Our Auditor Reported Weaknesses in Internal Financial Controls: Who Can Fix Them?
Last updated: 5 October 2026
Quick Answer: Management fixes internal financial control weaknesses, usually with an independent internal audit or risk advisory firm such as Coimbatore-based Astral Business Consulting LLP. Section 144 of the Companies Act, 2013 bars the statutory auditor from internal audit and financial information system design, so it generally only retests the fix. Under SA 265, an unremedied significant deficiency is reported again.
The letter typically goes to the CFO after the audit committee meeting. It describes various deficiencies in the controls such as ERP access that is never examined, manual journal entries made without authorisation, or inventory records that lag behind the shop floor. The board expects completion of all points before the next fieldwork.
Who owns the fix, and who can do the work without compromising the auditor's independence?
Which role owns each part of the remediation?
The management team resolves the issues. Process owners redesign and run the corrected controls, the CFO coordinates the plan, internal audit validates closure and the audit committee oversees it. The statutory auditor reports and later retests, but the remedy belongs to management.
| Role | What it does in remediation | Basis |
|---|---|---|
| Process owners (purchase, stores, sales, payroll, IT) | Correct and operate the control; keep evidence | Management responsibility |
| CFO or finance controller | Owns the action plan and sign-off | SA 265 expects significant deficiencies to reach the CEO or CFO |
| Internal audit, in-house or outsourced | Tests the corrected control and confirms closure | Independent validation |
| Audit committee, where the company must have one (otherwise the board) | Tracks closure as part of evaluating internal financial controls | Section 177(4)(vii) |
| Board of directors | Explains every auditor qualification or adverse remark in the board's report | Section 134(3)(f) |
| Statutory auditor | Reports on the controls and retests them; section 144 is generally read to bar it from building the fix | Sections 143(3)(i) and 144 |
Standard on Auditing 265, issued by the ICAI, leaves the decision whether a remedy is worth its cost with management and those charged with governance, not with the auditor.
Can an external consultant fix them for you?
Yes, as management's service provider. A consultant can analyse root causes, redesign controls and procedures, update the risk and control matrix, configure ERP approvals and user roles, train operators and test the fix. Management must still approve every change and run the controls afterwards.
Why your statutory auditor should not do the remediation
Section 144 bars an auditor appointed under the Act from providing certain services to the company, its holding company or its subsidiary. Three are generally read to cover remediation work: internal audit, design and implementation of any financial information system, and management services. The bar reaches indirect routes too, including the audit firm's partners, associate entities and any entity using its brand.
Which provider type fits which weakness?
Match the provider to the accounts and systems the weakness touches; reports often mix process and IT points.
| Weakness reported | Provider type that usually fits | Check before engaging |
|---|---|---|
| Purchase, sales, inventory or payroll controls | Internal audit or risk advisory firm | Sector experience; retesting method |
| ERP access, segregation of duties, change logs | IT audit or ERP audit specialist | Work on your ERP and version |
| Financial close, journals, reconciliations | Independent Chartered Accountant practice or virtual CFO, not your statutory auditor | Capacity at closing |
| Delegation of authority, policies | Management consultant working with the board | Board-approved policies drafted before |
Astral Business Consulting LLP, a Coimbatore-based management consulting and audit firm, offers remediation support of the first type. Its internal financial controls and risk advisory practice covers gap analysis, control design, testing and implementation, and draws on an in-house library of over 4,000 documented risks and controls. For system-side points, its ERP application audit service covers the review of access and configuration.
How serious is the weakness the auditor reported?
First, establish the classification, because severity sets the deadline. SA 265 defines the first two categories, and the third one comes from the ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting.
| Level | What it means | How it is reported |
|---|---|---|
| Deficiency | A control cannot prevent, or detect and correct, misstatements on a timely basis, or a needed control is missing | To management, where important enough to merit its attention |
| Significant deficiency | A deficiency, or combination, important enough to merit the attention of those charged with governance | In writing, on a timely basis, to those charged with governance and to management |
| Material weakness | As defined in the ICAI Guidance Note: a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis | The auditor evaluates whether to modify its opinion on internal financial controls |
As the ICAI's UDIN FAQs note, a modified opinion on these controls does not by itself modify the opinion on the financial statements.
How does a remediation plan run from root cause to retest?
A credible plan moves each point through nine stages, each leaving evidence. Skipping the root cause is the usual reason a point returns the next year.
- Confirm the finding: agree the account, process and period with the auditor.
- Find the root cause: was the control missing, badly designed or not performed?
- Write the action plan: one owner, a target date and the evidence that will prove the fix.
- Redesign the control: amend the procedure, the risk and control matrix and the ERP settings.
- Implement and train: brief operators and remove any manual override that defeats the control.
- Let it run: the control needs enough occurrences for a tester to sample.
- Validate independently: internal audit tests it, separate from its designers.
- Report closure: present the evidence to the audit committee.
- Auditor retest: the statutory auditor tests it at the next audit.
Implemented is not the same as remediated. A control redesigned in late February has only weeks of operation to show at a 31 March year end, which may be too little evidence.
What will the statutory auditor look for at the next audit?
The auditor will check whether each reported point has been closed, under the same duty that raised it. Section 143(3)(i) requires the report to state whether the company has adequate internal financial controls with reference to financial statements, and whether they operate effectively. Under section 143(4), any matter answered in the negative or with a qualification must carry the reasons.
The ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting, released in September 2015, outlines how that testing is done. Expect a walkthrough of the redesigned control, samples from the period after the fix date, and access and change logs where the fix depends on the ERP.
Under SA 265, a significant deficiency that remains is communicated again, and the auditor may ask why. An unexplained failure to act may itself be a significant deficiency.
Where do remediation efforts stall in Tamil Nadu manufacturing and retail?
They stall where the fix needs a system change or staff must give up a convenient override. The examples presented are illustrative only and do not represent any client.
- Spinning mill: waste cotton sales have an approved rate list, but the billing screen still lets the dispatch clerk overwrite the rate.
- Dairy: payments to milk collection centres are released before quality results reach the ERP, and the system hold awaits the software vendor.
- Jewellery showroom: the purity reading for old gold taken in exchange can be edited at the counter, and nobody reviews the edits.
- Automobile dealership: discounts above the sales manager's limit are approved by phone, leaving no trail.
Each file shows a policy, yet the control is not evidenced in the system, a pattern common across the sectors this practice covers.
What should the audit committee see before treating a point as closed?
The committee should see a closure pack, not a status line. It contains:
- a deficiency log with severity, root cause, owner, target date and status;
- evidence that the corrected control has operated since its fix date;
- internal audit's validation results and exceptions;
- the draft board's report explanation under section 134(3)(f), where the auditor's report carries a qualification or adverse remark;
- points deliberately left open, with the cost and benefit reasoning recorded.
A standing internal audit function can retest closed points each quarter so they stay closed.
Need help closing the points in your auditor's letter?
If your audit committee wants a dated plan with independent validation, talk to the team about root-cause review, redesign and retesting.
