Internal Financial Controls - Guidance Is Here!

The new Companies Act 2013 requires auditors to separately issue an opinion on whether the company has an adequate internal financial controls (IFC) system in place and the operating effectiveness of such controls – this is in addition to the existing audit opinion on the financial statements. This new requirement is effective for the year ending March 31, 2016. The ICAI has finally reissued the long awaited “Guidance Note on Audit of Internal Financial Controls over Financial Reporting” which provides detailed guidance on this topic. What does IFC encompass?The Guidance note provides the necessary criteria for maintaining an effective IFC for companies. It draws reference to the Internal Control Components” of SA 315, “Identifying and Assessing the Risks of Material Misstatement Through Understanding the Entity and its Environment” which includes the following 5 components that should exist:i.    Control environmentii.    Entity’s risk assessment processiii.    Control activitiesiv.    Information system and communicationv.    Monitoring of controls.The Guidance note explains that for auditor reporting, the term IFC is restricted within the context of audit of financial statements and relates to internal financial control over financial reporting only (ICFR). This is also consistent with the practice adopted internationally for example SOX reporting in the U.S. This is a relief as it removes the unnecessary ambiguity by excluding from the scope operational controls i.e. those facilitating the effectiveness and efficiency of company’s operations and also differentiates ICFR from Enterprise Risk Management and Risk management policies which Boards of companies have to maintain. To whom does this apply?The Guidance note clarifies that reporting on ICFR by auditors will be applicable for both listed and unlisted companies, including small and one person companies . Further, it also states that auditors will have to report on ICFR in respect of both standalone and consolidated financial statements. For consolidated financial statements, it will cover Indian subsidiaries, joint ventures and associates components of the Group since Companies Act applies to such entities. When does this apply and for which period financial statements?The auditors will have to report whether the company has an adequate ICFR system in place and whether the same was operating effectively as at the balance sheet date of March 31, 2016. In practice this will mean that when forming the audit opinion on IFC, the auditor will surely test transactions during the financial year ending March 31, 2016 and not just as at the balance sheet date, though the extent of testing at or near the balance sheet date may be higher. If control issues or deficiencies are identified during the interim period and are remediated before the balance sheet date, then the auditor may still be able to express an unqualified opinion on the ICFR. For example, if deficiencies are discovered, management may have the opportunity to correct and address these deficiencies by implementing new controls before the reporting date. However, sufficient time will need to be allowed to evaluate and test controls, which again will depend on the nature of the control, how frequently it operates and would be a matter of professional judgement. This is particularly important for companies for the current year March 31, 2016 as it will be the first year when auditor attestation of ICFR will be required. Further, reporting on IFC will not apply to interim financial statements, such as quarterly or half-yearly, unless such reporting is required under any other law or regulation. ReportingPer the Guidance note, the auditors will have to issue a qualified or an adverse opinion on ICFR if material weaknesses in the Company’s ICFR are identified as part of their audit. Material weakness’ is a deficiency, or a combination of deficiencies, in internal financial control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company's annual or interim financial statements will not be prevented or detected on a timely basis. A material weakness in internal financial controls may exist even when the financial statements are not materially misstated. The Guidance note also specifies indicators of material weaknesses, such as:• Identification of fraud, whether or not material, on the part of senior management;• Errors observed in previously issued financial statements in the current financial year;• Identification by the auditor of a material misstatement of financial statements that would not have been detected by the company's internal financial controls over financial reporting; and• Ineffective oversight of the company's external financial reporting and internal financialcontrols over financial reporting by the company's audit committee.An adverse opinion will be issued if such matters are pervasive to the financial statements i.e. those impacting various or substantial portion of financial statements accounts or items. Additionally, significant control deficiencies will also have to be reported to the audit committee. Comparison with international practicesIt is interesting to note that the Guidance note is quite similar to the PCAOB auditing standard No. 5 applied by auditors in context of SOX reporting in the US. For example various paragraphs from the US auditing standard have been inserted within the Guidance note, including definitions such as significant deficiency and material weakness related to internal controls. What next?The Guidance note is a fairly comprehensive document covering 200+ pages with detailed guidance in several areas related to internal financial controls such as the internal control components, entity level controls, Information Technology controls, understanding and documentation of process flows including flow charts, use of service organizations, sampling etc. Accordingly, both the management and auditors will have to quickly familiarize themselves and decipher the details of this Guidance note in order to gear up for the year-end March 31, 2016 reporting on internal financial controls!

Read the ICAI’s Guidance Note on Audit of Internal Financial Controls Over Financial Reporting here http://thefirm.moneycontrol.com/story_page.php?more_category=resource_center&autono=3093801