Is Internal Financial Controls Reporting Applicable to Private Companies in 2026?
Last updated: 5 October 2026
Quick Answer: Yes, internal financial controls reporting applies to a private company with turnover of ₹50 crore or more or borrowings of ₹25 crore or more. The auditor reports under section 143(3)(i) of the Companies Act, 2013. One Person Companies, small companies and private companies below both limits are exempt under a 2017 notification.
The question usually reaches the CFO at the audit planning meeting, when the auditor asks for process narratives, a risk and control matrix and test evidence.
The answer depends on three facts: whether the company is a small company, its turnover in the latest audited accounts, and its highest borrowing during the year. Misreading any one of them leaves the auditor reporting on controls nobody has documented.
Does section 143(3)(i) cover private companies by default?
Yes, by default. Section 143(3)(i) of the Companies Act, 2013 requires every company auditor to state whether the company has adequate internal financial controls with reference to financial statements in place, and whether those controls operate effectively. The section makes no exception for private companies.
The relief comes from a Ministry of Corporate Affairs exemption under section 462. Notification G.S.R. 583(E) of 13 June 2017 amended the private company exemptions of 2015 and switched off section 143(3)(i) for three classes of private company. Every private company outside those classes receives an auditor's report on its internal financial controls.
Which private companies are exempt from internal financial controls (IFC) reporting?
Three classes are exempt from the auditor's reporting, provided the company has not defaulted in filing its financial statements or annual return with the Registrar of Companies.
| Exempt class | Condition | Where the condition comes from |
|---|---|---|
| One Person Company | Incorporated as a One Person Company | G.S.R. 583(E), 13 June 2017 |
| Small company | Paid-up capital up to ₹10 crore and turnover up to ₹100 crore; not a holding or subsidiary company | Section 2(85) read with G.S.R. 880(E), 1 December 2025 |
| Private company below both limits | Turnover below ₹50 crore and borrowings from banks, financial institutions or any body corporate below ₹25 crore, tested "at any point of time during the financial year" | G.S.R. 583(E) as corrected on 13 July 2017 |
One Person Companies
A One Person Company is exempt whatever its size. Few manufacturers in Tamil Nadu use this form, so the other two classes matter more in practice.
Small companies
The small company limits rose sharply from 1 December 2025. Under the Ministry of Corporate Affairs notification of 1 December 2025, a small company may have paid-up capital of up to ₹10 crore and turnover of up to ₹100 crore.
Section 2(85) excludes holding companies, subsidiary companies, section 8 companies, and companies governed by a special Act. A private company inside a group therefore cannot use this route, however small it is.
The turnover and borrowing limits
A private company that is not small is exempt only when turnover is below ₹50 crore and borrowings stay below ₹25 crore. Both limits must hold together.
Many summaries still say "or". The notification as first printed did read "or", but a corrigendum dated 13 July 2017 (S.O. 2218(E)) replaced it with "and". A company below one limit and above the other receives the auditor's report.
How does the exemption work on real numbers?
The cases below are illustrative. None of the companies is a One Person Company, and none has a filing default.
| Case | Paid-up capital | Turnover (latest audited) | Highest borrowings in the year | Small company? | Auditor reports on internal financial controls? |
|---|---|---|---|---|---|
| A | ₹3 crore | ₹30 crore | ₹10 crore | Yes | No. Exempt as a small company |
| B | ₹15 crore | ₹30 crore | ₹10 crore | No | No. Below both limits |
| C | ₹15 crore | ₹60 crore | ₹10 crore | No | Yes. Turnover is ₹50 crore or more |
| D | ₹15 crore | ₹30 crore | ₹30 crore | No | Yes. Borrowings reached ₹25 crore or more |
| E | ₹8 crore | ₹60 crore | ₹30 crore | Yes, if standalone | No. Exempt as a small company |
| F | ₹8 crore | ₹60 crore | ₹30 crore | No. It is a subsidiary | Yes. Neither exemption is available |
Cases E and F have identical financial figures but reach different conclusions based solely on group structure. Check any restructuring against this exemption before it is signed.
How are the turnover and borrowing limits measured?
Each limit uses a different period, and mixing them up is the most common error.
Turnover
The notification uses turnover "as per latest audited financial statement". Section 2(91) defines turnover as gross revenue recognised in the profit and loss account from goods sold and services rendered.
The small company test is worded differently: turnover as per the profit and loss account for the immediately preceding financial year.
Borrowings
Borrowings are tested "at any point of time during the financial year", which is generally read to mean that the peak balance, not the year-end balance, decides the test. The count covers banks, financial institutions and any body corporate.
That last phrase is wider than the internal audit test under rule 13, which counts only banks and public financial institutions. Inter-corporate loans from a group company count towards ₹25 crore here.
Who answers for internal financial controls: the directors or the auditor?
Both, under different provisions. The exemption removes only the auditor's opinion, not the board's duties.
| Provision | Who it binds | What it requires |
|---|---|---|
| Section 134(5)(c) | Directors of every company | Proper care for adequate accounting records, safeguarding assets and preventing and detecting fraud |
| Section 134(5)(e) | Directors of listed companies only | A statement that internal financial controls are laid down, adequate and operating effectively |
| Rule 8(5)(viii), Companies (Accounts) Rules, 2014 | Board's report of a private company that is neither a One Person Company nor a small company | Details of the adequacy of internal financial controls with reference to financial statements |
| Section 143(3)(i) | Statutory auditor, unless the company is exempt | Opinion on adequacy and operating effectiveness |
Section 134(3A) provides for an abridged board's report for One Person Companies and small companies. Rule 8(6), inserted by G.S.R. 725(E) of 31 July 2018, takes them out of rule 8, and the abridged contents under rule 8A carry no internal financial controls item. For every other private company, the board comments on its controls each year even when the auditor does not.
The auditor's work follows the ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting, issued in September 2015. It shows what the auditor will ask for in the first year of reporting.
What are the common mistakes when private manufacturers read the exemption?
Most errors come from reading the exemption as a balance sheet test. Three patterns recur in the Western Tamil Nadu industrial belt; the examples are illustrative.
- The seasonal borrowing peak. A spinning mill stocks up on cotton in the peak arrival months and draws heavily on its cash credit limit while it does. The year-end balance may sit comfortably below ₹25 crore while the winter peak crossed it. On the usual reading, the exemption is then lost for the year.
- The group loan nobody counted. A knitwear exporter in Tiruppur keeps its bank borrowings below ₹25 crore but also takes a loan from a sister trading company. Because borrowings from any body corporate count, the two together can cross the limit.
- The small company that joined a group. A foundry in Coimbatore within the small company limits is exempt until the promoters move its shares into a new holding company. From then on, it is a subsidiary, and section 2(85) no longer applies.
What should a private company do before reporting first applies?
Start in the first quarter of the year in which a limit is likely to be crossed, not at the year-end audit. The auditor reports on controls as at the balance sheet date and tests whether they operate as designed, so a control first documented in March leaves too little evidence to test.
- Confirm the class. Check small company status, group structure, filing history and the borrowing peak month by month.
- Document the processes. Write narratives for order-to-cash, procure-to-pay, inventory, payroll, fixed assets and financial close.
- Build the risk and control matrix. Link each material risk to a control, an owner and the evidence the control leaves behind.
- Test and fix. Test design and operating effectiveness, then remediate gaps before the auditor's interim visit.
- Brief the board. The board's report comments on adequacy, so directors should see the test results first.
Section 144 bars the statutory auditor from internal audit and from designing a company's financial information systems, so this work is usually done by the finance team or an independent firm. Astral Business Consulting LLP, a Coimbatore-based management consulting and audit firm, supports companies at this stage through its internal financial controls design and testing practice, which draws on an in-house library of more than 4,000 risks and controls. The same checks apply across the manufacturing and trading sectors the firm works with.
Not sure whether your company is inside the exemption?
If your turnover is approaching ₹50 crore, your borrowings peak near ₹25 crore, or your group structure is changing, test your position before the auditor's planning meeting. Speak to the internal financial controls team about a gap assessment for the current financial year.
