5
Inside the Internal Brain: Auditing IFCR and Internal Audit Systems 12:16 Nia: Auditing Internal Financial Controls or IFCR is like being a brain surgeon for a corporation. You’re looking at the systems and processes that ensure the financial statements are reliable. Under the Companies Act 2013, we have to give an opinion on whether the company has an adequate ICFR system and if it’s operating effectively. It’s not just a one-time check at the end of the year; you’re looking at how transactions are authorized, recorded, and reported throughout the entire period.
12:45 Jackson: And for listed companies, the Board of Directors even has to state in their report that these controls are adequate and operating effectively. So the stakes are high for everyone. But what’s the first step for an auditor? I’m guessing it starts with understanding the "Control Environment"—the tone at the top?
0:33 Nia: Exactly! You’re looking at the big picture—the entity's risk assessment process, the information systems, and how they monitor their own controls. A great starting point is to see if the company has an ICFR Manual. This should document all their processes, authorizations, and internal checks. If it doesn't exist, that’s a major area for improvement.
13:21 Jackson: And then you’ve got to get into the weeds with walkthroughs. You pick a single transaction—like a sales order—and trace it all the way from the initial voucher to the final ledger entry. You’re looking for where things could go wrong. Is there a point where one person can both approve and record a sale? That’s a classic lack of "segregation of duties" and a huge risk.
13:41 Nia: Right! And in today's world, you can't talk about controls without talking about IT. For a company like ABC Limited using Finacle or SAP, the automated controls are the backbone of their ICFR. Our IS Audit experts have to check everything from access rights—making sure only authorized people can change the price master—to "change management," which is how the system is updated without introducing errors.
14:06 Jackson: It’s interesting how the internal audit system fits into this too. Clause (xiv) of CARO specifically asks if the company has an internal audit system that’s commensurate with its size and nature. And as statutory auditors, we’re supposed to consider the reports of those internal auditors. But Nia, there’s a bit of a tricky relationship there, right? We can't just blindly rely on their work.
14:25 Nia: You've hit the nail on the head! SA 610 gives us the ground rules for "Using the Work of Internal Auditors." We have to evaluate three things: their objectivity, their technical competence, and whether they work with due professional care. If the internal audit head reports to the CEO instead of the Audit Committee, that might affect their objectivity.
14:45 Jackson: And even if they’re great, we still have to perform our own procedures on their work to make sure it’s adequate for our purposes. We’re ultimately the ones with "sole responsibility" for the audit opinion. We can use their work to help us understand the risks or to focus our own testing, but we can't just outsource our judgment to them.
7:25 Nia: Exactly. And in India, we have to be careful about "direct assistance" from internal auditors too. While it's not strictly prohibited by the Companies Act, we have to ensure it doesn't compromise our independence. Most firms prefer to review the internal audit reports and then decide how much "control reliance" they can actually place on the system.
15:22 Jackson: It’s all about building that "bridge of trust" between the internal and external audit functions, but with enough professional skepticism to keep things honest. And when you’re dealing with a complex group, that bridge has to extend to the component auditors too—the "Other Auditors" who are looking at the subsidiaries.
13:41 Nia: Right! And that’s where the Principal Auditor has a huge job of coordination. You have to issue clear "Group Audit Instructions," set the materiality for each component, and regularly communicate with those other teams. It’s a massive exercise in project management and technical oversight to ensure the consolidated financial statements are actually true and fair.
16:01 Jackson: So, we’ve looked at the strategy, the risks, the CARO survival kit, and the internal controls. Now let's get into the nitty-gritty of the final outputs—the certificates and the reporting. What are the common pitfalls we need to avoid when we’re finally putting pen to paper?