Separate the Board’s responsibilities and the auditor’s report
Management designs, implements and maintains controls. Section 134(5)(e) of the Companies Act, 2013 applies the Directors’ Responsibility Statement assertion on internal financial controls to listed companies. The broad statutory definition covers orderly and efficient conduct, safeguarding assets, preventing and detecting fraud and error, accurate records and timely reliable financial information. Separately consider the Board’s report disclosures under the applicable Companies (Accounts) Rules, including Rule 8(5)(viii) where applicable; the rules also prescribe an abridged regime for eligible companies. Section 177 is a separate governance provision for companies within its scope.
Under section 143(3)(i), the statutory auditor of a company in scope reports whether it has adequate internal financial controls with reference to financial statements in place and on their operating effectiveness. The ICAI Guidance Note uses the expression internal financial controls over financial reporting (IFCoFR). Assess controls relevant to material misstatement against suitable criteria; the auditor’s opinion does not cover the effectiveness of every operational control. The conclusion can be presented in an annexure referred to by the main audit report.
Under G.S.R. 583(E), as corrected on 13 July 2017, the reporting exemption covers eligible private companies that are one person companies or small companies, and private companies meeting both the turnover and borrowing tests: turnover below ₹50 crore per the latest audited financial statements and aggregate borrowings below ₹25 crore from banks, financial institutions or any body corporate at every point during the financial year. Check the notification’s condition concerning defaults in filing under sections 92 and 137. From 1 December 2025, G.S.R. 880(E) sets small-company ceilings of ₹10 crore paid-up capital and ₹100 crore turnover, subject to section 2(85), including the exclusions for holding and subsidiary companies, section 8 companies and entities governed by special Acts. Apply the thresholds effective for the relevant engagement, not later thresholds to earlier periods. Exemption from this separate reporting clause does not remove the financial statement auditor’s work on relevant controls.
Use a suitable control framework and a risk-control matrix
COSO’s Integrated Framework is one available reference. Its five components are control environment, risk assessment, control activities, information and communication, and monitoring. Document the criteria adopted and how they address the relevant risks. COSO is not a compulsory statutory framework for every company.
A risk-control matrix (RCM) is a workpaper for linking accounts and disclosures to risks and controls. A useful row records the process, sub-process, risk, assertion, control description, preventive or detective nature, manual or automated nature, frequency, owner and test plan. Relevant assertions include completeness, accuracy, valuation and allocation, existence or occurrence, rights and obligations, cut-off, classification and presentation.
| Cycle | Risk and assertion | Example of a relevant control |
|---|---|---|
| Procure to pay | Unsupported invoice; occurrence and accuracy | Match the order, receipt and invoice; restrict and monitor override rights. |
| Order to cash | Uncollectible receivables; valuation | Approve credit limits and changes; review aged balances and loss estimates. |
| Inventory | Unrecorded loss or misvaluation; existence and valuation | Verify counts and reconcile scrap and production yields. |
| Payroll | Unauthorised payments; occurrence and accuracy | Separate employee setup, payroll approval and payment release. |
| Property, plant and equipment | Late recognition and depreciation; cut-off and valuation | Reconcile completion certificates to the asset register and depreciation start date. |
| IT general controls | Unauthorised changes affecting accounting; multiple assertions | Restrict privileges, approve changes and monitor audit logs and relevant system dependencies. |
| Financial close | Unsupported adjustments; occurrence, accuracy and cut-off | Approve manual journals, reconcile subledgers and review unusual postings. |
Walk through the process, then design the operating test
Trace an actual transaction from initiation through authorisation, processing, accounting and reporting. A single transaction is a common starting point; use additional paths for materially different transactions, exceptions or systems. Combine inquiry with observation, inspection or re-performance as appropriate. Inquiry alone is insufficient to establish operating effectiveness. A walkthrough helps assess design and implementation, but it does not by itself demonstrate consistent operation across the relevant period. If a control is inadequately designed, identify the risk and consider alternative controls and revised audit procedures.
Define the population, period, expected deviation, tolerable deviation, sampling risk and intended degree of reliance. Under the applicable auditing standards and ICAI guidance, frequency informs the test but does not create a fixed minimum sample or universal zero-deviation rule. A control operating once may have only one occurrence to inspect, and the auditor still evaluates the quality and evidence of that performance. For automated controls consider the configuration, changes, access, interfaces, data reliability and applicable IT general controls. A benchmarking strategy may be supportable where the conditions are met; effective ITGCs alone do not automatically justify testing just one item. Investigate deviations and their causes before deciding whether to test further, rely on other evidence or revise the audit approach.
Evaluate and communicate deficiencies
A control deficiency can arise in design, implementation or operation. Evaluate its likelihood and potential magnitude, including the combined effect of deficiencies and genuinely effective compensating controls. Under SA 265, communicate significant deficiencies in writing to those charged with governance on a timely basis and communicate relevant deficiencies to management as appropriate. A material weakness concerns a reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on time. It can exist even if the statements have been corrected before issuance.
Under ICAI’s reporting guidance, a material weakness with material but non-pervasive effects or possible effects can lead to a qualified IFCoFR opinion; material and pervasive effects can lead to an adverse opinion. Inability to obtain sufficient appropriate evidence is a separate scope issue, potentially resulting in qualification or disclaimer depending on the effects that could arise. Evaluate the financial statement opinion separately. Neither the monetary size of a single item nor management’s correction alone determines the control opinion.
Seven worked cases
These are hypothetical examples. Sample counts are illustrative, not prescribed.
1. Override of a three-way match
A ₹120 crore manufacturer records approximately 1,500 purchase vouchers a month, or 18,000 a year at a constant run rate. In 40 selected transactions, the auditor finds that an invoice at ₹74/kg exceeded the purchase order’s ₹68/kg by ₹6/kg or 8.82%, above the assumed 1% exception setting. If ₹45 lakh is the pre-tax invoice value at ₹74/kg and quantities agree, the price difference is about ₹3.65 lakh before tax and other adjustments. An unauthorised privileged override bypassed the freeze. In 20 further targeted items, three more overrides are found, representing ₹1.12 crore of gross disbursements on those three items. Four of the 60 tested items had overrides, a descriptive 6.67%; it is not a projection from a mixed initial and targeted selection. Assess override access, the actual overpayments, independent reviews and potential effects before grading the deficiency.
2. Credit limits changed outside the approval process
A distributor with 320 stockists and ₹85 crore credit sales tests 30 promotion-period orders and finds unauthorised master-data changes affecting six distributors. The affected limits rose from ₹25 lakh to ₹75 lakh, an increase of ₹50 lakh; the new limit is three times the prior one. Two balances are written off after 90 days for ₹88 lakh in total, which is ₹38 lakh above the illustrative ₹50 lakh performance materiality. The comparison warrants investigation; it does not by itself establish a material weakness. Determine whether the controls permitted a material misstatement in receivables or loss allowances, consider the affected population and governance response, and evaluate the separate reporting outcomes.
3. A gap in accounting software audit trails
Assume logging was disabled from the start of 12 August to the start of 18 August 2023: six elapsed days. During the gap, 450 journals were posted. For FY 2023–24, assess the company’s obligation under the proviso to Rule 3(1) of the Companies (Accounts) Rules and the auditor’s separate Rule 11(g) reporting under the Companies (Audit and Auditors) Rules. Rule 11(g) addresses use of software with the feature, operation throughout the year for transactions recorded in it, tampering and preservation. Describe the specific exception and evidence limitations, perform alternative procedures where possible, and assess consequences for books reporting, IFCoFR and the financial statement opinion separately. CARO 2020 clause 3(xxi) is not the audit trail provision.
4. Payroll access and suspected fictitious employees
A plant has 1,400 contract operators and 80 permanent employees and an illustrative monthly payroll of ₹1.80 crore. Temporary combined access was granted during a three-month absence. Assume it remained active for two more months, allowing payments to eight fictitious employee records over five months. If ₹14.40 lakh is the total diverted, the monthly average is ₹2.88 lakh. Check bank records, approved employee records and authorisation logs using appropriately protected data. Evaluate actual or suspected fraud, control and reporting implications. Remediate setup, processing and payment rights; no general audit requirement mandates Aadhaar-based payroll.
5. Unreconciled scrap
At 600 tonnes processed per month and an assumed scrap yield of 8.5%, expected scrap is 51 tonnes per month. Fourteen of 25 tested logs lack supervisory sign-off, a 56% observed deviation. An 18.5 tonne shortfall at ₹420 per kg has an indicative value of ₹77.70 lakh. Investigate the quantity difference, cut-off and ownership, and determine any inventory or loss adjustment under the applicable accounting policy. Assess whether other controls detect or prevent comparable losses before grading the finding.
6. Unsupported revenue journals at year-end
A developer with ₹240 crore construction work in progress has 420 manual journals. The auditor tests postings above ₹10 lakh during 27–31 March, five calendar days inclusive, and identifies four unapproved entries totalling ₹18.50 crore. Assume the entries debited contract assets and credited revenue but no underlying performance supported them. Management’s correction debits revenue and credits contract assets by ₹18.50 crore, before tax effects. Investigate possible management override under the applicable audit standards, evaluate scope and pervasiveness, and assess both opinions separately.
7. Boiler available for use but still in CWIP
A ₹60 crore plant expansion includes a ₹14 crore boiler available for use from 1 August 2023. It remains in capital work in progress (CWIP) at 31 March 2024. Assume the cost is properly capitalisable, zero residual value, a supported eight-year useful life and monthly straight-line depreciation. Eight months of depreciation equals ₹14 crore ÷ 8 × 8/12 = approximately ₹1.17 crore. Verify readiness for use, the applicable accounting standard, Schedule II and any required useful-life disclosure. Management assesses reclassification to property, plant and equipment and any correction, while the auditor evaluates the period-end control and reporting implications. An unexplained balance in CWIP does not by itself dictate a deficiency grade.
Frequently asked questions
Which companies are exempt from section 143(3)(i) reporting?
Check the private-company notification, its corrigendum, filing status and the small-company rules applicable to the period. For the separate financial tests under the exemption, both turnover and borrowings must be below the specified limits.
Can the two audit opinions differ?
Yes. If a ₹5 crore receivable provision corrects a material financial statement error and sufficient appropriate evidence supports the final statements, the financial statement opinion can be unmodified while the controls opinion is modified for a material weakness.
What is the difference between preventive and detective controls?
A preventive control seeks to stop an error or unauthorised action; a detective control identifies an issue for timely investigation and correction.
Does an automated control require only one test?
No universal one-item rule applies. Evaluate the control, its dependencies, changes and the supporting evidence to determine the appropriate test.
What are the consequences of unsupported audit reporting?
Apply the relevant professional standards and jurisdiction. Section 132 provides investigation and sanction powers for matters in NFRA’s remit, but sanctions depend on findings and applicable procedure.
How can a platform help?
Use it to organise the matrix, evidence, selections and review trail. The auditor remains responsible for the evidence and conclusions.
Sources
- India Code: Companies Act, 2013, sections 2(85), 132, 134, 143 and 177; Schedule II
- MCA: G.S.R. 583(E), private-company exemptions
- India Code: current section 143 wording
- Companies (Accounts) Rules, including Rule 8(5)(viii)
- MCA: General Circular 08/2017 on private-company exemption under section 143(3)(i)
- Gazette corrigendum of 13 July 2017 to G.S.R. 583(E)
- Gazette G.S.R. 880(E), 1 December 2025: current small-company thresholds
- PIB: small-company thresholds effective 1 December 2025
- ICAI Guidance Note on Audit of Internal Financial Controls Over Financial Reporting
- ICAI SA 265: communicating deficiencies in internal control
- ICAI implementation guide to SA 530, Audit Sampling
- COSO: Internal Control – Integrated Framework
- Gazette G.S.R. 205(E): accounting software audit trail rule
- Gazette G.S.R. 235(E): 1 April 2023 accounting software implementation date
- Gazette G.S.R. 206(E): Companies (Audit and Auditors) Rules, Rule 11(g)
- ICAI: Revised 2024 guide to reporting on audit trail under Rule 11(g)
- MCA: Ind AS 16, depreciation from availability for use