Internal Financial Controls over Financial Reporting (ICFR)

Internal Financial Controls Nikunj J. Parekh January 2016 What is Internal Financial Controls (IFC)? 3 What is Internal Controls over Financial Reporting (ICFR)? 4 Regulatory mandate under Companies Act, 2013 6 Determining IFC / ICFR applicability across entities 8 When does this apply and for financial statements of which period? 9 ICFR reporting 10 Indicators of material weaknesses in ICF 11 What needs to be done? 12 Internal Financial Controls – Common myths 14 How will IFC help beyond compliance 15 Synopsis Nikunj J. Parekh 2 What is Internal Financial Controls? (Sec 134) As per Section 134 of the Companies Act 2013, the term ‘Internal Financial Controls’ means the policies and procedures adopted by the company for ensuring: orderly and efficient conduct of its business, including adherence to company’s policies, safeguarding of its assets, prevention and detection of frauds and errors, accuracy and completeness of the accounting records, and timely preparation of reliable financial information. Nikunj J. Parekh 3 What is Internal financial controls over financial reporting? (Sec 143) “ A process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.” A company’s Internal financial control over financial reporting includes those policies and procedures: Pertain to the maintenance of record that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; Provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.” Nikunj J. Parekh 4 What is Internal financial controls over financial reporting? (Sec 143) (contd.) + + = Maintenance of financial records (Detail / Accuracy) Authorization of transactions in accordance with GAAP ICFR Safeguarding of the assets of the Company Nikunj J. Parekh 5 Regulatory mandate under Companies Act 2013 Directors responsibility statement Section 134(5)(e) - The directors, in the case of a listed company, had laid down internal financial controls to be followed by the company and that such internal financial controls are adequate and were operating effectively. Section 134(5)(f) - The directors had devised proper systems to ensure compliance with the provisions of all applicable laws and that such systems were adequate and operating effectively. Section 134(3)(q), sub-rule 8(5) - “In addition to the information and details specified in sub-rule (4), the report of the Board shall also contain: …“the details in respect of adequacy of internal financial controls with reference to the financial statements.” Nikunj J. Parekh 6 Regulatory mandate under Companies Act 2013 (contd.) Audit Committee Section 177(4)(vii) - Every Audit Committee shall act in accordance with the terms of reference specified in writing by the Board which shall inter alia, include ….., evaluation of internal financial controls and risk management systems …. Section 177(5) - The Audit Committee may call for the comments of the auditors about internal control systems, the scope of audit, including the observations of the auditors and review of financial statement before their submission to the Board and may also discuss any related issues with the internal and statutory auditors and the management of the company. Auditor’s report Section 143(3)(i) - Whether the company has adequate internal financial control system in place and the operating effectiveness of such controls. Nikunj J. Parekh 7 Determining IFC / ICFR applicability across entities Nikunj J. Parekh 8 Se ctionRe le va nt cla use sRe quire me ntApplica bility 134(5) (e)Directors’ Responsibility Statement Board to confirm that IFC are adequate and operating effectively Listed companies Rule 8(5)(vii) of Companies (Accounts) Rules, 2014 Board reportBoard report to state the details in respect of the adequacy of IFC with reference to the financial statements All companies 143(3)Auditor’s reportAuditors to report if the company has a de qua te IFC systems and that they are ope ra ting e ffe ctive ly (from FY 2015-16) (Note 1) All companies 177(4)Audit Committee (AC)Evaluation of IFCAll companies having an ACs 149(8)Code for Independent Directors (ID) IDs to satisfy themselves on the integrity of financial information and that financial controls are robust and defensible All companies having IDs Note 1 : The auditors will have to report whether a company has an adequate ICFR system in place and whether the same was operating effectively as at the balance sheet date of March 31, 2016 When does ICF / ICFR apply and for financial statements of which period? Nikunj J. Parekh 9 This is particularly important for companies for the current year ending 31 March 2016, as it will be the first year when auditor validation of ICFR will be required. The auditors will have to report whether a company has an adequate ICFR system in place and whether the same was operating effectively as at the balance sheet date of March 31, 2016 In practice, this will mean that when forming its audit opinion on ICFR, the auditor will surely test transactions during the financial year ending 31 March 2016 and not just as at the balance sheet date, though the extent of testing at or near the balance sheet date may be higher. If control issues or deficiencies are identified during the interim period and are remediated before the balance sheet date, then the auditor may still be able to express an unqualified opinion on the ICFR For example, if deficiencies are discovered, the management may have the opportunity to correct and address these deficiencies by implementing new controls before the reporting date ICFR Reporting Auditor will have to issue a qualified or an adverse opinion on ICFR if ‘material weaknesses’ in the company’s ICFR are identified as part of their audit. Material weakness is a deficiency, or a combination of deficiencies, in ICFR over financial reporting, such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis A material weakness in ICFR may exist even when the financial statements are not materially misstated. Nikunj J. Parekh 10 Indicators of material weaknesses Identification of fraud, whether or not material, on the part of senior management Errors observed in previously issued financial statements in the current financial year Ineffective oversight of the company’s external financial reporting and internal financial controls over financial reporting by the company’s audit committee Identification by the auditor of a material misstatement of financial statements that would not have been detected by the company’s IFC over financial reporting Note: An adverse opinion will be issued if such matters are pervasive to the financial statements—i.e. they impact various elements, accounts, or items of the financial statements, or a substantial portion of the financial statements. Additionally, significant control deficiencies will have to be reported to the audit committee. Nikunj J. Parekh 11 What needs to be done? A.Identify Entity level controls: Nikunj J. Parekh 12 What needs to be done? (contd.) B. For operational activities: Nikunj J. Parekh 13 Testing stage Test the controls identified Write process narratives For eg. Goods are received at gate from where the receipt entry is posted and accrual of liability is made in books Identify risks For eg. W hat happens if goods are received but purchase accrual is not made Identify controls For eg. Reconciliation of GRN with Purchase Accrual is made Design the controls based on the risks identified Identify the important Financial Statement Accounts Identify the processes in the organization Map them to ensure that for all accounts there are processes Designing of controls Internal Financial Controls – Common myths Nikunj J. Parekh 14 W e have a good SLA with service providers. W e don’t need to evaluate their controls Meeting CARO requirement is sufficient W e don’t need to revisit processes and controls There is no need to document processes and controls Testing of controls and remediation of deficiencies is the responsibility of auditors W e don’t need a process for IFC certification to Board / AC. W e know people are doing it and no exceptions are identified by auditors How will IFC help beyond compliance? Helps in business process re-designing to plug revenue leakages & cost containment opportunities. Helps in rationalizing the number of controls across organization – moving to smart and automated controls. Helps in standardizing policies and procedures for multi-location / multi business Companies. Fosters a control conscious work culture for people behind controls Provides assurance to the CEO/CFO as well as improves business performance. Nikunj J. Parekh 15 Nikunj J. Parekh 16 Thank you Nikunj J. Parekh Mumbai, India +91 98198 16542 nikunjparekh06@gmail.com