CMA Intermediate · Corporate Accounting and Auditing

Report on Internal Financial Control over Financial Reporting

Internal financial controls are the policies and procedures a company uses to run its business in an orderly way, protect assets, prevent and detect fraud, keep accurate records and prepare reliable financial information on time. The auditor tests design and operating effectiveness, then reports on it in a separate report.

What this chapter covers

This chapter covers how a company's internal financial controls (IFC) are set up, and how the statutory auditor checks them and reports on them. The Companies Act, 2013 places duties on both sides. Directors must lay down and follow controls. The auditor must say whether an adequate IFC system exists over financial reporting and whether it worked effectively.

You study five linked ideas. First the legal duty. Then the professional guidance on how to audit IFC. Then the components of a control system, such as the control environment, risk assessment, control activities, information and communication, and monitoring. These five components come from the COSO framework, which companies often use. The Guidance Note requires the company to set its own criteria, considering the essential components of internal control. Then the auditor's procedures and testing. Last, the format and content of the report, including the types of opinion. The opinion on IFC may be unmodified, qualified, adverse or a disclaimer.

This chapter sits next to the rest of Corporate Accounting and Auditing. It builds on the audit topics on risk, evidence and reporting, and it uses the same ideas of assertions and materiality. It also links to company audit, where the auditor's main report and the IFC report are read together. Treat it as a chapter that is mostly theory, so it suits both the MCQs in Section A and the written theory questions.

This chapter is compact, concept-based and predictable, so it rewards structured revision more than long practice. Many questions ask you to list components, explain design versus operating effectiveness, or describe what the report must contain. These are easy marks if you have clean lists and correct terms. The same ideas also help you answer broader company audit questions. Since MCQs carry no negative marking, precise definitions let you attempt every one with confidence.

Report on Internal Financial Control over Financial Reporting: topics in the order to study them

1Internal Financial Controls under Companies Act 2013Start with the legal duty of directors and auditors, because everything else in the chapter exists to meet it.
2Guidance Note on Audit of Internal Financial ControlsIt explains the professional framework and the approach the auditor must follow, so the later procedures make sense.
3Components and Essential Elements of Internal Financial ControlYou need to know what a good control system contains before you can test it.
4Auditor's Procedures and Testing of ControlsTesting builds on the components: you plan, understand, test design, test operation and evaluate deficiencies.
5Auditor's Report on Internal Financial ControlsStudy the report last, since it is the end result of the procedures and the evaluation of deficiencies.

How to prepare Report on Internal Financial Control over Financial Reporting

Plan for several short sessions rather than one long one. The chapter is mostly recall and application, so repeated retrieval works best.

Read the legal requirement first and write in your own words who is responsible for what: directors for establishing and maintaining controls, the auditor for reporting on them.
Make one-page notes on the Guidance Note: objective, approach, and the idea that the audit of IFC is integrated with the financial statements audit.
Learn the five components as a list, then attach one example of a control to each, such as approval limits under control activities.
Write the audit process as a flow: plan, understand and identify risks, test design, test operating effectiveness, evaluate deficiencies, form opinion.
Learn the structure of the report section by section, and the circumstances that lead to a qualified opinion, an adverse opinion or a disclaimer.
Practise 15 to 20 MCQs on definitions and distinctions, then answer two or three written questions in timed conditions using headings and bullet points.
Revise the distinctions, such as design versus operating effectiveness and deficiency versus material weakness, until you can state them without notes.

Common mistakes in Report on Internal Financial Control over Financial Reporting

Mixing up management's and the auditor's responsibility.
Fix: Write one line each: management designs, implements and maintains; the auditor tests and expresses an opinion.
Treating design and operating effectiveness as the same thing.
Fix: Remember a control can be well designed but not followed, or followed but poorly designed. State both tests separately in answers.
Listing components without explaining them.
Fix: Add a short meaning and one example for each component, which earns the explanation marks.
Relying only on inquiry as audit evidence of controls.
Fix: Combine inquiry with observation, inspection and re-performance, and say so in your answer.
Ignoring the effect of material weaknesses on the opinion.
Fix: Remember that only a material weakness leads to a modified opinion, not a mere deficiency. It generally leads to an adverse opinion, or a qualified opinion if not pervasive. Also note that the auditor considers it for the audit of financial statements.
Claiming that IFC give absolute assurance.
Fix: Always mention inherent limitations such as collusion, management override and human error, and say assurance is reasonable.

Last-day revision: Report on Internal Financial Control over Financial Reporting

IFC are policies and procedures for orderly, efficient conduct of business, safeguarding assets, preventing and detecting fraud and error, accurate and complete records, and timely reliable financial information.
Directors are responsible for establishing and maintaining IFC; the auditor reports on them.
The auditor's opinion covers whether an adequate IFC system over financial reporting exists and whether it operated effectively. Reporting is against criteria established by the company, considering the essential components of internal control in the Guidance Note.
The five components are control environment, risk assessment, control activities, information and communication, and monitoring. They come from the COSO framework, which companies often use; the Guidance Note does not prescribe them as a fixed list.
Design effectiveness asks whether a control, if operated as planned, can meet its objective.
Operating effectiveness asks whether the control actually operated as designed during the period, and by a competent person.
A deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their functions, to prevent or detect misstatements on time, or when a necessary control is missing.
A material weakness is a deficiency, or combination, with a reasonable possibility that a material misstatement will not be prevented or detected on time.
The audit of IFC is carried out together with the audit of the financial statements.
Test of controls uses inquiry, observation, inspection and re-performance; inquiry alone is not enough.
The opinion on IFC may be unmodified, qualified, adverse or a disclaimer. A material weakness generally leads to an adverse opinion, or a qualified opinion if the weakness is material but not pervasive. A mere deficiency does not lead to a modified opinion.
Inherent limitations mean IFC give reasonable, not absolute, assurance.

Report on Internal Financial Control over Financial Reporting practice questions

Report on Internal Financial Control over Financial Reporting in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Report on Internal Financial Control over Financial Reporting: frequently asked questions

What does the auditor report on in the IFC report?

The auditor reports on whether the company has an adequate internal financial controls system over financial reporting and whether those controls were operating effectively. The report is against criteria established by the company, considering the essential components of internal control in the Guidance Note. The five components often cited come from the COSO framework, which companies commonly use.

Is the IFC report part of the main audit report?

It is a separate report, but it is linked to the main audit report, which refers to it. The audit of IFC is carried out along with the audit of the financial statements.

How should I answer a theory question on IFC testing?

Use a clear sequence: planning, understanding controls, testing design, testing operating effectiveness, evaluating deficiencies and forming the opinion. Add the techniques used, such as inquiry, observation, inspection and re-performance.

Which parts of this chapter suit MCQs?

Definitions, the five components, design versus operating effectiveness, deficiency versus material weakness, and the types of opinion (unmodified, qualified, adverse or disclaimer) are common MCQ areas. Learn them as crisp distinctions.