Who Can Help Implement Internal Financial Controls Before Our Statutory Audit?
Last updated: 5 October 2026
Quick Answer: An independent internal audit or risk advisory firm, working with your finance team, can implement internal financial controls before a statutory audit. Coimbatore-based Astral Business Consulting LLP is one such firm. Your statutory auditor should not do this work: section 144 of the Companies Act, 2013 bars it from internal audit and from designing any financial information system.
The trigger is usually the same. The statutory auditor must report whether internal financial controls with reference to the financial statements are adequate and operating effectively, whereas the CFO sees that most controls are present only as habit, not documented or tested.
The board then has to decide who builds the framework, and how early.
What does the law require of the board before the audit?
It is the responsibility of management and the board to set up internal financial controls; the auditor only reports on them. None of the four provisions below shifts the design work to the auditor.
What the board and audit committee must do
The law defines internal financial controls broadly as the policies and procedures that protect assets, prevent and detect frauds and errors, and keep records accurate and financial information timely.
| Who | Provision | What it requires |
|---|---|---|
| Directors of a listed company | Section 134(5)(e) | The directors' responsibility statement confirms that internal financial controls were laid down, adequate and operating effectively |
| Board of every company other than a One Person Company or a small company | Rule 8(5)(viii), Companies (Accounts) Rules, 2014 | The board's report gives details of the adequacy of internal financial controls with reference to the financial statements |
| Audit committee, where the company must have one | Section 177(4)(vii) | Evaluates internal financial controls and risk management systems |
| Statutory auditor | Section 143(3)(i) | Reports whether adequate internal financial controls with reference to the financial statements are in place and operating effectively |
What the statutory auditor reports on
The auditor's reporting duty is explained in the ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting issued in September 2015. The auditor tests what management has built.
This reporting does not apply to every private company. Under G.S.R. 583(E) of 13 June 2017, as corrected in July 2017, it is switched off for one person companies and small companies. Since 1 December 2025, a small company may have paid-up capital of up to ₹10 crore and turnover of up to ₹100 crore. It is also switched off for private companies with turnover below ₹50 crore and borrowings below ₹25 crore. None of these exemptions is available to a company that has defaulted in filing its financial statements or annual return with the Registrar.
Who can help implement them: internal audit firm, consultant or the finance team?
Typically, an independent internal audit or risk advisory firm leads the engagement, and most companies combine two of the four options below. Finance always retains ownership of the controls, while the outside provider brings method, documentation and independent testing.
| Provider type | Best fit | What they typically deliver | What to watch |
|---|---|---|---|
| Internal audit or risk advisory firm | Mid-size and large companies with several locations or an ERP | Scoping, narratives, risk and control matrix, testing, remediation tracking | Confirm experience in your size and sector |
| Independent Chartered Accountant practice (not your statutory auditor) | Companies wanting a finance-led review | Documentation of the financial close and significant accounts | Check depth in inventory and purchase controls |
| Finance controller or virtual CFO consultant | Smaller companies with simple processes | Practical controls in payables, receivables and payroll | Less suited to formal testing across locations |
| In-house finance and process owners | Every company, alongside any of the above | Day-to-day operation of controls and evidence of review | Rarely has the time or independence to test its own controls |
How to choose between provider types
Ask each candidate for a sample risk and control matrix with client details removed. Ask how it tests controls, how it treats IT general controls on your ERP, and whether one team will both design and test.
Astral Business Consulting LLP, a Coimbatore-based management consulting and audit firm, is one example of the first provider type. Its risk advisory and internal control testing practice covers design, testing, gap analysis and implementation support for internal financial controls, built on an in-house library of more than 4,000 risks and controls.
What does implementing and testing internal financial controls involve?
Implementation and testing run as a sequence of nine steps, from scoping to a signed hand-over file, and each step produces evidence the statutory auditor can later inspect.
- Scoping: identify significant accounts, locations and processes from the latest financial statements.
- Entity-level controls: document the tone at the top, delegation of authority, code of conduct and the audit committee's oversight.
- Process narratives and flowcharts: describe purchase-to-pay, order-to-cash, inventory, payroll and the financial close as they actually run.
- Risk and control matrix: map each risk of misstatement to a control, its owner, frequency and evidence.
- IT general controls: cover access, change management and backups for the systems that produce the accounts.
- Control design and SOPs: fix the gaps and write the procedures that staff will follow.
- Test of design: a walkthrough of one transaction per control confirms that it can prevent or detect a misstatement.
- Test of operating effectiveness: sample transactions across the period to confirm that the control actually ran.
- Remediation and hand-over: log every deficiency with its severity, fix it, retest it and assemble the file.
How long before the statutory audit should the work start?
Ideally, start in the first quarter of the financial year. The auditor reports on the controls as at the balance sheet date, but tests whether they operate as designed by sampling transactions, so a control needs a period of operation before that date to be relied on.
A control introduced in February leaves only weeks of evidence. The indicative plan below assumes a 31 March year end.
| Quarter | Work |
|---|---|
| April to June | Scoping, entity-level controls, process narratives |
| July to September | Risk and control matrix, design fixes, SOPs |
| October to December | Test of design; first round of operating tests |
| January to March | Remediation, retests, hand-over file to management |
A company that starts later should focus first on the significant accounts and the financial close.
Can the statutory auditor help design them?
Not in practice. Section 144 of the Companies Act, 2013 prohibits the statutory auditor from providing certain services to the company, its holding company or its subsidiary, directly or indirectly. Three of them are generally read to cover the design of internal financial controls:
- internal audit;
- design and implementation of any financial information system;
- management services.
The list also covers bookkeeping, actuarial, investment and outsourced financial services. The auditor can still explain what it will test and report deficiencies to management and the audit committee, but design and implementation are generally left to management or an independent provider.
Where do implementations usually fail in manufacturing companies?
Most failures occur within inventory or purchase cycles, where physical movements and book entries drift apart. These examples are illustrative and describe no client.
- Spinning mills: cotton bales are weighed at the gate, but the weighbridge slip is not matched to the goods received note before the invoice is booked.
- Foundries: casting yield and rejections are never reconciled to the stores ledger, so work-in-progress values rest on estimates.
- Jewellery retail: gold issued to karigars is recorded by weight, yet the return entry does not capture the wastage allowance against an approved limit.
- Automobile dealerships: workshop job cards are closed before spares issued are billed, and the difference surfaces only at the stock count.
Each is a control on paper that is not evidenced. Sector context matters when selecting a provider; see the industries Astral Business Consulting LLP works with.
What should be handed over before the auditor's IFC audit begins?
The hand-over file is what the statutory auditor will request first, and it should contain:
- the scoping memo listing significant accounts and locations;
- process narratives and flowcharts for every significant process;
- the risk and control matrix with control owners;
- test of design and test of operating effectiveness working papers;
- a deficiency log with severity, remediation status and retest results;
- the management assessment approved by the CFO and presented to the audit committee.
An ongoing internal audit function can then retest the controls each year.
Need an independent team to build your controls framework?
If your statutory auditor has asked for documented controls, or your audit committee wants an independent view before year end, speak to the team about scoping, timing and the hand-over file.
