Business Laws and Ethics · Internal Financial Control for Financial Reporting

Directors' and Auditors' Responsibilities for Internal Financial Controls

Updated 10 October 2026 · Fact-checked

Directors must lay down internal financial controls and ensure they are adequate and operating effectively; for listed companies the directors' responsibility statement says so. The audit committee evaluates these controls. The statutory auditor must report under section 143(3)(i) whether the company has adequate internal financial controls with reference to financial statements and whether they operate effectively.

Understand Directors' and Auditors' Responsibilities for IFC

Internal financial controls (IFC) are the policies and procedures a company adopts to run its business in an orderly and efficient way. They cover adherence to company policies, safeguarding of assets, prevention and detection of frauds and errors, accuracy and completeness of accounting records, and timely preparation of reliable financial information. This is the meaning given in the Explanation to section 134 of the Companies Act, 2013.

The responsibility is split. Management and the Board own the controls: they design, implement and maintain them. The auditor does not build controls. The auditor tests them and gives an opinion.

Directors. Under section 134(5)(e), the directors' responsibility statement of a listed company must state that the directors had laid down internal financial controls and that these controls are adequate and were operating effectively. For other companies, the Board's report must still give details on the adequacy of IFC with reference to the financial statements. Do not say the full statement applies to every company.

Audit committee. Section 177 requires certain companies to have an audit committee. Its role includes evaluating the company's internal financial controls and risk management systems, and talking to the auditors about the scope of audit and the adequacy of controls. It acts as a link between the Board, management and the auditor.

Statutory auditor. Section 143(3)(i) says the auditor's report shall also state whether the company has adequate internal financial controls with reference to financial statements in place and the operating effectiveness of such controls. Two tests are therefore needed: adequacy (is the design sound) and operating effectiveness (does it work in practice). If the answer is negative or qualified, section 143(4) requires the report to state the reasons.

Internal control vs IFC. Internal control is wider. It covers all operational, compliance and financial controls. IFC is the part concerned with orderly conduct of business, assets, fraud prevention, records and reliable financial information, and the auditor's report focuses on controls with reference to financial statements.

Key rules to remember

Meaning of IFC (Explanation to section 134): IFC = policies and procedures for orderly and efficient conduct of business + adherence to company policies + safeguarding of assets + prevention and detection of frauds and errors + accuracy and completeness of accounting records + timely preparation of reliable financial information; Learn the six parts as a list. Questions often ask you to define IFC.
Directors' responsibility statement: Section 134(5)(e): directors of a listed company state that they laid down IFC and the IFC are adequate and were operating effectively; The condition 'listed company' is part of the rule.
Auditor's reporting duty: Section 143(3)(i): report whether the company has adequate IFC with reference to financial statements AND the operating effectiveness of such controls; Two limbs: adequacy and operating effectiveness.
Reasons for negative answer: Section 143(4): if any matter in the report is answered in the negative or with a qualification, the report shall state the reasons; A bare 'No' or qualification earns no marks without reasons.
Fraud reporting: Section 143(12): auditor with reason to believe an offence involving fraud is being or has been committed against the company by officers or employees must report as prescribed; Weak IFC findings may lead here. Fraud below the specified amount goes to the audit committee or the Board.

How to solve Directors' and Auditors' Responsibilities for IFC questions

Use this method for any question on who is responsible for IFC and what must be reported.

1Identify the party asked about: directors, audit committee or auditor. Keep the three roles separate.
2State the meaning of IFC in one line, using the six parts from the Explanation to section 134.
3For directors, state the duty to lay down controls and the responsibility statement under section 134(5)(e), noting that it applies to listed companies.
4For the audit committee, state that it evaluates internal financial controls and risk management systems and interacts with the auditor.
5For the auditor, quote the two limbs of section 143(3)(i): adequacy and operating effectiveness, with reference to financial statements.
6Apply to the facts: decide if controls are inadequate, or adequate but not working, and say how the report changes.
7Add section 143(4): give reasons for any negative or qualified answer. Add section 143(12) if fraud is suspected.
8Close with a one-line conclusion naming who is responsible and what the report must say.

Quickest way: Three-role grid: Design, Evaluate, Report

When to use it: Use for short notes, MCQs and the opening of a descriptive answer when time is tight.

Write three words: Directors = design and state; Audit committee = evaluate; Auditor = test and report.
Under Directors note section 134(5)(e), listed companies, adequate and operating effectively.
Under Auditor note section 143(3)(i): adequacy plus operating effectiveness.
Add one line: reasons are needed if negative or qualified (section 143(4)).
In MCQs, reject any option saying the auditor designs or implements the controls.

Common mistakes in Directors' and Auditors' Responsibilities for IFC

Saying the auditor is responsible for designing and maintaining IFC.
Students link 'controls' with 'auditor' because the auditor reports on them.
Fix: Remember that management and the Board own the controls. The auditor only tests and reports on them.
Writing only 'adequacy' and forgetting 'operating effectiveness' in the auditor's duty.
Students recall the first part of section 143(3)(i) and stop.
Fix: Always write both limbs. Adequacy is about design, operating effectiveness is about working in practice.
Stating that the directors' responsibility statement on IFC applies to every company.
Students drop the condition while memorising.
Fix: Say that section 134(5)(e) covers listed companies. Other companies still give details on adequacy of IFC in the Board's report.
Treating internal control and IFC as the same thing.
Both phrases sound alike.
Fix: Internal control is wider and includes operational and compliance controls. IFC is tied to orderly business conduct, assets, fraud prevention, records and reliable financial information, and the report is with reference to financial statements.
Giving a qualified IFC opinion without reasons.
Students focus on the conclusion, not on section 143(4).
Fix: State the control weakness, the area affected and its effect, because the law requires reasons.
Ignoring the audit committee in a question about responsibilities.
Students think only of directors and auditor.
Fix: Add one line that the audit committee evaluates IFC and risk management systems and discusses with the auditor.

Worked examples

Example 1

Explain the duty of a statutory auditor to report on internal financial controls under section 143(3)(i) of the Companies Act, 2013. What must the auditor do if the controls are found inadequate?

Show the solution

Source of duty: section 143(3) lists matters the auditor's report shall also state. Clause (i) covers internal financial controls.
Content of the duty: the auditor must state whether the company has adequate internal financial controls with reference to financial statements in place and the operating effectiveness of such controls.
Two limbs: adequacy means the design is suitable for the size and nature of the business. Operating effectiveness means the controls actually worked as designed.
If controls are inadequate: the answer to the matter is negative or qualified, so section 143(4) applies and the report must state the reasons.
Further point: if the weakness points to fraud by officers or employees, the auditor considers the reporting duty under section 143(12).
The auditor does not design the controls. That remains the responsibility of the Board and management.

Answer: The auditor must report on both the adequacy and the operating effectiveness of IFC with reference to financial statements. If controls are inadequate, the report must give the reasons for the negative or qualified answer under section 143(4).

Example 2

Sundaram Textiles Ltd, a listed company, has a control that requires every purchase invoice to be matched with a goods receipt note before booking. The matching exists in the policy manual, but during the year the accounts team skipped it for most invoices of a large supplier. The directors' responsibility statement says that IFC are adequate and were operating effectively. Comment on the position of the directors and the auditor.

Show the solution

Design check: the matching control is in the policy manual, so the design may be adequate.
Operation check: the team skipped the control for most invoices of a large supplier, so it did not work in practice. Operating effectiveness fails.
Directors: section 134(5)(e) requires a listed company's directors to state that IFC are adequate and were operating effectively. The statement is therefore not supported by the facts.
Audit committee: it should evaluate the control weakness and discuss it with the auditor and management, and push for corrective action.
Auditor: under section 143(3)(i) the auditor must report on operating effectiveness. As the control failed, the answer is negative or qualified.
Reasons: section 143(4) requires the auditor to explain the failure, the area affected (purchases and payables) and its effect on financial reporting.
Fraud check: if the auditor has reason to believe fraud has been committed, section 143(12) applies.

Answer: The control is adequate in design but not operating effectively. The directors' statement is incorrect, and the auditor must report this under section 143(3)(i), with reasons under section 143(4).

Exam tips

Write both limbs of section 143(3)(i) every time: adequacy and operating effectiveness, with reference to financial statements.
Keep the three roles in separate lines: directors lay down and state, the audit committee evaluates, the auditor tests and reports.
Mention 'listed company' when you cite the directors' responsibility statement under section 134(5)(e).
In MCQs, watch for options that make the auditor responsible for designing controls. These are wrong.
For a scenario question, test design and operation separately, then link to section 143(4) for reasons.

Practice questions from Internal Financial Control for Financial Reporting

Directors' and Auditors' Responsibilities for IFC in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Directors' and Auditors' Responsibilities for IFC: frequently asked questions

What does section 143(3)(i) require the auditor to report?

The auditor must state whether the company has adequate internal financial controls with reference to financial statements in place, and the operating effectiveness of such controls. Both adequacy and operating effectiveness must be covered.

Who is responsible for internal financial controls, directors or auditors?

The Board and management are responsible for laying down and maintaining the controls. The auditor is responsible for testing them and reporting on their adequacy and operating effectiveness.

What is the audit committee's role in internal financial control?

The audit committee evaluates the company's internal financial controls and risk management systems. It also discusses the audit scope and control matters with the auditor and acts as a link with the Board.

What is the difference between internal control and internal financial control?

Internal control is the wider system covering operational, compliance and financial areas. IFC is the part concerned with orderly conduct of business, safeguarding assets, preventing fraud and errors, accurate records and reliable financial information, and the auditor's report looks at it with reference to financial statements.