Corporate Accounting and Auditing · Report on Internal Financial Control over Financial Reporting

Internal Financial Controls under Companies Act 2013

Updated 10 October 2026 · Fact-checked

Internal financial controls (IFC) are the policies and procedures a company uses to run its business in an orderly way, protect assets, prevent and detect fraud, keep accurate records and prepare reliable financial information on time. Directors state they have laid down and followed IFC under Section 134(5)(e). The auditor reports on their adequacy and operating effectiveness under Section 143(3)(i).

Understand Internal Financial Controls under Companies Act 2013

An internal financial control is a safeguard built into a company's day-to-day working. Think of approval limits on payments, bank reconciliations, segregation of duties between the person who orders goods and the person who pays for them, and access rights in the accounting software. Together they help the company produce financial statements you can trust.

The Companies Act, 2013 gives IFC a legal meaning. The explanation to Section 134(5)(e) says IFC means the policies and procedures adopted by the company for ensuring: the orderly and efficient conduct of its business, including adherence to company policies; the safeguarding of its assets; the prevention and detection of frauds and errors; the accuracy and completeness of the accounting records; and the timely preparation of reliable financial information.

The Act places duties on two groups. Directors of listed companies must state in the Directors' Responsibility Statement that they have laid down internal financial controls and that those controls are adequate and operating effectively (Section 134(5)(e)). Auditors of companies must state in their report whether the company has an adequate internal financial controls system over financial reporting and whether it operated effectively (Section 143(3)(i)).

Note the difference in focus. The directors' duty covers controls over the whole business, including operational and compliance controls that have a financial angle. The auditor's report is on internal financial controls over financial reporting (IFCoFR), meaning the controls that affect the reliability of the financial statements.

Two tests matter for the auditor: adequacy (is the control designed well enough to stop or catch a misstatement?) and operating effectiveness (did it actually work throughout the year?). A well-designed control that nobody follows fails the second test.

Key rules to remember

Meaning of IFC (explanation to Section 134(5)(e)): IFC = policies and procedures for (1) orderly and efficient conduct of business, (2) safeguarding assets, (3) preventing and detecting frauds and errors, (4) accuracy and completeness of accounting records, (5) timely preparation of reliable financial information; Learn the five limbs as a list. Questions often ask you to define IFC or to name its objectives.
Directors' duty: Section 134(5)(e): Directors of a listed company must state in the Directors' Responsibility Statement that they have laid down IFC and that such controls are adequate and operating effectively; This applies to listed companies. Do not say it applies to every company under this clause.
Auditor's duty: Section 143(3)(i): Auditor's report states whether the company has an adequate IFC system over financial reporting and whether it operated effectively; Reporting is on financial reporting controls. It is an opinion, not a guarantee.
Two tests for the auditor: Adequacy (design) + Operating effectiveness (functioning); Both must be assessed. A control can be adequate in design yet not effective in operation.

How to solve Internal Financial Controls under Companies Act 2013 questions

Use this method for definition questions, responsibility questions and short case-based questions on IFC.

1Read what the question asks: meaning, directors' duty, auditor's duty, or a case where you must judge a control.
2If it asks for meaning, write the definition and list the five objectives from the explanation to Section 134(5)(e).
3If it concerns directors, name Section 134(5)(e), state that it applies to listed companies, and say they must confirm IFC are laid down and are adequate and operating effectively.
4If it concerns the auditor, name Section 143(3)(i) and say the report covers adequacy and operating effectiveness of IFC over financial reporting.
5For a case, identify the control weakness, say whether it is a design gap (adequacy) or a failure in operation (effectiveness), and link it to a risk to the financial statements.
6Close with the consequence: for example, the auditor may report a weakness or modify the IFC opinion, and directors must disclose it in their statement.

Quickest way: Who, which section, which test

When to use it: Use in MCQs and 2-3 mark short notes when you have under two minutes.

Ask who: directors or auditor.
Match the section: directors with 134(5)(e), auditor with 143(3)(i).
Recall scope: directors' clause is for listed companies; the auditor reports on controls over financial reporting.
Check the test words in the options: adequate and operating effectively.
Eliminate options that mix up the two sections or say the auditor guarantees no fraud.

Common mistakes in Internal Financial Controls under Companies Act 2013

Swapping the sections, giving Section 143(3)(i) for directors and Section 134(5)(e) for the auditor.
Both sections talk about IFC and the numbers look alike.
Fix: Link 134 with the Board's report and 143 with the auditor's report. Directors report, auditors audit.
Saying Section 134(5)(e) applies to all companies.
Students remember the duty but forget the condition.
Fix: Write that the clause applies to listed companies. Always state the condition with the rule.
Treating IFC and IFCoFR as the same thing.
Textbooks use the short form IFC loosely.
Fix: Say the directors' statement is about IFC, while the auditor's report is on IFC over financial reporting.
Writing only about adequacy and ignoring operating effectiveness.
Students think a control that exists is a control that works.
Fix: Always write both tests, and give an example where design is fine but the control is not followed.
Claiming the auditor's report guarantees that no fraud or error exists.
The word 'prevention' in the definition is misread as the auditor's duty.
Fix: The auditor gives an opinion on IFC based on testing. Management and the Board are responsible for establishing and maintaining controls.
Listing fewer than five objectives in a definition answer.
Students give a general idea instead of the statutory wording.
Fix: Memorise the five limbs: orderly conduct, safeguarding assets, fraud and error, accurate records, timely reliable information.

Worked examples

Example 1

Explain the meaning of internal financial controls as given in the Companies Act, 2013, and state who must report on them.

Show the solution

Identify the source: the explanation to Section 134(5)(e) defines IFC.
Write the definition: policies and procedures adopted by the company for ensuring the orderly and efficient conduct of its business.
List the limbs: adherence to company policies, safeguarding of assets, prevention and detection of frauds and errors, accuracy and completeness of accounting records, and timely preparation of reliable financial information.
State the reporting: directors of a listed company confirm in their responsibility statement that IFC are laid down and are adequate and operating effectively (Section 134(5)(e)).
State the auditor's role: under Section 143(3)(i), the auditor reports whether the company has an adequate IFC system over financial reporting and whether it operated effectively.

Answer: IFC are the company's policies and procedures covering orderly conduct of business, safeguarding assets, preventing and detecting fraud and error, accurate records and timely reliable financial information. Directors of listed companies report under Section 134(5)(e); the auditor reports on IFC over financial reporting under Section 143(3)(i).

Example 2

Sundaram Textiles Ltd has a rule that every payment above ₹50,000 needs the finance manager's approval. During the year the auditor finds that 12 payments above ₹50,000 were released by the accountant alone, with no approval. Discuss the effect on the auditor's report on internal financial controls.

Show the solution

Identify the control: approval of payments above ₹50,000 by the finance manager.
Test adequacy: the rule is well designed, because it requires independent approval for large payments.
Test operating effectiveness: the control was bypassed 12 times, so it did not operate throughout the year.
Link to risk: unapproved payments raise the risk of misappropriation and misstatement of expenses and payables in the financial statements.
Consider consequence: the auditor assesses the importance of the failure, considers compensating controls and the amounts involved, and, if the failure is significant, reports that IFC were not operating effectively under Section 143(3)(i).

Answer: The control is adequate in design but not operating effectively. The auditor evaluates the significance of the 12 exceptions and compensating controls. If significant, the report under Section 143(3)(i) will say that IFC over financial reporting did not operate effectively, and the directors should address the gap in their statement.

Exam tips

Write section numbers with the person: directors with 134(5)(e), auditor with 143(3)(i). This earns easy marks.
In theory answers, quote all five limbs of the IFC definition and then add one example for each if marks allow.
For MCQs, watch for options that say 'all companies' for 134(5)(e) or 'guarantee' for the auditor. These are usually wrong.
In case questions, label each weakness as a design gap or an operation failure before you conclude.
Keep answers in short numbered points. Step marks go to clear identification, the section, and the consequence.

Practice questions from Report on Internal Financial Control over Financial Reporting

Internal Financial Controls under Companies Act 2013 in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Financial Controls under Companies Act 2013: frequently asked questions

What is internal financial control over financial reporting?

It means the controls that help ensure financial statements are reliable, such as authorisation of entries, reconciliations and segregation of duties. The auditor gives an opinion on their adequacy and operating effectiveness under Section 143(3)(i).

What does Section 134(5)(e) require from directors?

It requires directors of a listed company to state in the Directors' Responsibility Statement that they have laid down internal financial controls and that the controls are adequate and operating effectively. This is part of the Board's report.

What is the difference between adequacy and operating effectiveness?

Adequacy asks whether the control is designed well enough to prevent or detect errors. Operating effectiveness asks whether it actually worked consistently during the period. A control must pass both tests.

Does the auditor guarantee that the company's controls will prevent fraud?

No. The auditor gives an opinion based on testing, and controls have inherent limits. Responsibility for establishing and maintaining IFC rests with the company's management and Board.