An internal control audit asks two things about a company's controls over financial reporting: are they designed well enough, and did they actually operate during the year? In India the statutory auditor answers this in the audit report under section 143(3)(i) of the Companies Act, 2013, using the ICAI Guidance Note on the subject.
Last reviewed: 17 October 2026. Facts checked. We opened search summaries of the ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting (preface-level content and commentary) and a KPMG summary of its revision. We could not open the full Guidance Note, the text of section 143(3)(i) or the Companies (Auditor's Report) Order. Exemptions for certain companies are not listed here because we could not verify them; check the Act and the MCA notifications for your client.
What the law asks
Per the Guidance Note's preface, section 143(3)(i) requires the auditor to state whether the company has an adequate internal financial controls system in place and whether those controls are operating effectively. The same preface notes that reporting on internal financial controls is not covered by the Standards on Auditing, which is why the Guidance Note exists. Section 134(5)(e) defines internal financial controls broadly, and the Guidance Note treats the auditor's reporting as relating to controls over financial reporting.
If you want the contrast with the US-style SOX regime, see SOX controls vs IFC in India.
Design versus operating effectiveness
- Design: Would this control, if it works, prevent or catch a material misstatement? A bank reconciliation reviewed by someone who also posts the entries is poorly designed.
- Operation: Did the control run, on time, by the right person, through the year? A well-designed approval that is skipped at quarter end fails here.
Commentary on the Guidance Note says controls should be tested across the year under audit, not just around the balance sheet date, though testing may be heavier near it.
A practical flow
1. Scope the financial statement areas
Start from what is material: revenue, purchases, payroll, fixed assets, inventory, borrowings, tax and the close process. Controls over areas that cannot hold a material misstatement need less attention.
2. Document the process and the key controls
For each area, write the flow in plain steps, name the control (for example three-way match before payment), who performs it and what evidence it leaves. A risk and control matrix is the usual format; our inventory controls checklist shows one for stock.
3. Test design by walkthrough
Follow one transaction from start to finish. Ask the person doing it to show, not tell.
4. Test operation by sample
Select items across the year, using a rational sample. The audit sample selector can help with selection. Look for the evidence the control should leave: signatures, system logs, approvals with dates.
5. Evaluate deficiencies
List each exception, ask what could go wrong because of it, and whether another control compensates. Group related deficiencies; two small gaps in the same process can add up.
6. Conclude and report
Depending on the severity, the report may say controls are adequate and operating effectively, or it may point to material weaknesses. Use the wording in the Guidance Note.
Where small and mid-size companies struggle
- Controls live in people's heads. There is no written procedure, so the auditor writes it with management and then tests it.
- Spreadsheet dependence. Key calculations sit in files anyone can edit. Look for version control and access.
- Owner override. A promoter approves payments outside the system. This is a control environment issue as much as a transaction issue.
- IT access. One user can create a vendor, enter an invoice and release the payment. Our ITGC guide covers testing user access.
ICAI has also published an implementation guide aimed at smaller, less complex companies, according to the sources we saw; we could not confirm its edition date.
Example
A distributor with eight branches has branch managers who approve their own discount credit notes. The auditor's walkthrough shows no second approval. Sample testing finds 14 of 40 sampled credit notes above the branch's own limit, none escalated. The auditor records a deficiency in design and operation, assesses whether head office reviews of margin compensate, finds the review is monthly and does not name individual notes, and discusses the gap with the audit committee.
The numbers here are made up to show the method.
Frequently Asked Questions
Is an internal control audit the same as an internal audit?
No. An internal audit is an assignment by management for management. The control audit is part of the statutory audit report for the specified companies.
Does it apply to every company?
Section 143(3)(i) applies to companies unless exempted. Check the exemption conditions currently in force.
Is it the same as CARO 2020 reporting?
No. CARO has its own clauses, including one on internal audit systems. The two reports serve different purposes; see the CARO 2020 clause guide.
What framework should be used?
The Guidance Note does not mandate one. COSO is widely used; see the COSO 2013 guide.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error