Internal Financial Controls (IFC) refers to the policies and procedures put in place by companies to ensure:
Reliability of financial reporting
Effectiveness and efficiency of operations
Compliance with applicable laws and regulations
Safeguarding of assets
Prevention and detection of frauds
---
### Responsibilities under Companies Act, 2013
Section
Who
Responsibility
134(5)(e)
Directors of listed companies
Directors' Responsibility Statement must confirm that adequate IFC are in place and operating effectively
143(3)(i)
Auditor
Auditor's report must state whether adequate IFC system exists and whether it is operating effectively
177(4)(vii)
Audit Committee
Must evaluate internal financial controls and risk management systems
149(8) + Schedule IV
Independent Directors
Must satisfy themselves on integrity of financial information and that financial controls and risk management are robust and defensible
---
### Exemption from Section 143(3)(i) Reporting
The IFC reporting requirement does NOT apply to a private company that satisfies both of the following:
1. Is a One Person Company or Small Company, OR has turnover < ₹50 crore (per latest audited financial statements); AND
2. Has aggregate borrowings < ₹25 crore from banks, FIs, or any body corporate at any point during the financial year.
> Both conditions must be met simultaneously for the exemption to apply.
Worked example
### Example 1
Example — Applicability test for Section 143(3)(i):
Private Ltd Co. X has turnover of ₹40 crore and total bank borrowings of ₹30 crore.
Turnover < ₹50 crore ✓ — first condition met.
Borrowings ₹30 crore > ₹25 crore ✗ — second condition NOT met.
Conclusion: The exemption does NOT apply. The auditor must report on adequacy and operating effectiveness of IFC in the audit report.
### Example 2
Example — Director's responsibility for IFC:
During audit of a listed company, the auditor finds that the purchase approval workflow in the ERP was bypassed 23 times during the year.
Significance: Under Section 134(5)(e), the Directors are required to confirm IFC are adequate and operating effectively. These 23 bypasses represent a deficiency that must be evaluated and communicated — potentially impacting the Directors' statement and the auditor's IFC opinion under Section 143(3)(i).
⚠️ Common exam mistakes
Confusing IFC exemption conditions — both the size condition (OPC/small company OR turnover < ₹50 crore) AND the borrowings condition (< ₹25 crore) must be satisfied together; either one alone is insufficient for exemption.
Thinking Section 134(5)(e) applies to all companies — it applies only to listed companies; unlisted companies have a different directors' responsibility statement.
Treating IFC as synonymous with all internal controls — IFC specifically focuses on financial reporting integrity, not all operational controls.
Forgetting independent directors have a role — Schedule IV under Section 149(8) places specific IFC-related obligations on independent directors, not just management.
Bare-Act text Sections 134(5)(e), 143(3)(i), 177(4)(vii), 149(8) read with Schedule IV · Companies Act, 2013 · click to expand
Section 134(5)(e): In case of listed Companies, the Directors' responsibility statement shall state that the Directors had laid down Internal financial controls to be followed by the company and that such Internal financial controls are adequate and were operating effectively.
Section 143(3)(i): The auditor's report shall state whether the company has adequate Internal financial controls system in place and also on the operating effectiveness of such controls. This requirement shall not apply to a private company which – (i) is One Person Company or a small company; or (ii) has turnover less than ₹50 crore as per latest audited Financial Statements; and which has aggregate borrowings from banks or financial institutions or any body corporate at any point of time during the financial Year for less than ₹25 crore.
Section 177(4)(vii): Every audit Committee shall act in accordance with the terms of reference specified in writing by the Board which shall, inter alia, include – evaluation of internal financial controls and risk management systems.
Section 149(8) read with Schedule IV: The company and independent directors shall abide by the provisions specified in Schedule IV (Code for Independent Directors). As per this code, independent directors shall satisfy themselves on the integrity of financial information and that financial controls and the systems of risk management are robust and defensible.