What is the auditor's report on internal financial controls, and which companies need it?

What is reported

Under section 143(3)(i), the auditor states whether the company has adequate internal financial controls with reference to financial statements, and whether they were operating effectively. The report is an annexure to the audit report, with its own opinion: unmodified, qualified, adverse or a disclaimer.

Who needs it

What "internal financial controls" means here

Controls that give reasonable assurance that transactions are recorded properly and the financial statements are reliable. For example:

• entity level: code of conduct, delegation of authority, risk assessment, IT general controls;
• process level: approvals, three-way matching of orders, receipts and invoices, reconciliations, segregation of duties, period-end closing;
• IT controls: access rights, change management, and the audit trail in accounting software.

How the auditor tests them

Following ICAI's Guidance Note, the auditor understands each significant process, identifies the key controls, and tests their design and operating effectiveness through walk-throughs and samples. A material weakness, a gap that could lead to a material misstatement going undetected, results in a modified opinion.

Getting ready

1. Write down each key process and its controls in a risk and control matrix.
2. Make sure each control leaves evidence: an approval, a signed reconciliation, a system log.
3. Test the controls yourself during the year, through internal audit or management review.
4. Fix gaps before the year end; controls that start after the year end do not count.

Directors of listed companies also state in the board's report that internal financial controls were adequate and operating effectively (section 134(5)(e)).