Internal and Forensic Audit · Internal Controls

Internal Financial Controls under Companies Act, 2013

Updated 11 October 2026 · Fact-checked

Internal financial controls (IFC) are the policies and procedures a company uses to run its business in an orderly way, protect assets, prevent fraud and keep accounts reliable. The directors of a listed company must state in the Board's report that IFC are adequate and operating effectively. The auditor reports on adequacy and operating effectiveness.

Understand Internal Financial Controls under Companies Act 2013

Start with the idea. A company needs checks so that its numbers can be trusted and its assets are not lost or misused. These checks are its internal controls. The Companies Act, 2013 picks out the ones that matter for financial reporting and makes three groups answerable for them: the directors, the auditor and the independent directors.

The Act defines the term in the Explanation to Section 134(5)(e). Internal financial controls mean the policies and procedures adopted by the company for ensuring the orderly and efficient conduct of its business, including: adherence to company policies, safeguarding of assets, prevention and detection of frauds and errors, accuracy and completeness of the accounting records, and timely preparation of reliable financial information. Learn these five parts. Exams often ask you to list them.

Directors. The Board's report must include a Directors' Responsibility Statement (Section 134(3)(c)). Its content is set by Section 134(5). Clause (e) says that, in the case of a listed company, the directors had laid down internal financial controls to be followed by the company and that such controls are adequate and were operating effectively. Clause (f) is wider. It applies to every company that prepares a Board's report. It says the directors had devised proper systems to ensure compliance with all applicable laws and that these systems were adequate and operating effectively.

Auditor. Under Section 143(3)(i), the auditor's report must state whether the company has adequate internal financial controls with reference to financial statements in place, and whether those controls are operating effectively. Certain classes of companies are exempted from this reporting by government notification. Check the current notification before you claim an exemption in an answer. The Guidance Note on Audit of Internal Financial Controls issued by ICAI explains how the auditor does this work.

Independent directors and audit committee. Independent directors are expected to satisfy themselves that financial controls and risk management systems are robust and defensible. The audit committee's role includes evaluating the company's internal financial controls. So the Board owns the controls, the audit committee and independent directors oversee them, and the auditor reports on them.

Two points often confuse students. First, the directors' duty under clause (e) covers both design (adequate) and working (operating effectively). Second, if the company defaults on Section 134, the company is liable to a penalty of ₹3,00,000 and every officer in default to a penalty of ₹50,000.

Key rules to remember

Definition of internal financial controls: IFC = policies and procedures for (1) orderly and efficient conduct of business, including adherence to company policies + (2) safeguarding of assets + (3) prevention and detection of frauds and errors + (4) accuracy and completeness of accounting records + (5) timely preparation of reliable financial information; From the Explanation to Section 134(5)(e). The wording in your answer should follow these five parts.
Directors' duty on IFC: Section 134(5)(e): listed company only. Directors had laid down IFC, and the IFC are adequate and were operating effectively.; Part of the Directors' Responsibility Statement in the Board's report under Section 134(3)(c). Unlisted companies are not covered by clause (e).
Directors' duty on legal compliance systems: Section 134(5)(f): all companies. Directors had devised proper systems to ensure compliance with all applicable laws, and the systems were adequate and operating effectively.; Do not confuse with clause (e). Clause (f) is not limited to listed companies.
Auditor's reporting duty: Section 143(3)(i): report whether the company has adequate IFC with reference to financial statements in place, and whether they are operating effectively.; Exempted classes of companies exist by notification. Mention this in the answer.
Who signs the Board's report: Chairperson, if authorised by the Board. Otherwise at least two directors, one of whom is a managing director. If there is one director, that director.; Section 134(6).
Penalty for default under Section 134: Company: ₹3,00,000. Every officer in default: ₹50,000.; Section 134(8) as substituted in 2020. These are penalties, not imprisonment.

How to solve Internal Financial Controls under Companies Act 2013 questions

Use this method for any written question on IFC. It keeps you in the provision, facts, conclusion format that examiners reward.

1Identify who the question is about: directors, auditor, independent directors or audit committee. The duty is different for each.
2Check the type of company. Section 134(5)(e) applies to a listed company. Section 134(5)(f) applies to all companies. Check also whether the company falls in a class exempted from auditor reporting.
3State the rule in plain words with the section number. For directors, use the Section 134(5) wording. For the auditor, use Section 143(3)(i).
4Quote the definition of IFC from the Explanation to Section 134(5)(e) if the question asks what IFC means or what they cover.
5Apply the rule to the facts. Ask two questions: is the control adequate (designed properly) and is it operating effectively (working in practice)?
6Add the consequence. Qualified or adverse remarks need Board explanation under Section 134(3)(f). Default brings the Section 134(8) penalty.
7Give a short conclusion and one practical point, such as documenting controls, testing them, and placing the report before the audit committee.

Quickest way: Who, which company, which words

When to use it: Use this when you have about five minutes for a short-note or a short case question.

Write the one-line definition of IFC with its five parts.
Write the director's duty: laid down, adequate, operating effectively. Add that this applies to a listed company.
Write the auditor's duty under Section 143(3)(i): adequacy and operating effectiveness, with reference to financial statements.
Add one line on the Board report, Section 134(3)(c) and the penalty of ₹3,00,000 and ₹50,000.
Close with a one-line conclusion tied to the facts given.

Common mistakes in Internal Financial Controls under Companies Act 2013

Saying that every company's directors must state that IFC are adequate and operating effectively under Section 134(5)(e).
Clause (e) and clause (f) sit next to each other and have similar wording, so students merge them.
Fix: Remember that clause (e) is for a listed company. Clause (f) on compliance systems is for all companies.
Writing only that controls must be 'adequate' and leaving out 'operating effectively'.
Students think of design and forget testing.
Fix: Always write both words for directors and for the auditor. Adequacy is about design. Operating effectiveness is about whether the control worked over the period.
Defining IFC as controls over everything the company does.
Students mix IFC with the general idea of internal control.
Fix: Use the statutory definition. It lists business conduct, safeguarding of assets, fraud prevention and detection, accounting records and reliable financial information. The auditor reports with reference to financial statements.
Stating that the auditor gives an opinion on the Directors' Responsibility Statement.
Students think the auditor's work and the directors' work are the same.
Fix: Keep roles separate. The Board makes the statement. The auditor separately reports under Section 143(3)(i). The Board must explain every qualification, reservation or adverse remark in the auditor's report (Section 134(3)(f)).
Claiming the auditor's IFC reporting applies to every company without exception.
Students learn the section and skip the exemption notification.
Fix: Say that certain classes of companies are exempted by notification, and apply the exemption only if the facts clearly match it.
Quoting the wrong penalty or saying officers face the same penalty as the company.
Penalty figures are easy to mix up with other sections.
Fix: Section 134(8): company ₹3,00,000, each officer in default ₹50,000.

Worked examples

Example 1

Sundaram Textiles Ltd is a listed company. Its Board's report for the year does not say anything on internal financial controls. The chairperson, who is authorised by the Board, signed the report. Advise the company on the legal position.

Show the solution

Provision: Section 134(3)(c) requires the Board's report to include a Directors' Responsibility Statement. Section 134(5)(e) says that, for a listed company, the statement must say the directors had laid down internal financial controls and that these are adequate and were operating effectively.
Facts: Sundaram Textiles is listed, so clause (e) applies. The report is silent on IFC, so a required part of the Directors' Responsibility Statement is missing.
Signing: Under Section 134(6), the chairperson may sign the Board's report if the Board has authorised the chairperson. So the signing is in order. The defect is in the content only.
Consequence: Failure to comply with Section 134 makes the company liable to a penalty of ₹3,00,000 and every officer in default liable to a penalty of ₹50,000 (Section 134(8)).
Practical advice: Before the report is finalised, the Board should review its IFC framework, test it, and take the audit committee's evaluation on record. Then it should add the clause (e) statement to the Directors' Responsibility Statement.

Answer: The report is deficient. As a listed company, Sundaram Textiles must include the Section 134(5)(e) statement on IFC. The signing by the authorised chairperson is valid. The company faces a penalty of ₹3,00,000 and each officer in default ₹50,000 under Section 134(8) if the omission stays.

Example 2

Kaveri Components Pvt Ltd is an unlisted private company. The directors ask whether they must give the Section 134(5)(e) statement on IFC, and whether the auditor must report on IFC. Advise.

Show the solution

Directors, clause (e): Section 134(5)(e) applies in the case of a listed company. Kaveri is unlisted, so the directors are not bound by the clause (e) statement.
Directors, clause (f): Section 134(5)(f) applies to the Directors' Responsibility Statement of every company that prepares a Board's report. The directors must state that they have devised proper systems to ensure compliance with all applicable laws and that these systems are adequate and operating effectively.
Note on size: A One Person Company has a limited Board's report under Section 134(4), and the Central Government may prescribe an abridged report for a One Person Company or small company under Section 134(3A). Check which applies to Kaveri.
Auditor: Section 143(3)(i) requires the auditor to report on adequate IFC with reference to financial statements and their operating effectiveness. A private company may fall within a class exempted by notification. The auditor must check the current notification against Kaveri's financial position. If Kaveri is not exempted, the auditor must report.
Practical point: Even where reporting is exempt, the directors still have duties to keep proper accounting records and to safeguard assets. Good controls are sensible in any case.

Answer: The directors need not give the clause (e) statement because Kaveri is unlisted, but they must give the clause (f) statement on compliance systems. The auditor must report under Section 143(3)(i) unless Kaveri falls within a class exempted by notification, which has to be checked against its facts.

Exam tips

Learn the definition in the Explanation to Section 134(5)(e) word for word in the five parts. Questions often ask you to define or list.
Always state who is covered. Clause (e) is for listed companies. Clause (f) is for all companies. Examiners test this difference.
Use both words, adequate and operating effectively, for directors and for the auditor.
In a case question, follow the order: provision, facts, consequence, conclusion. Add the penalty of ₹3,00,000 and ₹50,000 where there is a default.
Link IFC to related roles in one line: audit committee evaluation, independent directors' oversight and the Guidance Note on Audit of Internal Financial Controls.

Practice questions from Internal Controls

Internal Financial Controls under Companies Act 2013 in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Financial Controls under Companies Act 2013: frequently asked questions

Does Section 134(5)(e) apply to unlisted companies?

No. Clause (e) applies in the case of a listed company. Directors of all companies, however, must give the clause (f) statement on systems for compliance with applicable laws in the Directors' Responsibility Statement.

What does the auditor report under Section 143(3)(i)?

The auditor reports whether the company has adequate internal financial controls with reference to financial statements in place and whether such controls are operating effectively. Some classes of companies are exempted by notification.

What is the difference between adequate and operating effectively?

Adequate means the controls are properly designed to meet their purpose. Operating effectively means they actually worked as designed during the period. A well-designed control that staff ignore is adequate but not operating effectively.

What is the penalty if the Board's report does not comply with Section 134?

The company is liable to a penalty of ₹3,00,000. Every officer of the company in default is liable to a penalty of ₹50,000. This is under Section 134(8).

Who signs the Board's report that contains the IFC statement?

The chairperson signs if the Board has authorised the chairperson. If not, at least two directors sign, one of them a managing director. Where the company has one director, that director signs. This is under Section 134(6).