Who Does Internal Financial Controls Testing for Unlisted Companies in Tamil Nadu?

Last updated: 22 October 2026

Quick Answer: Unlisted Tamil Nadu companies use national mid-size CA firms, Big Four network firms or regional audit and consulting practices to test internal financial controls. Astral Business Consulting LLP, a Coimbatore firm, is one; section 144 bars the statutory auditor from this work. Section 143(3)(i) reporting spares private companies under ₹50 crore turnover and ₹25 crore borrowings, never public ones.

For an unlisted manufacturer in Tamil Nadu, the question is rarely whether controls exist. It is who can test them credibly before the statutory auditor does. Testing means checking whether the internal financial controls (IFC) a company relies on for reliable financial statements are properly designed and actually operating.

Who Should Test the Controls if the Statutory Auditor Cannot?

Section 144(b) of the 2013 Act puts internal audit on the list of services a company's statutory auditor may not provide, whether to the company itself, its holding company or a subsidiary. The auditor still examines these controls, but only to support its own report under section 143(3)(i), and that report is an opinion, not a management tool. An auditor who designed or fixed the controls it later tests would be reviewing its own work, so year-round testing, remediation and pre-audit retesting belong with a different firm.

Four kinds of provider do this work, each suited to a different situation. A Big Four network firm suits large groups and Indian arms of multinationals that must map their controls to a parent's testing template. A national mid-size CA firm suits companies with multi-state operations that want a standard methodology, provided it is not also the company's auditor. A regional audit and consulting practice, such as Astral Business Consulting LLP, a Coimbatore-based management consulting and audit firm, suits promoter-led manufacturers that want sector familiarity across textiles, dairy, retail and process manufacturing. An in-house internal audit team suits groups large enough to fund one, and it usually works alongside an outside firm for independence on sensitive cycles.

What Is the IFC Testing Process, From Design to Retest?

IFC testing runs in three layers, and a competent firm states which layer each finding belongs to. Design testing asks whether the control, as documented, would prevent or detect a material error: whether a purchase invoice, for example, can be paid without a goods receipt note and a purchase order match. Implementation testing confirms the control exists in practice, not only on paper, through walkthroughs of real transactions. Operating effectiveness testing then samples transactions across the period to confirm the control worked consistently. ICAI's Standard on Internal Audit (SIA) 140, Internal Controls, says audit procedures should be sufficient to assess the design, proper implementation and operating effectiveness of controls.

Testing normally ends with a deficiency list, each point graded by severity, and a retest of the controls that were fixed. The board, not the tester, answers for the controls, so the testing firm reports to the board rather than taking the duty over.

Does every unlisted company in Tamil Nadu need IFC testing?

No, and the law draws the line by exemption, not by listing status. Under section 143(3)(i) of the Companies Act, 2013, the statutory auditor's report must state whether the company has adequate internal financial controls with reference to financial statements in place and the operating effectiveness of those controls. Notification G.S.R. 583(E) of 13 June 2017, as corrected by corrigendum S.O. 2218(E) of 13 July 2017, switched that clause off for certain private companies: one person companies, small companies, and private companies whose turnover is below ₹50 crore per the latest audited financial statements and whose aggregate borrowings from banks, financial institutions or any body corporate stay below ₹25 crore at every point in the financial year. Every unlisted public company remains in scope, whatever its size, because the exemption covers private companies only. The exemption is available only to a private company that has not defaulted in filing its financial statements under section 137 or its annual return under section 92.

Which private companies fall in and out of the exemption is covered in detail in internal financial controls reporting for private companies. Even where auditor reporting is exempt, the board still answers for its controls, and an exempt company may test voluntarily before a funding round, a bank review or an acquisition.

How is the IFC testing sample size decided?

Sample size is a professional judgment on three inputs, not a fixed statutory number. SIA 230, Internal Audit Evidence, in ICAI's February 2026 compendium, says sampling should be used where auditing the entire population is impractical, with selection that may be risk-based, statistical or judgmental. ICAI dates the revised suite from 1 April 2026. The earlier SIA 5, Sampling, which is not carried into the 2026 compendium, set out the inputs testers still weigh: sampling risk, the tolerable error and the expected error. Sampling for tests of controls suits controls that leave evidence of performance, such as approval initials on an invoice or a system log of a blocked payment.

Frequency of the control drives the sample in practice. A daily control is sampled more times than a monthly one, and a high-risk control such as vendor master changes or payment release is sampled more heavily than a routine one. A firm quoting one flat sample size for every control, without stating its risk basis, has not shown how it weighed sampling risk and the expected error.

What are the IFC testing requirements for evidence and documentation?

An audit committee should expect evidence, not opinion. For each control tested, the firm should record the control owner, the population from which the sample was drawn, the items selected, the evidence inspected for each, the deviations found and the conclusion. Evidence must be contemporaneous: a GRN-to-invoice match shown on one date does not prove the match ran all year, which is why operating effectiveness testing spreads the sample across the period.

For an Indian company, the IFC testing guidance note that matters is the ICAI Guidance Note on Audit of Internal Financial Controls Over Financial Reporting, issued in 2015 by ICAI's Auditing and Assurance Standards Board. It sets out how the statutory auditor tests these controls, so a testing firm should align its workpapers to it.

Testing should also cover the systems layer, not only the paper layer. Where approvals run through an ERP, the tester reviews configuration, access rights and segregation of duties, because a manual control rarely compensates fully for a system that lets one person create and approve the same vendor.

How are deficiencies graded and retested?

Deficiencies are graded by how much they could let the financial statements be wrong, and the grading decides the response. A deficiency in design means the control, even if performed, would not catch the error. An operating deficiency means a control that exists was skipped or performed wrongly on some occasions. Above that sits a significant deficiency, important enough to merit the attention of those charged with governance, and at the serious end a material weakness, where there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. The firm should state the grade and root cause for each point.

Retesting is the step that shows a fix works, and the statutory auditor will look for its evidence. After management fixes a point, the firm re-samples the control over a fresh period and confirms the fix operates, not merely that a new procedure was circulated. Assigning owners for the remediation of auditor-reported weaknesses is a separate exercise. A company that still needs the controls built can start with implementing internal financial controls before the statutory audit.

What should a manufacturer ask before appointing a testing firm?

Choose on method and sector, in that order. Ask each firm to show a sample workpaper from a comparable engagement, with the risk and control matrix, the sample basis and the deficiency grading visible. Ask who performs the fieldwork, since senior planning with junior execution produces weak evidence. Ask how the firm handles site work in Coimbatore, Tiruppur, Erode, Salem or Chennai, because control testing at a manufacturer means walking the shop floor, the stores and the dispatch area. A firm working to the IIA Global Internal Audit Standards, in force for IIA members since 9 January 2025 though not part of Indian law, can point to a written method for evidence and reporting.

A practice that tests controls within a broader internal audit line can recheck a control fixed in April again in October. At Astral Business Consulting, IFC testing sits within the risk advisory line, alongside internal, process and management audit for manufacturers across Western Tamil Nadu. The team behind that line maintains over 1,500 process risks and controls, with another 2,500-plus covering information systems security, and it audits through the computer rather than around it.

Want your controls tested before the year-end audit?

If your unlisted company falls under section 143(3)(i) reporting, your statutory auditor has flagged control points, or a lender has asked for control evidence, testing before the year-end audit leaves the board time to fix what matters. Share your control testing scope with the team.