New Companies Act, 2013 has stated specific responsibilities on the Board and Audit Committee of listed companies towards the Company's internal financial controls. The provisions of the Act, inter alia, requires the "Board to state that they have laid down Internal Financial Controls (IFC) to be followed by the Company" and that such internal financial controls are "adequate and operating effectively".
Statutory Auditors of all companies are also required to report on the "adequacy and operating effectiveness" of the Company's internal financial control system. These changes are effective from the financial years beginning on or after 1st April 2014. Auditor's reporting on IFC made voluntary for year ending 31st March 2015 and made mandatory for financial years beginning on or after 1st April 2015. However, no deferment has been provided to reporting by the Directors of a Company in the board report.
According to the Companies Act 2013, the term IFC has been defined as "The policies and procedures adopted by the company to ensure orderly and efficient conduct of its business, including adherence to company's policies, safeguarding of its assets, prevention and detection of frauds and errors, accuracy and completeness of accounting records and Timely preparation of reliable financial information".
However, the expanded coverage and focus goes way beyond the above definition & includes all "key elements" of a Controls Framework, such as tone at the top & culture within the Organization, Company policies and standard operating procedures, controls design, operating efficiency of these controls, continuous controls monitoring & Management reporting process.
Currently, many companies are assessing the impact these new requirements will have on their operations & processes. While Companies continue looking to their internal auditors to help them deliver a more sustainable, efficient and effective audit function, there is ambiguity in the minds of the Board, Audit Committee and internal auditors themselves on the changes needed in their roles to fulfill these new IFC requirements.
Senior Management in consultation with the Board and Audit Committee must sense the urgency & act expeditiously on the IFC requirement. This will ensure adequate assurance provided to the Board and Audit Committee so that they can report on the adequacy and the operating effectiveness of IFC by 31st March 2015. Based on our experience, globally where reporting on ICFR has been mandated, it would be reasonable to expect, that significant efforts will be required to establish robust IFC systems.
For effective IFC certification by all stakeholders, a demonstrable documented framework for internal financial controls is required. Documentation of controls that actually mitigate the risk of significant misstatements and provide requisite accountability for financial reporting structure, fraud risks and controls at the process level that must be understood clearly and the testing of operating effectiveness of these controls.