Introduction
In the past, we had come across many financial frauds, the most manipulated corporate frauds were Satyam Scam, Enron Scandal and WorldCom scandal. The major reason these scams were successful is due to lack of corporate governance, hiding the true position of the company by the intentional use of fraudulent accounting practices. Such scams spurred the government to bring strict rules and regulations and mandate the requirement of internal financial control reporting to prevent the recurrence of such kinds of frauds in near future.
In order to raise the bar of corporate governance in India, hold the Board and Management accountable for irregularities in the internal financial control and avoid financial fraud due to loopholes in the regulatory and control framework of the company, IFC “Internal Financial Control” reporting has been mandated in the Companies Act, 2013.
Applicability
Clauses as perCompanies Act, 2013 | Requirements | Applicability |
Directors’ Responsibility Statement: Sec. 134(5)(e) | Board to state that IFCs are followed by the company and such IFC are adequate and operating effectively | Listed Companies |
Auditor’s report: Sec. 143(3)(i) | Auditors need to report whether the company has adequate IFC systems and that they are operating effectively | All Companies Public Listed ü Public Unlisted ü *Privateü |
Audit Committee: Sec 177 | For IFC evaluation, if any such Audit Committee formed | Companies with Audit Committee Public Listed ü Public Unlisted ü *Privateû |
Independent Directors: Schedule IV | Independent Directors to satisfy themselves on the integrity of financial reporting and that financial controls are robust and defensible. | Companies with Independent Directors Public Listed ü Public Unlisted ü *Privateû |
Board report: Rule 8(5) of Companies (Accounts) Rules | Board report to state the details in respect of the adequacy of IFC with reference to the financial statements | All Companies Public Listed ü Public Unlisted ü *Private ü |
*Private Companies which are exempt from the application of Internal Financial Controls as per MCA notification dated 13th June 2017:
- One Person Company, Small Company; or
- Company with turnover less than Rs.50 crores as per the latest audited financial statement or aggregate borrowings from the bank or financial institutions or body corporate at any point of time during the financial year less than Rs.25 crores
Responsibility of Management & Auditor
Advantages of IFC
By holding the board and management accountable for internal financial control performance and bringing clarity to the roles and responsibilities in the organization, some of the benefits that the companies would experience:
CASE STUDY.
CASE STUDY.ABC is an EPC listed company that serves the finest quality of construction services. The company’s growth is tremendous and has created its strong position in the industry for a very long time. In 2015, the introduction of internal financial controls reporting came into the picture, as per the Companies Act 2013 it was mandated to report the efficiency and effectiveness of IFC in director responsibility statement and even in the auditor’s report.
ABC Ltd is a listed company, IFC compliance was mandatory to the company. After a detailed analysis of the existing policies and future outlook of a company and as a disclosure requirement need, a board meeting was held, where Mr. Sky, an IFC expert is hired by the management for the financial year 2016-17. Management decided to implement IFC testing in alignment with the internal audit.
Mr. Sky and his team assessed the existing process and controls in phases. Mr. Sky segregated the areas into entity-level controls, process-level controls and IT controls and other operational procedures.
Based on the summary of findings, recommendation and suggestions on the efficiency and improvement in business and IT processes be communicated to the management
Output of Phase I
- Proper understanding of the policies and procedures of the organization.
- Held meetings with the Head of each department to understand the area and to check the existence of controls as per the process.
- Documented all the observations and As-is process.
- Lack of accountability at process owner and management level & inadequate skills possessed by staff.
- Defining an Organisation Matrix along with the roles & responsibilities to check whether there is an availability of workforce in any department.
Output of Phase II
- Poor delegation of duties that led to delay in meeting the deadlines.
- No authorization matrix was defined and thus lack of completeness and duplicate transactions were recorded.
- Misappropriation of cash was found at the time of the audit process
- Supporting files and backups for all the financial data was not maintained properly
- Periodic reporting of the company’s performance was not provided to management
- Adjustment entries and reconciliation were prepared on a half-yearly basis and not quarterly
Measured the business productivity, profit margin and capital efficiency of the company.
Output of Phase III
- Based on the documentation, the risk level of the sub-processes was defined as low, moderate and high
- A high level of risk was prioritized and control evidence against the process was documented for IFC testing
Assessment & Walkthrough the ERP, payroll and attendance software to detect any material misstatement and loopholes were documented for further reference
Output of Phase IV
- Based on control evidence, sampling of the data was performed to test the IFC
- A detailed check of samples with the requirements was completed and materiality was measured
- The area of concern was reported and documented to communicate at the end of the IFC testing with the management
Output of Phase V
- The failure of IFC was reported to the management and held the process owner accountable for the inefficiency
- Recommendations on the summary of findings were provided to the management
Recommendation
Reframing the policies and procedures with the standardized approach
- Automating the process by eliminating the manual process wherever possible & authorization matrix to be prepared
- Reporting of company’s performance to be submitted periodically
- Supporting documents and files must be placed in a secured database with access to only the process owner
- Quality of work to be improved by maintaining checklist and compliance tracker to avoid non-compliance
- Follow-up mechanism to be implemented to complete the work as per deadlines
- Monitoring activities like the review of the books of accounts periodically and any issues faced while implementation of proposed controls to be communicated with management and auditor
Conclusion
Financial controls did exist in ABC Ltd but there was no proper documentation, follow-ups and tracking process which leads to a higher level of risk and manipulation in the financial reporting transaction. A formulated internal guideline has been formed to ensure effective implementation of the controls.
The above example will help the companies to understand the futuristic perspective of adapting IFC, how such implementation will improve the overall business performance and not just additional compliance to meet the audit requirements
Importance of IFC reporting
To identify the opportunities for strengthening the system and process, to monitor the allocation and usage of the financial resources, IFC delivers value addition to different areas:
- Filling the gap of communication in the organization by establishing a direct chain of communication between the accounting executives, process owners, management which includes the CFO
- Creating a bunch of specialized team by delegating the duties and responsibilities in a more organized manner
- Updating the human resources by periodic training and latest information sessions to ensure that the team is aware of the change of laws and regulations evolved in the organization
- IFC assures to support the CEO and CFO of the company in terms of improved business operations and providing a different view for tackling complex decision making
- Establishing standardized policies and procedures to avoid the risk of fraud or complexities in future
- ERP transformation and automation of process by making IFC documentation & control as a base.
- Periodic testing of IFC by using sampling tools and reporting the management on the failure of any IFC
Conclusion
IFC reporting design and implementation vary as per the requirements of the organization. The ultimate focus of implementing the internal financial control is to make companies understand the difference between doing minimum and doing the work effectively to adopt the right approach by improving process efficiency, reducing the risk of financial fraud, creating potential benefits not only for the company but also for their stakeholders, having clarity on the roles and responsibilities of the process owner and sustain the company’s performance for a long term.
The initial year of IFC implementation might witness the level of resistance among the staff, the proper documentation and testing of policies and operational procedures, the need to define the change management process and failure in the controls due to lack of accountability. However, once the senior management will sense the level of accountability with adequate training and have clear directions on how the deficiencies highlighted be resolved, it will help the companies in near future to sustain IFC compliances initiatives along with operational effectiveness.
In case you would like to know more on how can your organization benefit from implementation of IFC and how it will improve your company’s performance, you can reach us on our below mentioned e-mail ID.
Authors:
CA Aakash Mehta, Partner
E-mail ID: aakash.mehta@masd.co.in
CA Punit Ruparelia, Director
E-mail ID: punit.ruparelia@masd.co.in
Riddhi Thakkar, Associate Consultant
E-mail ID: riddhi.thakkar@masd.co.in