Cost and Management Audit · Internal Control and Internal Audit

Internal Financial Controls under Companies Act 2013

Updated 11 October 2026 · Fact-checked

Internal financial controls (IFC) are the policies and procedures a company uses to run its business in an orderly way, protect assets, prevent and detect fraud, keep accurate records and prepare reliable financial information. The auditor must report under Section 143(3)(i) whether adequate IFC with reference to financial statements exist and operate effectively.

Understand Internal Financial Controls under Companies Act 2013

Start with the idea. A company has many controls: approval limits, bank reconciliations, segregation of duties, stock counts. The Companies Act, 2013 asks two groups to take a formal view on them. Management must build and run the controls. The auditor must say whether they are adequate and working.

The auditor's duty sits in Section 143(3)(i). The audit report must state whether the company has adequate internal financial controls with reference to financial statements in place and the operating effectiveness of such controls. These are two tests. Adequacy asks whether the design is sufficient. Operating effectiveness asks whether the controls actually worked. A well-designed control that nobody follows fails the second test.

The scope is narrower than all internal control. The Act's wording is IFC *with reference to financial statements*. So the focus is controls that affect reliable financial reporting. Operational controls matter only where they affect the financial statements. The words were substituted for the older "internal financial controls system" by the 2018 amendment.

You must also know the link to other duties. Under Section 143(4), if any matter required in the report is answered in the negative or with a qualification, the report must state the reasons. So an adverse IFC conclusion must be explained, not just stated. Under Section 143(14), Section 143 applies with necessary changes to a cost accountant conducting cost audit under Section 148. That is why this topic matters in a cost and management audit paper.

For the directors' side and CARO, the Act text supplied here does not cover them. State these in general terms. The Board's report carries a directors' responsibility statement, and it covers internal financial controls for listed companies. The Companies (Auditor's Report) Order, CARO, is a separate report on prescribed matters, including internal audit system and certain control-related points for specified companies. Keep these separate from the Section 143(3)(i) opinion. They are different reports with different purposes.

Key rules to remember

Auditor's IFC reporting duty: Section 143(3)(i): report whether the company has adequate internal financial controls with reference to financial statements in place AND their operating effectiveness; Two tests: adequacy (design) and operating effectiveness (working in practice). Quote both.
Reasons for negative answers: Section 143(4): any matter answered in the negative or with a qualification must be reported with reasons; An adverse or qualified IFC conclusion needs stated reasons.
Auditor's right of access and information: Section 143(1): right of access at all times to books of account and vouchers, and to require information and explanations from officers; This is the basis for testing controls and getting evidence.
Auditing standards: Section 143(9): every auditor shall comply with the auditing standards; IFC audit is done under the standards and guidance applicable to the auditor.
Application to cost auditor: Section 143(14)(a): Section 143 applies mutatis mutandis to a cost accountant conducting cost audit under Section 148; Link to quote when asked how the IFC duty relates to cost audit.
Holding company auditor's access: Proviso to Section 143(1): holding company auditor has right of access to records of subsidiaries and associate companies as it relates to consolidation; Relevant when consolidated financial statements are audited.
Fraud reporting: Section 143(12): auditor with reason to believe an offence involving fraud is being or has been committed against the company by officers or employees must report as prescribed; Control weaknesses may lead to this. Below the specified amount, report to the audit committee or Board.

How to solve Internal Financial Controls under Companies Act 2013 questions

Use this order for any question on internal financial controls, whether theory or case-based.

1Identify who the question is about: management or directors, the statutory auditor, or the cost auditor. The duty differs for each.
2Name the source rule. For the auditor, cite Section 143(3)(i) and state both tests, adequacy and operating effectiveness.
3Define the scope: controls with reference to financial statements, covering orderly conduct of business, safeguarding assets, preventing and detecting fraud, accuracy and completeness of records, and timely reliable financial information.
4Apply the facts of the case. Decide whether the issue is a design gap (adequacy) or a failure in operation (effectiveness).
5Link the conclusion to Section 143(4): if the answer is negative or qualified, give reasons in the report.
6Check for fraud indicators. If there is reason to believe fraud, apply Section 143(12) and the reporting route.
7Close with a clear recommendation or opinion in one or two lines, and keep CARO or the directors' statement separate from the Section 143(3)(i) opinion.

Quickest way: Adequacy versus effectiveness in 60 seconds

When to use it: Use for MCQs and short case questions asking what the auditor should report on controls.

Ask: is the control missing or badly designed? That is an adequacy failure.
Ask: does the control exist but was not followed in the period? That is an operating effectiveness failure.
Match to Section 143(3)(i) wording and write both terms.
If negative or qualified, add that reasons must be stated under Section 143(4).
Reject options that say the auditor certifies all internal controls, or that the duty covers only operational controls.

Common mistakes in Internal Financial Controls under Companies Act 2013

Saying the auditor reports on all internal controls of the company.
Students mix internal control in general with the narrower statutory wording.
Fix: Write the exact scope: internal financial controls with reference to financial statements.
Mentioning adequacy but forgetting operating effectiveness.
Students remember only the first half of the clause.
Fix: Always write both tests together. Adequacy is design. Operating effectiveness is working in practice.
Treating the Section 143(3)(i) opinion and the CARO report as the same thing.
Both mention controls, so they look alike.
Fix: Keep them separate. Section 143(3)(i) is an opinion on IFC. CARO is a report on prescribed matters under a separate order.
Giving a qualified IFC conclusion without reasons.
Students focus on the conclusion and skip the reporting rule.
Fix: Cite Section 143(4) and state the reasons for the negative or qualified answer.
Quoting a section number for the directors' statement or CARO paragraph without being sure.
Students guess numbers to look precise.
Fix: Quote only sections you are sure of. Describe the rule in words if unsure.
Ignoring Section 143(12) when a control failure suggests fraud.
Students treat control failure as only a reporting matter.
Fix: Check for fraud indicators and state the reporting route to the Central Government, audit committee or Board as prescribed.

Worked examples

Example 1

During the audit of Bharat Components Ltd, the auditor finds that the company has a written policy requiring a bank reconciliation every month. Testing shows reconciliations were not prepared for five of the twelve months, and unreconciled differences remain open. What is the issue under Section 143(3)(i), and how should it be reported?

Show the solution

Identify the duty: Section 143(3)(i) requires the auditor to report on adequate IFC with reference to financial statements and the operating effectiveness of such controls.
Test design: a written monthly reconciliation policy exists, so design looks adequate on this point.
Test operation: reconciliations were missed in five of twelve months, so the control did not operate effectively during the period.
Assess impact: unreconciled differences affect the reliability of cash balances in the financial statements, so this is relevant to financial reporting.
Reporting: the answer on operating effectiveness is negative or qualified, so under Section 143(4) the report must state the reasons.
Consider fraud: if the differences indicate misappropriation by officers or employees, Section 143(12) applies.

Answer: The control is adequately designed but not operating effectively. The auditor should report this weakness in the IFC opinion and state the reasons, as required by Section 143(4).

Example 2

A student writes that a cost auditor appointed under Section 148 has no obligation relating to Section 143 duties. Evaluate this statement using the Act.

Show the solution

Recall Section 143(14)(a): the provisions of Section 143 apply mutatis mutandis to the cost accountant conducting cost audit under Section 148.
Mutatis mutandis means with the necessary changes. The cost auditor's duties follow Section 143 as adapted to the cost audit.
Therefore the cost auditor has access rights under Section 143(1), must comply with auditing standards under Section 143(9), and has the fraud reporting duty under Section 143(12).
Failure to comply with Section 143(12) attracts a penalty under Section 143(15): five lakh rupees for a listed company and one lakh rupees for any other company.
Conclude that the statement is incorrect.

Answer: The statement is incorrect. Section 143(14)(a) applies Section 143 with necessary changes to the cost accountant conducting cost audit. This includes the fraud reporting duty, and Section 143(15) imposes penalties of ₹5,00,000 for a listed company and ₹1,00,000 for any other company for non-compliance with Section 143(12).

Exam tips

Write the phrase 'with reference to financial statements' in every theory answer on IFC. Examiners look for it.
Always give both tests: adequacy and operating effectiveness. Marks are lost when only one appears.
In case scenarios, label each fact as a design gap or an operating failure before you conclude.
Cite Section 143(3)(i), 143(4), 143(12) and 143(14) where relevant. Avoid section numbers you are not sure of.
Section A MCQs often test wording. Eliminate options that overstate the scope, such as all controls or a guarantee against fraud.

Practice questions from Internal Control and Internal Audit

Internal Financial Controls under Companies Act 2013 in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Financial Controls under Companies Act 2013: frequently asked questions

What does Section 143(3)(i) require the auditor to report?

The auditor must state whether the company has adequate internal financial controls with reference to financial statements in place and whether those controls operate effectively. Both adequacy and operating effectiveness must be addressed.

Is IFC reporting the same as CARO reporting?

No. Section 143(3)(i) is the auditor's opinion on internal financial controls with reference to financial statements. CARO is a separate order requiring a report on prescribed matters for specified companies. Answer them separately.

What if the auditor gives a negative answer on IFC?

Under Section 143(4), where any matter required to be in the report is answered in the negative or with a qualification, the report must state the reasons. A bare adverse conclusion is not enough.

Does Section 143 apply to a cost auditor?

Yes. Section 143(14)(a) applies the section mutatis mutandis to a cost accountant conducting cost audit under Section 148. The cost auditor's access rights and fraud reporting duty follow it with the necessary changes.