Internal financial controls: documenting and testing

Section 134(5)(e) of the Companies Act, 2013 requires the directors of a listed company to state that they have laid down internal financial controls and that these are adequate and operating effectively. For all companies, the directors’ responsibility statement and the Board’s report refer to the adequacy of internal financial controls with reference to the financial statements.

What “internal financial controls” covers

The Act describes them as the policies and procedures adopted to ensure the orderly and efficient conduct of business, including:

• adherence to company policies;
• safeguarding of assets;
• prevention and detection of frauds and errors;
• accuracy and completeness of accounting records; and
• timely preparation of reliable financial information.

A practical approach

1. Scope. Identify significant accounts and the processes that feed them: revenue, purchases, inventory, payroll, fixed assets, treasury and financial closing.
2. Document. For each process, prepare a short narrative or flowchart and a risk and control matrix listing each risk, the control that addresses it, the control owner and frequency.
3. Design test. Walk through one transaction end to end to confirm the control exists as described.
4. Operating test. Test a sample across the year. Sample sizes depend on frequency: more for daily controls, fewer for quarterly ones.
5. Evaluate. Classify each failure as a deficiency, a significant deficiency or a material weakness, depending on the potential effect on the financial statements.
6. Report and remediate. Agree corrective actions and retest after they are implemented.

Sample sizes often used

Common gaps

• Controls performed but not evidenced (no sign-off or review trail).
• ERP access not reviewed; users with conflicting rights.
• Manual journal entries without independent review.
• Month-end reconciliations prepared but not reviewed.

Official sources

• Ministry of Corporate Affairs — Companies Act, 2013