Introduction
Companies Act 2013 requires auditors to express their opinion on existence of internal financial controls in place and their operating effectiveness, and this is in addition to their expression of opinion on financial statements. Initially this reporting requirement was applicable to financial statements ending on 31st March, 2015 but due to lack in compliance guidelines this applicability got deferred and is now effective from the year ending on 31st March, 2016. This reporting is also consistent with global reporting requirements and the international reporting requirements, e.g. Sarbanes Oxley Act in US.
IFC: Mandatory under Companies Act 2013
As per section 143(3)(i) of Companies Act 2013,auditors are required to report in their audit report on the existence and operating effectiveness of IFC in all type of companies both listed and unlisted however section 134(5)(e) of Companies Act in case of listed companies holds directors primarily responsible for implementing IFC and their adequacy in reference to the financial statements and to state the details of the same in Director’s Responsibility Statement. In Director’s Responsibility Statement, directors are required to acknowledge their responsibility for establishing proper IFC’s in place.
Under Section 177 of Companies Act, specified companies are required to establish Audit Committee. Provisions of the Act also specify the functions and powers of Audit Committee. Audit Committees are statutorily required to evaluate the IFC’s in place and are empowered to invite suggestions from both internal and statutory auditors on the functioning of such controls.
Guidance Note by ICAI on IFC’s
Institute of Chartered Accountant of India has issued a detailed guidance note on IFC. The guidance note explains that for the purpose of reporting the term IFC is restricted to internal controls over financial reporting (ICFR). Guidance note derives the definition of ICFR from US Auditing Standard. As per the guidance note IFC over financial reporting includes those policies and procedures that:
- Relates to maintenance of records of transactions that in reasonable detail reflects the true and correct of view of the company’s state of affairs.
- Provide reasonable assurance regarding prevention or timely detection of any misstatement that could have a material effect on company’s financial statement.
- Transactions are recorded in such a manner so as to facilitate preparation of financial statement in accordance with the generally accepted accounting principles and provisions of the statute.
- Ensures that receipts and expenditures are recorded only after proper authorisation.
♣ Applicability of ICFR
As per the guidance note auditors are required to comply with ICFR in all types of companies either listed or non listed including small and one person companies and it is also required u/s. 143(3)(i) of the Companies Act 2013. As per Section 129(4) of the Act all the provisions regarding preparation, adoption and audit of financial statement of holding company shall mutatis mutandis apply to the consolidated financial statement. Therefore, auditors will have to report on IFC in both standalone and consolidated financial statements(CFS) and consolidated financial statements includes subsidiaries, JV’s and group of all associate companies which are incorporated in India. Further guidance note specifically states that reporting on ICFR would apply even in case of CFS for the respective component of CFS only if that company is incorporated in India. Hence it can be concluded that auditors of foreign subsidiaries whose parent company is incorporated in India are not required to comply with the requirements of ICFR.
Provisions regarding reporting on IFC shall apply on the financial statements for the period ending as on 31st March 2016 and auditor has to specify regarding adequacy and operating effectiveness of IFC as on the date of balance sheet , however for the purpose of forming an opinion auditor will have to test check the transactions occurred during the year.
♣ Standards on Auditing and ICFR
An auditor is statutorily required to adhere to Standards on Auditing (SA) as per Companies Act 2013, however SA does not fully address the auditing requirements of ICFR, guidance note therefore suggest that relevant portions of SA’s are need to be considered while performing the audit of ICFR. Some of the relevant SA’s that can be considered by the Auditor are:
- SA 230, Audit documentation when documenting the work performed during the audit of ICFR.
- SA 315, Identifying and assessing the risk of material misstatement while determining whether internal controls can timely prevent or detect errors.
♣ Reporting
Company’s internal control cannot be considered as effective if one or more material weakness exists. Material weakness may also be present even if financial statements are not misstated. As per guidance note an auditor is required to issue modified opinion if ICFR either individually or in combination results in material weakness. Auditor should also consider the effect of modified opinion on ICFR on his opinion on the financial statement and should also disclose whether his opinion on financial statement is affected by his modified opinion on ICFR.
It may also be noted that auditor’s reporting on IFC will apply only in case of financial statements prepared under Companies Act 2013 and reported u/s 149 of the Act, hence auditor’s report on IFC is not required in case of interim financial statements i.e. half yearly or quarterly reporting, unless it is statutorily required under any other law.
Sarbanes Oxley Act and ICFR
The Sarbanes Oxley Act of 2002 in the U.S. states that all registered companies must issue an internal control report annually and companies fulfilling the specified criteria must appoint an external auditor to express an opinion on ICFR and this requirement of Sarbanes Oxley Act is very much similar to our Indian Law. Similarly Sarbanes Oxley Act’s requirement of an executive certification as to the “corporate responsibility for financial reports” is also very much similar to the Indian reporting requirements of ICFR by the boards.
Conclusion
Due to enhanced reporting requirements companies are required to evaluate their internal control components and ensure that they are aligned with the prescribed framework. Enhanced reporting requirements would require high compliance costs but in long run it would result in high quality reporting on company’s financial report.
Guidance issued by ICAI is likely to help the implementation requirements of Companies Act 2013 and will guide companies and auditors who were initially looking for the guidance to discharge their statutory obligation.
