiry, observation and inspection of documents. It helps you understand the process and confirm that the controls exist and are designed properly.

Is a walkthrough the same as a test of controls?

No. A walkthrough usually covers one transaction and mainly confirms understanding and design. A test of controls uses a sample over the period to judge whether the control operated effectively.

What is the difference between tests of controls and substantive procedures?

Tests of controls check whether a control operated effectively. Substantive procedures check whether the amounts and disclosures in the financial statements are materially misstated. They consist of tests of details and substantive analytical procedures.

Which ICAI guidance applies to the auditor's report on IFC?

The ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting guides the auditor. It covers planning, understanding controls, testing, evaluating deficiencies and forming the report on IFC.