ICFR Audit & IFC Support Services –
Section 134(5)(e) and 143(3)(i) Compliance, COSO Framework, RCM Design & TOD / TOE Testing
ICFR audit and IFC support together meet the Companies Act 2013's mandate for robust internal financial controls. Section 134(5)(e) requires the Director's Responsibility Statement to confirm that internal financial controls are adequate and operating effectively, and Section 143(3)(i) requires the statutory auditor to report on ICFR adequacy and operating effectiveness. Every covered company must build, document, test, and report on its IFC system each year.
Overview
End-to-End ICFR Audit & IFC Implementation
N D Savla & Associates handles complete ICFR audit and IFC support engagements for listed companies, large private companies, public companies, and group entities across Maharashtra and pan-India. We design Risk Control Matrices (RCMs), conduct Test of Design (TOD) and Test of Operating Effectiveness (TOE), document deficiencies across the three-tier ICAI framework, and certify compliance for management and statutory auditors.
The Framework
The ICFR & IFC Statutory Framework
Four Companies Act provisions, the ICAI Guidance Note, and the COSO 2013 framework together build the ICFR architecture in India. The framework involves multiple layers of corporate governance accountability — Board, Audit Committee, independent directors, and statutory auditor each carry distinct ICFR responsibilities:
- Section 134(5)(e) — Director's Responsibility Statement on adequacy and operating effectiveness of internal financial controls
- Section 143(3)(i) — statutory auditor's certification on ICFR adequacy and operating effectiveness
- Section 177(4)(vii) — Audit Committee oversight responsibility over internal financial controls
- Schedule IV — independent directors' duty to verify the integrity of financial information
- ICAI Guidance Note — Audit of Internal Financial Controls Over Financial Reporting (September 2015, revised) — the technical standard
- COSO 2013 framework — five components and seventeen principles forming the design backbone for every ICFR engagement
- MCA notification GSR 583(E) dated 13 June 2017 — the private company exemption framework
Applicability
Who Needs ICFR Audit?
ICFR audit applicability depends on company type, size, and filing compliance. Listed companies always fall within the audit net while private companies enjoy threshold-based exemptions under the GSR 583(E) framework — but the exemption is conditional, and a single MCA filing default forfeits it:
- Listed companies — always applicable; both Section 134(5)(e) IFC reporting and Section 143(3)(i) auditor certification apply, with continuous Audit Committee oversight
- Unlisted public companies with paid-up capital ≥ ₹25 crore — full ICFR audit applies
- Other unlisted public companies — standard ICFR audit applies under Section 143(3)(i)
- One Person Companies (OPCs) — automatic exemption under GSR 583(E)
- Small companies — automatic exemption under GSR 583(E)
- Other private companies — exempt only if turnover < ₹50 crore AND borrowings < ₹25 crore (conjunctive test)
- Private companies crossing either threshold — full ICFR audit applies
- Section 137 / 92 default — exemption forfeited; ICFR audit becomes mandatory regardless of size
MCA filing discipline directly drives ICFR audit applicability for private companies — a single default in financial statement filing under Section 137 or annual return under Section 92 brings the company back into full ICFR scope.
Core Audit Pillars
Risk Control Matrix & TOD / TOE Testing
Every ICFR audit revolves around two technical pillars — the Risk Control Matrix that maps risks to controls, and the two-layer testing process that evaluates whether those controls are properly designed and actually working.
Risk Control Matrix (RCM) — The Core Document
The RCM is the single source of truth for the entire engagement. Construction starts with process-level risk identification across procure-to-pay, order-to-cash, hire-to-retire, record-to-report, fixed assets, treasury, and tax. Every process generates risks at the financial-statement-assertion level. The matrix lists each risk alongside the control owner, control description, frequency, control type, and assertion mapping. A well-built RCM doubles as both management's self-assessment tool and the statutory auditor's testing reference.
Test of Design & Operating Effectiveness
TOD checks whether the control is logically capable of preventing or detecting material misstatement — verified through one walkthrough per control. Design failures call for control redesign before any TOE work begins. TOE then verifies actual control operation through sample-based attribute testing aligned to control frequency — typically 25 samples for daily controls, with smaller samples for less frequent controls per ICAI Guidance Note norms. Exceptions trigger root-cause analysis and remediation before the audit conclusion is finalised.
COSO 2013 Components
The Five COSO Components Plus IT General Controls
The COSO 2013 framework anchors every ICFR audit in India. The framework defines five integrated components — and IT General Controls underpin the automated portions of all five. Every ICFR audit tests these areas in an integrated assessment.
Tone at the top — integrity, ethics, governance oversight, management philosophy, organisation structure, authority delegation, and HR policies.
Identification and analysis of financial-reporting risks at the assertion level for each significant account and process.
Policies and procedures that mitigate identified risks — preventive and detective controls across business processes.
Flow of relevant, timely information to control owners, management, and the Audit Committee — internal and external reporting channels.
Ongoing assessment of control effectiveness through management review, internal audit, and continuous monitoring tools.
Access management, change management, backup procedures — underpinning every automated business control across all five COSO components.
Our Methodology
Deficiency Classification & Common Problem Areas
Every control deficiency identified during ICFR audit needs proper classification — the ICAI Guidance Note recognises three deficiency tiers, and classification accuracy directly drives the Section 143(3)(i) auditor's report. Our methodology is built around the five anchors below.
Three-Tier Deficiency Classification
Control deficiency (lowest — single-instance failures, management letter); significant deficiency (communicated to Audit Committee in writing); material weakness (highest — reasonable possibility of material misstatement, triggers adverse Section 143(3)(i) opinion).
Segregation of Duties & Journal Entry Controls
The most frequently flagged ICFR deficiency — conflicts arise when one person both initiates and approves transactions. Manual journal entries posted at period-end are particularly susceptible. Strong review controls and ERP-based approval workflows mitigate both risks.
IT General Controls & Access Management
ITGCs underpin every automated business control — weak access management, change management, or backup procedures undermine all dependent controls. ITGC testing always runs alongside business-process controls; remediation typically delivers the highest leverage on overall ICFR strength.
Reconciliation, Estimation & Period-End Controls
Bank, vendor, and intercompany reconciliations carry high financial-reporting risk. Accounting estimates require management judgment that controls must moderate. Reconciliation discipline supports both audit and tax compliance — period-end is where most material weaknesses surface.
Statutory Auditor & Audit Committee Coordination
Every engagement is calendared against the statutory audit timeline — early kickoff in Q3 of the financial year is the standard timeline anchor. Outputs feed Section 134(5)(e) Director's Responsibility Statement and Section 143(3)(i) auditor reporting; deficiencies are briefed to the Audit Committee under Section 177(4)(vii).
Frequently Asked Questions
ICFR Audit & IFC Support – FAQs
ICFR Audit on the Calendar? Run RCM Design, TOD & TOE Under One Coordinated Team.
N D Savla & Associates handles applicability scoping, COSO 2013 implementation, RCM design, Test of Design and Operating Effectiveness, deficiency classification, and Section 143(3)(i) reporting support — all aligned to your statutory audit calendar. Reach out to discuss your ICFR engagement.
Ready to scope your ICFR audit engagement?
Talk to our team about applicability mapping, COSO 2013 implementation, RCM design, TOD/TOE testing, and Section 143(3)(i) reporting support — under one coordinated workplan.
Get in Touch
