Internal and Forensic Audit · Internal Controls

Guidance Note on Audit of Internal Financial Controls

Q: What is the difference between design and operating effectiveness?

Design effectiveness asks whether a control could prevent or detect a material misstatement if it ran as intended. Operating effectiveness asks whether it actually ran as designed, consistently, by a competent and authorised person.

Q: What is the difference between a significant deficiency and a material weakness?

Both are deficiencies in internal control. A material weakness has a reasonable possibility of letting a material misstatement go unprevented or undetected on time. A significant deficiency is less severe but still merits the attention of those charged with governance.

Q: Does a material weakness always mean the financial statements are qualified?

No. The IFC opinion and the financial statement opinion are separate. A material weakness usually leads to an adverse IFC opinion, but the financial statement opinion depends on whether substantive procedures gave sufficient evidence.

Q: Is the Guidance Note mandatory?

The statutory duty to report on IFC comes from the Companies Act, 2013. The Guidance Note is ICAI professional guidance on how to perform and report the work, and auditors are expected to follow it in practice.

Updated 11 October 2026 · Fact-checked

The ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting explains how an auditor reports on a company's IFC under the Companies Act, 2013. You understand the entity, assess risk, test design and operating effectiveness, evaluate deficiencies, and then give an opinion on whether adequate IFC existed and operated effectively.

Understand Guidance Note on Audit of Internal Financial Controls

Internal financial controls (IFC) are the policies and procedures a company uses to run its business in an orderly way. They cover safeguarding assets, preventing and detecting fraud and error, keeping accurate and complete records, and preparing reliable financial information on time. The Companies Act, 2013 makes directors responsible for laying down IFC and for ensuring they operate effectively. The statutory auditor must report on whether the company has adequate IFC with respect to financial reporting and whether they operated effectively. This reporting duty is in section 143(3)(i), which you should confirm in the bare Act.

The ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting is not law. It is professional guidance that shows auditors how to carry out this work. It follows an integrated approach: the auditor audits the financial statements and the IFC together, so evidence from one supports the other. The note treats IFC audit as a top-down, risk-based exercise. You begin at the financial statement level, find the significant accounts and assertions, and then identify the controls that address the risks of material misstatement.

Two ideas matter most. Design effectiveness asks whether a control, if operated as intended by competent people, can prevent or detect a material misstatement. Operating effectiveness asks whether the control actually worked as designed, consistently, throughout the period, by a person with the authority and competence to run it. A well-designed control that nobody performs fails the second test. A control that is performed but could never catch the error fails the first.

Where a control fails, the auditor records a deficiency. A deficiency becomes a significant deficiency or a material weakness depending on how likely it is that a misstatement could occur and how large it could be. A material weakness is a deficiency, or a combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis. A significant deficiency is less severe than a material weakness but still deserves the attention of those charged with governance. Compensating controls can reduce severity if they operate precisely enough.

The auditor also looks at the entity-level setting: control environment, risk assessment, information and communication, and monitoring, often mapped to the COSO framework. The final report is an opinion. A material weakness normally leads to an adverse opinion on IFC, and a scope limitation can lead to a qualified or disclaimed opinion. The deficiency also affects the nature, timing and extent of substantive procedures in the financial statement audit.

Key rules to remember

Design effectiveness test: Control properly designed ⇔ if operated as prescribed by competent persons, it can prevent or detect material misstatement on a timely basis; Assess design first. Testing operation of a badly designed control wastes time.
Operating effectiveness test: Control operates effectively ⇔ performed as designed, consistently through the period, by an authorised and competent person; Use inquiry, observation, inspection and re-performance. Inquiry alone is never enough.
Material weakness: Deficiency (or combination) with a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis; Look at likelihood and magnitude, not at whether a misstatement actually occurred.
Severity ranking: Control deficiency < Significant deficiency < Material weakness; Significant deficiency is serious enough for governance attention but is less than a material weakness.
Reporting consequence: Material weakness → normally adverse opinion on IFC; scope limitation → qualified or disclaimer; The opinion is on IFC as at the balance sheet date, separate from the financial statement opinion.

How to solve Guidance Note on Audit of Internal Financial Controls questions

Use this sequence for any case-based question on auditing IFC. It mirrors the provision, analysis, conclusion format examiners reward.

1State the duty briefly: directors establish IFC, and the auditor reports on adequacy and operating effectiveness of IFC over financial reporting under the Companies Act, 2013.
2Plan the work: understand the entity, identify significant accounts, assertions and risks of material misstatement, using a top-down, risk-based approach.
3Identify the relevant controls at entity level and process level, including IT general and application controls where systems are involved.
4Test design effectiveness by walkthroughs and inspection of documents, then test operating effectiveness by inquiry, observation, inspection and re-performance, with sample sizes linked to risk.
5Evaluate each deficiency for likelihood and magnitude, consider compensating controls and aggregate related deficiencies.
6Classify as deficiency, significant deficiency or material weakness, and communicate in writing to management and those charged with governance.
7Form the opinion: unmodified, qualified, adverse or disclaimer, and state how it affects the audit of the financial statements.
8Apply the conclusion to the facts given in the question and name the exact modification and reason.

Quickest way: Design, operate, severity, opinion

When to use it: Use when a short-answer or case question gives a control failure and asks what the auditor should conclude.

Ask: is the control designed to catch the risk? If not, it is a design deficiency.
Ask: did it run all year, by the right person, with evidence? If not, it is an operating deficiency.
Ask: could a material misstatement slip through, and is there a compensating control? Decide the severity.
Write the consequence: communication to governance and, for a material weakness, an adverse IFC opinion.

Common mistakes in Guidance Note on Audit of Internal Financial Controls

Treating the Guidance Note as binding law.
Students mix the statutory duty with the professional guidance.
Fix: Say the Companies Act, 2013 creates the duty, and the ICAI Guidance Note explains how to perform and report the work.
Relying on inquiry alone to prove operating effectiveness.
Inquiry is quick and feels like evidence.
Fix: Combine inquiry with observation, inspection and re-performance. Inquiry supports but does not prove.
Testing operating effectiveness before checking design.
Students jump straight to sampling.
Fix: Do walkthroughs first. A control that cannot work gains nothing from sample testing.
Classifying a deficiency by whether a misstatement actually happened.
Students link severity to actual loss.
Fix: Judge by reasonable possibility and potential magnitude. A material weakness can exist with no misstatement yet.
Confusing the IFC opinion with the financial statement opinion.
Both appear in the same audit report.
Fix: Remember they are separate opinions. A material weakness can lead to an adverse IFC opinion while the financial statement opinion stays unmodified if substantive work gave enough evidence.
Ignoring compensating controls and aggregation.
Students assess each deficiency in isolation.
Fix: Check whether another control addresses the same risk precisely, and combine deficiencies that affect the same account or assertion.

Worked examples

Example 1

Nirmal Textiles Ltd's policy requires a second person to approve every vendor bank-detail change. During testing you find that in 25 of 40 sampled changes the approval was missing, and the approver's login was shared with the accounts clerk. Explain what you would conclude about this control.

Show the solution

Design: the policy of independent approval can prevent fraudulent payments, so the control is suitably designed on paper.
Operation: approval was absent in 25 of 40 changes, and the shared login means approval cannot be attributed to an authorised person. The control did not operate as designed.
Severity: unauthorised bank-detail changes can divert payments to wrong accounts. The likelihood is high and the amount could be material.
Compensating controls: check whether payment-run review or bank reconciliations catch diverted payments precisely. If none do, severity stays high.
Conclusion: this is an operating effectiveness deficiency, likely a significant deficiency or material weakness, especially if combined with other payment-cycle gaps.

Answer: The control is designed adequately but failed in operation. Unless a precise compensating control exists, treat it as a material weakness in the procure-to-pay process, communicate it in writing to management and those charged with governance, and consider an adverse opinion on IFC.

Example 2

Explain the approach an auditor follows to audit IFC over financial reporting under the ICAI Guidance Note, and state how the results affect the audit report.

Show the solution

Planning: understand the business, identify significant accounts and assertions, and assess risks of material misstatement in a top-down manner.
Controls: identify entity-level controls and process-level controls, including IT controls, that address those risks.
Testing: walk through to check design, then test operating effectiveness using inquiry, observation, inspection and re-performance, with larger samples for higher risk.
Evaluation: assess each deficiency for likelihood and magnitude, allow for compensating controls and aggregate related deficiencies.
Communication: report significant deficiencies and material weaknesses in writing to management and those charged with governance.
Reporting: give an opinion on whether adequate IFC existed and operated effectively. A material weakness normally means an adverse opinion, and a scope limitation means qualification or disclaimer.

Answer: The auditor uses an integrated, risk-based, top-down approach, tests design and operating effectiveness, grades deficiencies, and reports a separate IFC opinion, which is adverse where a material weakness exists.

Exam tips

Write the sequence plan, design test, operating test, evaluate, report. Examiners look for the order.
Always separate design from operating effectiveness in your answer, and say which one failed in the facts.
Define material weakness using reasonable possibility and timely prevention or detection, not actual loss.
State that the Companies Act, 2013 creates the duty and the Guidance Note is professional guidance.
In case questions, end with a concrete conclusion: severity class, communication and the type of opinion.

Practice questions from Internal Controls