Meaning of IFCFR
A process designed by, or under the supervision of, the company’s principal executive and principal financial officers, or persons performing similar functions, and effected by the company’s board of directors, management, and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of the financial statements for external purposes in accordance with generally accepted accounting principles.
Thus a company’s IFCFR includes policies and procedures that:
• pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company.
• provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company.
• provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.
Role of various authorities
Management In case of LISTED companies, section 134(5)(e) of the Companies Act, 2013 requires Directors Responsibility Statement to state that the Directors had laid down internal financial controls and the same were adequate and operating effectively. In case of ALL companies, Rule 8(5)(viii) of Companies (Accounts) Rules, 2014 requires the Board of Directors’ Report to state the details in respect of adequacy of internal financial controls with reference to the financial statements.
Auditor Section 143(3)(i) of the Companies Act, 2013 requires the auditors of ALL companies to state in their report whether the company has adequate internal financial control system in place and the operating effectiveness of such controls. The auditor will have to modify its audit methodology to obtain reasonable assurance on the adequacy of internal financial controls over financial reporting and its operating effectiveness.
Independent Director Schedule IV of the Companies Act, 2013 requires the Independent Directors of the Company to satisfy themselves on the integrity of financial information and financial controls and also to ensure that the systems of risk management are robust and defensible. Audit Committee Section 177(4)(vii) requires Audit Committee to evaluate internal financial controls and risk management systems. Also, section 177(5) gives power to the Audit Committee to call for comments of the auditors on internal control systems, scope of audit, their observations on internal control systems and financial statements before submission of the same to the board. They may also discuss any related issues with the internal auditors and the management of the Company.
Focus Areas The introduction of IFC has helped companies enhance their internal control environment. For the IFC framework to be sustainable, each stakeholder is expected to play an important role during its implementation. Some of the key focus areas in the coming years for companies and internal auditors are:
• The first year of IFC implementation might witness documentation and testing of policies, procedures and controls. However, business operations are likely to evolve continuously and there may be changes in the policies and processes, with the management having to ensure that the same are reflected in the IFC documentation. An effective change management process needs to be defined and implemented. Further, adequate training is required to be imparted to process owners on documentation and change management.
• The Test of Operating Effectiveness (TOE) requires the audit of transactions with respect to the internal controls defined in the IFC framework. The internal audit plan may be defined considering the TOE requirements and processes may be taken up for review accordingly. While the responsibility of maintaining the internal controls is that of the management.
• Having clear directions on how the deficiencies highlighted could be treated as a part of the IFC programme, might only help stimulate this exercise across India and help companies sustain their IFC compliance initiative. IFC implementation is a journey and Indian companies over the next few years should focus on adopting the right approach to reap the potential benefits for their stakeholders as well as for themselves.
Both corporates and auditors in India will need to come to terms with the concept of a combined or an integrated audit, which includes an audit of ICFR over financial reporting and financial statements. The guidance note acknowledges that while the objectives of the audit of ICFR and audit of financial statements are not identical, the auditor now needs to plan and perform work in such a way that it achieves the objectives of both the audits in an integrated manner. In such an audit, the auditor is required to plan and conduct the audit to fulfill the following:
• Obtain sufficient evidence to support the auditor’s opinion on the ICFR as of the year end
• Obtain sufficient evidence to support the auditor’s control risk assessments for the purposes of the audit of the financial statements.