Corporate Accounting and Auditing · Report on Internal Financial Control over Financial Reporting

Auditor's Report on Internal Financial Controls (IFC Report)

Updated 10 October 2026 · Fact-checked

The auditor's report on internal financial controls is a separate report, issued as an annexure to the audit report, in which the auditor gives an opinion on whether the company has adequate IFC over financial reporting and whether they operated effectively. To answer, state the basis, the opinion type, and the reasons for any modification.

Understand Auditor's Report on Internal Financial Controls

Section 143(3)(i) of the Companies Act, 2013 requires the auditor to state in the audit report whether the company has adequate internal financial controls system over financial reporting and whether such controls were operating effectively. Management is responsible for designing, implementing and maintaining these controls. The auditor is responsible for expressing an opinion on them.

The auditor reports on this in a separate annexure to the main audit report. The annexure follows the ICAI Guidance Note on Audit of Internal Financial Controls Over Financial Reporting. The audit is carried out following that Guidance Note and the applicable Standards on Auditing, to the extent relevant.

The annexure has a fixed flow. It begins with the heading and the report under clause (i) of sub-section 3 of Section 143, which carries the auditor's opinion. Then come management's responsibility, then the auditor's responsibility, then the meaning of internal financial controls over financial reporting, and finally the inherent limitations. The opinion is on whether the company has an adequate IFC system and whether it operated effectively at the balance sheet date.

There are four types of opinion. An unmodified opinion is given where the company has maintained adequate IFC over financial reporting and the controls operated effectively at the reporting date, based on criteria established by the company considering the essential components of internal control stated in the Guidance Note. An adverse opinion is given where one or more material weaknesses exist, so the company has not maintained adequate IFC or the controls were not operating effectively. A qualified opinion is used for a material but not pervasive limitation of scope, where the auditor cannot obtain sufficient appropriate evidence on some area. A disclaimer is used when the auditor cannot obtain sufficient appropriate evidence and the possible effect is both material and pervasive.

A material weakness is a deficiency, or combination of deficiencies, in IFC such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis. The auditor also obtains written representations from management on its responsibility for IFC, its own assessment, and disclosure of significant deficiencies and fraud.

Key rules to remember

Statutory basis: Section 143(3)(i), Companies Act, 2013; Auditor must report whether adequate IFC over financial reporting exists and operated effectively.
Unmodified opinion: Adequate IFC system + operating effectively at reporting date; No material weakness identified; criteria set by the company consider the essential components of IFC in the Guidance Note.
Adverse opinion: One or more material weaknesses exist; State that the company has not maintained adequate IFC or that controls were not operating effectively. Describe each weakness in the basis paragraph.
Qualified opinion: Material but not pervasive limitation of scope; Use 'except for the possible effects of' wording and describe the limitation in the basis paragraph.
Disclaimer: Unable to obtain sufficient appropriate evidence; possible effect material and pervasive; Auditor does not express an opinion.
Material weakness: Deficiency with reasonable possibility that a material misstatement will not be prevented or detected on a timely basis; Under the Guidance Note, its existence means the company has not maintained adequate IFC, so an adverse opinion is ordinarily given.

How to solve Auditor's Report on Internal Financial Controls questions

Use this order for any question asking you to draft, correct or explain the IFC report.

1Identify the facts: which controls failed or could not be tested, and at what level (account, process or entity-wide).
2Decide if the issue is a material weakness or a scope limitation.
3If a material weakness exists, the controls are not effective and an adverse opinion follows.
4If the issue is a scope limitation, judge whether the possible effect is material only, or material and pervasive.
5Select the opinion: unmodified, adverse, qualified or disclaimer.
6Write the opinion paragraph with the correct wording for that type.
7Add a basis paragraph describing the weakness or limitation, and state whether it affected the audit of the financial statements.
8Mention the annexure structure and management representations if the question asks for format.

Quickest way: Weakness or scope limitation decision grid

When to use it: Use this for MCQs and short scenario questions asking for the type of opinion.

Material weakness found and controls not effective: adverse.
Evidence not available, material but limited: qualified.
Evidence not available, material and pervasive: disclaimer.
No material weakness and adequate evidence: unmodified.

Common mistakes in Auditor's Report on Internal Financial Controls

Treating the IFC report as part of the main audit opinion paragraph.
Both are signed by the auditor together.
Fix: Remember it is a separate annexure to the audit report, referred to under the Report on Other Legal and Regulatory Requirements.
Saying the auditor is responsible for designing and maintaining controls.
Students confuse management's and auditor's roles.
Fix: Management designs, implements and maintains. The auditor only expresses an opinion.
Giving a qualified opinion for an isolated material weakness, or an adverse opinion for a limitation of scope.
Students carry over the qualified-versus-adverse logic of the main audit report, and both modifications feel similar.
Fix: Under the Guidance Note, where a material weakness exists the company has not maintained adequate IFC, so the auditor ordinarily gives an adverse opinion. Lack of evidence is a scope issue and leads to a qualified opinion or a disclaimer.
Ignoring the pervasiveness test for scope limitations.
Students stop once they see materiality.
Fix: For a limitation of scope, always ask second: is the possible effect pervasive? That separates qualified from disclaimer.
Claiming the report gives absolute assurance.
The word 'adequate' sounds like a guarantee.
Fix: Mention inherent limitations such as collusion, management override and changes in conditions over time.

Worked examples

Example 1

During the IFC audit of Bharat Textiles Ltd, the auditor finds that the company's controls over inventory valuation at one of its ten plants were not operating effectively, resulting in a material risk of misstatement. All other controls were effective. Which opinion should the auditor give and how should it be worded?

Show the solution

The deficiency is a material weakness because there is a reasonable possibility of material misstatement.
Under the Guidance Note, where a material weakness exists the company has not maintained adequate IFC.
So the auditor ordinarily gives an adverse opinion, even though the weakness is confined to one plant.
The basis paragraph describes the inventory valuation control failure and its possible effect on the financial statements.
The opinion paragraph states that, because of the material weakness described, the company has not maintained adequate IFC over financial reporting that operated effectively at the reporting date.

Answer: Adverse opinion on IFC, with the inventory valuation weakness described in the basis paragraph. The auditor also states whether the weakness affected the opinion on the financial statements.

Example 2

The auditor of Sunrise Pharma Ltd finds that the company has no documented control framework, and key processes of revenue, procurement and payroll have no effective controls. The auditor also notes the weaknesses affect the whole financial reporting system. What opinion and what main paragraph content are required?

Show the solution

Several key processes have no effective controls, so there are material weaknesses.
Material weaknesses exist, so the company has not maintained adequate IFC.
An adverse opinion follows. Here the weaknesses are also widespread, which makes the case stronger.
The basis paragraph lists the weaknesses and notes the effect on the audit of the financial statements, if any.
The opinion states that the company has not maintained adequate IFC, or that controls were not operating effectively, at the reporting date.

Answer: Adverse opinion, with a basis paragraph describing each material weakness, and a statement of whether the weaknesses affected the opinion on the financial statements.

Exam tips

For 14-mark questions, write the annexure in its order: heading and report under Section 143(3)(i) with the opinion, management's responsibility, auditor's responsibility, meaning of IFC over financial reporting, inherent limitations.
In MCQs, read for the words 'material weakness', 'pervasive' and 'unable to obtain evidence'. They decide the opinion.
Write the Section 143(3)(i) reference once, only to link the report to the statute.
When asked for management representations, cover responsibility for IFC, assessment of effectiveness, disclosure of deficiencies and fraud.

Practice questions from Report on Internal Financial Control over Financial Reporting

Auditor's Report on Internal Financial Controls in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Auditor's Report on Internal Financial Controls: frequently asked questions

Where is the IFC report placed?

It is an annexure to the independent auditor's report. The main report cross-refers to it under the report on other legal and regulatory requirements.

What is the difference between qualified and adverse opinion on IFC?

Adverse applies where material weaknesses exist, so the company has not maintained adequate IFC. Qualified is used for a material but not pervasive limitation of scope, where evidence on some area could not be obtained.

When does the auditor disclaim an opinion on IFC?

When the auditor cannot obtain sufficient appropriate evidence and the possible effects could be both material and pervasive.

Do management representations replace audit evidence?

No. Written representations support the audit, but they cannot replace other evidence the auditor needs to gather.