Content authored by practitioners with experience at Amazon India, Intuit QuickBooks, and the Tata Group. Meet the team →
A finance team does not know what internal financial controls are or what evidence the auditor will ask for.
Start with six controls (approvals, vendor master changes, bank reconciliation, segregation, access, month-end review) and keep dated evidence that each operated.
A control list with owner, frequency, evidence and reviewer sign-off for each control.
Controls that are designed well, operated all year and can be shown to the auditor.
Internal financial controls are the checks built into your accounting: approvals, reconciliations, access limits and document checks that keep the books accurate and the company’s money safe. Under Section 143(3)(i) of the Companies Act 2013, the auditor of a company that is not exempt must state whether the company has adequate internal financial controls over financial reporting and whether they operated effectively.
Which six controls can a small finance team start with?
| Control | What it prevents | ₹ example | Evidence an auditor accepts |
|---|---|---|---|
| Payment approval limits | Large payments without sign-off | Any payment above ₹1,00,000 needs a second approver | Approval trail in the bank portal or ERP |
| Vendor master change check | Payments diverted to a fraudster’s account | A changed bank account is confirmed by phone before use | Change log with call note and approver |
| Monthly bank reconciliation | Missing, duplicate or unauthorised entries | A ₹45,000 duplicate payment spotted in the month | Signed, dated reconciliation each month |
| Segregation of duties | One person creating and paying a bill | The person who books invoices cannot release payments | Role list in the ERP and bank portal |
| System access limits | Unauthorised changes to records | Only two users can edit posted entries | User access report, reviewed quarterly |
| Month-end review | Errors in accruals and balances | A ₹2,40,000 accrual booked twice | Reviewer sign-off on the trial balance |
Which companies need the auditor’s report?
Every company’s auditor reports under Section 143(3)(i), with one exemption. An MCA notification of 13 June 2017 exempts private companies with turnover below ₹50 crore and aggregate borrowings from banks and financial institutions below ₹25 crore at any time in the year, provided they meet the notification’s other conditions, such as being up to date on annual filings. ICAI’s guidance note sets out how auditors carry out this work. Directors of listed companies have a separate duty under Section 134(5)(e) to say that adequate controls were in place.
What is the difference between a control that is designed well and one that operated?
A control can fail in two ways.
- Design: would the control catch the problem if it were done? A rule that only the finance head approves payments is well designed for preventing unapproved payments.
- Operation: was it actually done, every time, all year? If the finance head shared their login with an assistant for three months, the control was designed well but did not operate.
The auditor tests both. For operation, they pick a sample, for example 25 payments across the year, and look for evidence that each one went through the control.
Worked example: a vendor bank-account change
A supplier email asks the accounts team to change its bank account. A junior accountant updates the vendor master the same day. The next payment run sends ₹3,75,000 to the new account. A week later, the real supplier calls to ask where its money is. The email was fake.
The one control that would have caught it is a vendor master change check: any bank-account change is confirmed by calling the supplier on a number already on file, and a second person approves the change before the next payment run. With that control, the ₹3,75,000 payment would have stopped at approval. The monthly bank reconciliation would also have shown a payment to an account that did not match the supplier’s earlier payments, but only after the money had gone.
Why does bank reconciliation come up first?
Because almost every error or fraud involving cash passes through the bank account. A monthly reconciliation, prepared by one person and reviewed by another, with every reconciling item explained and dated, is the control auditors most often test first.