Corporate Accounting and Auditing · Report on Internal Financial Control over Financial Reporting

Guidance Note on Audit of Internal Financial Controls

Updated 10 October 2026 · Fact-checked

The ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting (ICFR) tells auditors how to audit and report on a company's financial-reporting controls. The audit is carried out together with the financial statement audit, as an integrated audit, and ends in a separate opinion on whether adequate controls exist and operate effectively.

Understand Guidance Note on Audit of Internal Financial Controls

Internal control is the wide set of policies and procedures a company uses to run its business. It covers operations, compliance and reporting. Internal financial controls (IFC) are a subset of internal control, tied to financial reporting. Section 134(5)(e) of the Companies Act, 2013 (the directors' responsibility statement) defines them as the policies and procedures adopted by the company for orderly and efficient conduct of its business, including adherence to company policies, safeguarding of assets, prevention and detection of fraud and error, accuracy and completeness of accounting records, and timely preparation of reliable financial information.

The auditor of a company must report under section 143(3)(i) on whether the company has an adequate internal financial controls system with reference to financial statements, and whether it operated effectively. The Guidance Note gives the method. It is issued by ICAI, not ICMAI, and is recommendatory in nature. It is not a Standard on Auditing, but auditors should follow it as the accepted professional approach.

The Guidance Note focuses on controls over financial reporting. These are the controls that reduce the risk of material misstatement in the financial statements. Examples are authorisation of journals, bank reconciliations, segregation of duties, and access controls in the accounting software.

The key idea is the integrated audit. You do not run two separate audits. The same understanding of the business, risk assessment and testing serve both purposes. Controls testing done for the IFC opinion also supports the reliance placed on controls in the financial statement audit. In turn, misstatements found in the financial statement audit can show that a control is weak.

The result is a separate report on IFC, given as an annexure to the audit report. It is an opinion on the company's controls, and is not a guarantee against all errors or fraud.

Key rules to remember

Scope of IFC audit: Controls over financial reporting that address the risk of material misstatement in the financial statements; Operational controls with no link to reporting are outside the main scope.
Integrated audit: Financial statement audit + audit of IFC, planned and performed together; Evidence from one supports the other, but two separate opinions are given.
Opinion test: Adequate design + effective operation = unmodified opinion on IFC; A material weakness in design or operation leads to a modified (qualified or adverse) opinion on IFC, depending on the significance of the material weakness.
Deficiency grading: Control deficiency → significant deficiency → material weakness; Material weakness means a reasonable possibility that a material misstatement will not be prevented or detected on time.
Management and auditor roles: Management establishes and assesses controls; auditor expresses an opinion on them; The auditor does not design the controls for the company.

How to solve Guidance Note on Audit of Internal Financial Controls questions

Use this method for any question on the IFC audit approach, the difference between controls, or integration with the financial statement audit.

1Read the question and identify what is asked: definition, scope, approach, or report effect.
2State the relevant concept briefly, for example IFC as defined in section 134(5)(e) of the Companies Act, 2013 and the Guidance Note.
3If asked for a difference, set out the points side by side in two columns or paired bullets: purpose, coverage, responsibility, reporting.
4Link the point to the integrated audit: say how the same evidence serves both the controls opinion and the financial statements opinion.
5For a case, classify any deficiency as a control deficiency, significant deficiency or material weakness, giving the reason.
6Conclude with the effect on the report: unmodified or modified opinion on IFC, and whether the financial statements opinion is affected.

Quickest way: Three-line IFC answer

When to use it: Short-answer and MCQ questions with little time.

Name the scope: controls over financial reporting.
Name the approach: integrated, risk-based, test design and operating effectiveness.
Name the output: separate IFC opinion in an annexure to the audit report.

Common mistakes in Guidance Note on Audit of Internal Financial Controls

Treating internal control and internal financial control as the same thing.
The two terms sound alike and overlap.
Fix: Say internal control is broader, covering operations and compliance too. IFC is a subset tied to financial reporting, asset safeguarding and fraud prevention, as defined in section 134(5)(e) of the Companies Act, 2013.
Saying the IFC audit is a separate audit done after the main audit.
Students see two opinions and assume two audits.
Fix: Write that it is integrated: planned and performed together, with two separate opinions.
Stating the auditor designs or implements controls.
Confusion with consulting roles.
Fix: Management is responsible for establishing and maintaining controls. The auditor only tests and reports.
Testing only design, not operating effectiveness.
A well-written policy looks sufficient.
Fix: Always cover both: a control must be suitably designed and must have operated through the period.
Claiming a good IFC opinion means no misstatement can exist.
Overstating what the opinion gives.
Fix: Mention inherent limitations: collusion, management override and human error.

Worked examples

Example 1

Distinguish between internal control and internal financial control. Explain briefly how the IFC audit is integrated with the financial statement audit.

Show the solution

Internal control: all policies and procedures a company uses for operations, compliance and reporting objectives.
Internal financial controls: policies and procedures for orderly conduct of business, safeguarding assets, preventing and detecting fraud and error, accuracy and completeness of records, and timely reliable financial information, as defined in section 134(5)(e) of the Companies Act, 2013.
Difference: internal control is wider in business coverage. IFC is a subset focused on financial reporting and related asset protection, and the auditor must report on it under section 143(3)(i).
Integration: the auditor plans both together and uses one risk assessment.
Controls tested for the IFC opinion support the reliance on controls in the financial statement audit. Misstatements found in the financial statement audit are considered when judging control deficiencies.
Two opinions are given: one on the financial statements and one on IFC in an annexure.

Answer: Internal control is the broad system covering all objectives. IFC is the subset tied to financial reporting and asset safeguarding. The IFC audit is done with the financial statement audit, sharing risk assessment and evidence, but a separate opinion is issued.

Example 2

During the audit of Kaveri Textiles Ltd, the auditor finds that bank reconciliations were prepared by the cashier who also records receipts. No one reviewed them for the whole year. Several unreconciled differences are material. How should the auditor respond?

Show the solution

Identify the control: bank reconciliation, a key financial reporting control.
Identify the failure: no segregation of duties and no review, so the control did not operate effectively.
Assess severity: material unreconciled differences show a reasonable possibility that a material misstatement was not prevented or detected. This is a material weakness unless compensating controls exist.
Look for compensating controls, such as independent review elsewhere. Assume none are found.
Effect on IFC report: a modified (qualified or adverse) opinion on IFC, depending on the significance of the material weakness, with the weakness described.
Effect on the financial statement audit: perform extended substantive procedures on cash and bank balances and consider the effect on that opinion.

Answer: The deficiency is a material weakness. The IFC opinion is modified (qualified or adverse, depending on how significant the weakness is), and the auditor widens substantive testing of cash and bank in the financial statement audit.

Exam tips

Write the Companies Act, 2013 elements of IFC as a short list. Examiners reward complete listing.
For difference questions, give at least four paired points and keep each to one line.
Always state that the auditor gives a separate IFC opinion. Do not merge it with the financial statements opinion.
In MCQs, watch for options that say the auditor is responsible for designing controls. Those are wrong.
Use the terms control deficiency, significant deficiency and material weakness in case answers.

Practice questions from Report on Internal Financial Control over Financial Reporting

Guidance Note on Audit of Internal Financial Controls in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Guidance Note on Audit of Internal Financial Controls: frequently asked questions

Is the Guidance Note on IFC audit mandatory?

It is issued by ICAI, not ICMAI, and is recommendatory in nature. It is not a Standard on Auditing. Auditors should follow it as the accepted professional approach when reporting on IFC. For the exam, treat it as the accepted method.

What is the difference between internal control and internal financial control?

Internal control covers all business objectives, including operations and compliance. Internal financial control is a subset focused on financial reporting, protection of assets and prevention of fraud and error. It is defined in section 134(5)(e), and the auditor reports on it under section 143(3)(i) of the Companies Act, 2013.

What does integrated audit mean?

It means the audit of IFC and the audit of financial statements are planned and performed together. Evidence from each helps the other. Two separate opinions are still given.

Where does the auditor report on IFC?

In a separate annexure to the independent auditor's report. It gives an opinion on whether adequate IFC exists and operated effectively.