Been around for over 21 years, however ...
... there remains some degree of confusion between the terms internal financial controls (‘IFC’)s and internal financial controls over reporting ‘(ICFR’); with the two being used interchangeably.
This thought leadership examines the dichotomy.
| |
|
|
Genesis | The Sarbanes-Oxley Act (‘SOX’)
Assessments of ICFR for the effectiveness of their design and operation, gained prominence with SOX in 2022. Following accounting scandals at significant organizations (such as Enron, Tyco International and WorldCom), Section 404 of SOX introduced the requirement for public companies in the United States of America (‘USA’) to establish and report on their ICFR.
Companies listed in USA need to include their own assessment of the effectiveness of their internal controls (management assertion), as well as have their auditor attest on the management assertion, in their annual reports. Publicly listed companies in the USA also need to document, test and maintain their internal controls and procedures on an ongoing basis.
Equally significant is the personal accountability of signing officers on disclosure controls and procedures, which through Section 302 of SOX requires the principal executive and financial officers of a company (typically the CEO and CFO) to personally attest that the published financial information is accurate and reliable. These officers need to make their attestations within the quarterly 10-Q and annual 10-K reports that are filed with the Securities Exchange Commission.
| |
|
Control assessments in India
With the advent of SOX in the USA, India also established new corporate governance norms under Clause 49 of Listing Agreement, which first came into effect from December 31, 2005 and have been mandatory for all listed companies ever since. However, Clause 49 made the requirement for IFCs broader to encompass ICFR, in addition to other controls (such as those stated in the ensuing section).
The second area where the requirements for assessing IFCs in India has deviated from SOX is in terms of its coverage. While SOX is applicable at a consolidated financial statement level and requires only material subsidiaries to be covered, the listing regulations in India (as amended from time to time) and specific provisions of the Companies Act 2013 (‘the Companies Act’) require the assessment of IFCs and ICFR to be undertaken at a stand-alone entity level.
| |
|
IFC v/s ICFR
IFC has been defined under explanation to Section 134(5)(e) of the Companies Act as policies and procedures adopted by a company for ensuring the orderly and efficient conduct of its business, including adherence to the company’s policies, safeguarding of its assets, prevention and detection of frauds and errors, in addition to the accuracy and completeness of the accounting records and the timely preparation of reliable financial information. This is where the concept of controls assessment moves beyond ICFR to include internal controls relating to operations, compliances and fraud prevention.
ICFR has been defined in the guidance note issued by the Institute of Chartered Accountants of India in September 2015 and this definition is consistent with Auditing Standard 5 on "Audit of Internal Control Over Financial Reporting that Is Integrated with An Audit of Financial Statements" issued by the Public Company Accounting Oversight Board, USA. According to this definition, ICFR refers to a process which is implemented by those charged with governance and management to provide reasonable assurance that a mechanism of internal control is in place to achieve the following main objectives:
- Preparation of financial statements as per the applicable financial reporting framework.
-
Authorized transactions & events reported in the financial statements as per the established protocols.
- Prevention, timely detection and amendment of any unauthorized use of assets.
| |
|
Responsibilities of the statutory auditor
Section 143(3)(i) of the Companies Act requires statutory auditors to report on the adequacy & operating effectiveness of a company’s ICFR only and not their IFCs.
Prior to this, the scope of reporting on IFC was provided under the Companies (Auditor’s Report) Order, 2015, which was limited to the adequacy of controls over purchase of inventory and fixed assets and sale of goods and services.
| |  |
|
Responsibilities of the board of directors (‘BoD’)
Section 134(5) of the Companies Act requires the BoD of listed entities to provide a confirmation that they have laid down the IFCs and that such IFCs are adequate and operating effectively.
However, Rule 8(5) of Companies (Accounts) Rules 2014 (which applies to all companies) requires the BoD’s report to address the adequacy of ICFR only.
| |
|
Responsibilities of the audit committee (‘AC’)
Section 177 of the Companies Act, which relates to companies that have an AC, requires this committee to evaluate the IFCs and the risk management systems and to call upon the statutory auditors to comment on the ICFR.
| | |
|
Responsibilities of the independent directors (‘ID’)s
Section 149(8) read with Schedule IV of the Companies Act, requires IDs to satisfy themselves on the integrity of the financial information and whether the IFCs and the risk management systems are defensible and robust.
| |
|
The management should assess the scope of coverage of their assessment of IFC or ICFR (as the case may be) on quantitative and qualitative aspects, after considering the company’s size, complexity, global reach and risk profile.
The statutory auditor should make an independent attestation of a company’s ICFR; which is possible when it has no role in enabling or assisting the management in forming their assertion over the design and operation of the same.
Companies that choose to undertake this exercise objectively will unlock value from this assessment, reduce fraud risk, avoid financial reporting surprises and facilitate sustained business performance over the long term.
Should you require any clarifications or assistance, please do not hesitate to reach out to us at contactus@mgcglobal.co.in.
Best regards
Markets Team
MGC Global Risk Advisory
| |
|
About MGC Global Risk Advisory
Recognized as one of the '10 most promising risk advisory services firms' in 2017, as the 'Company of the Year' in 2018 &, 2019' (both in the category of risk advisory services), one of the 'Top Exceptional Companies to Work For’ in 2020, amongst the ‘Top 25 Customer Centric Companies’ in 2020 and 'The Consultant of the year' in 2021 (in the category of risk advisory services); MGC Global is an independent member firm of the ~US$ 5 billion, Atlanta headquartered - Allinial Global.
MGC Global provides services in the areas of internal audits, enterprise-wide risk management, control assessments (SOC, IFCR & SOX), process re-engineering, governance frameworks, IT risk advisory, GDPR, VAPT, ISO readiness, cyber security, vCISO, CxO transformation, forensic, ESG & CSR services. Our firm has the capabilities to service its clients through its offices in Bengaluru, Mumbai, NCR; and has service arrangements in all major cities in India.
| |
|
About Allinial Global
Allinial Global (formerly PKF North America) is currently the world's second-largest member-based association (with collective revenues of approximately USD 5 billion) that has dedicated itself to the success of independent accounting and consulting firms since its founding in 1969. It currently has member firms in over 100 countries, who have over 28,000 professional staff and over 6,000 partners operating from nearly 700 offices across the globe.
Allinial Global provides its member firms with a broad array of resources and support that benefit both its member firms and their clients in the key impact areas of learning and development, human resources, international outreach, technical support, knowledge-sharing platforms through its specialized communities of practice, marketing resources, information technology and best practices in practice management.
| | | | |
