It is imperative that every business carries risk and such risks has to be counterfeited through effective governing, by ensuring adequate policies, procedures and measures are in place to make sure that controls are effective and sufficient. Keeping in mind the concept of globalization, conduct of business in fair and transparent manner the government laid emphasis on the concept of ‘Internal Financial Control’ in the recent amended Companies Act 2013.
The theme of IFC is mainly on globalisation, impetus on prevention of fraud and misstatements and cue obtained from SOX 404 which stresses on establising internal controls and procedures for financial reporting.IFC is forecasted to be seen as a major reform measure by bringing in all the chains of an organization in one group i.e not only Finance & Accounts will be responsible for getting the financial statements certified but also making other departments in the organization to participate and to ensure that the reporting, controls, procedures of their process/activities are in place and are effective and adequate as ultimately it will have an impact in the financial statements
DEFNITION
134(5)(e): “Every director of the company to state that they had laid down IFC to be followed by the Company and that such IFC are adequate and were operating effectively”.
134(5)(f):It requires the Director’s responsibility statement to state that they had devised proper systems to ensure compliance with the provisions of all applicable laws and that such systems were adequate and operating effectively.
Rule 8(5)(viii) of the Companies (Accounts) Rules, 2014 requires the Board of Directors’ report of all companies to state the details in respect of adequacy of internal financial controls with reference to the financial statements
Diagrammatic flow on applicability:
The above definition from the amended companies act 2013, clearly setting standards for top management to ensure that their business conduct is efficient and effective in all aspects. This sets the tone for external auditors to ensure that IFC is in confirmity with the accepted business practices before certiying the financial statements.
HOW CAN WE ACHIEVE IT
A simple approach can ensure compliance with IFC, lets analyse the same
Process I – Maintain an SOP
Maintaining an SOP(Standard Operating Procedure) for all the process in the organization. If not one has to create and maintain an SOP for the activities carried out. This SOP will enable to measure the competency of the process on how effective the activities of the business are carried out and the controls laid therein. Each department has to maintain SOP for all their activities. Some department like Quality engineering etc, may find it not feasible to maintain SOP instead their own work manual (Quality manual) can be taken into consideration as long as it is updated.
Process II – Adopt an Questionnaire
Lots of standard sets of Internal Control audit Questionnaires are available. Try to figure out the best applicable according to the operations of your organization.
A sample format of questionnaire with select requirements:
Process/Department: Sort the questionnaire department wise & if possible classify the sub process (Eg: Accounts Payables > a) Supplier bills b) Travel bills etc)
Risk assessment: Classify risk based on the observation/process
Areas of observation: Key to questionnaire is the observation. Effective the observation more the crux in defining IFC. Create the questions for your process as efficiently as possible such that the end user has to fill the Yes/No on its applicability and fill the Remarks column on the process (SOP) being followed for the question and controls if any he has in place to be mentioned if applicable. Let’s see an example:
Process / Department: Purchase
Observation: Are quotes for purchases are sent to atleast three suppliers and the basis for considering supplier as potential source?
Risk: Medium
Remarks: Supplier Evaluation process
Compensating controls: Selection based on tolerance levels
Compensating controls: Selection based on tolerance levels
Pl note that on evaluating the remarks and compensating controls it shows how effective your control is in place and how adequate it is considering the size of your operations. On evaluation, it will make us to identify weakness and will act as a tool to strengthen the process
Mapping This is mainly to facilitate external auditors to ensure that all items in balance sheet, profit & loss accounts are covered. Map the observations to financials like Eg: Flight Expenses à Travel Expenditure (P&L) à Accounts Payable (Balance sheet)
The above simple approach will give you some idea on how IFC will work.
Give a quick walkthrough on the questions and its relevance. Delete the non-applicable ones and make additions to the questionnaire if you think it misses some processes.
Validate and send it across all the departments and get it filled duly by the end-user
Test Check
Once the above exercise is completed, one has to ensure the authenticity of the details filled. The best mechanism of validating the data is to test verify the same through tailor made approaches.
- Select the process on sample basis
- Define the scope, collate and reviewing the process
- Map the risks and control
- Evaluate the process for risk assessment, and identifying the control gaps
- Frame an outcome/conclusion based on your test results
Now select that particular process taken for test verification in the questionnaire and check for the remarks and compensating controls mentioned by the end user and compare the same with your test results. By this time you would be in a position to observe whether the process is heading in right direction or any inconsistencies exists. This test check had to be carried out on sample basis for all the process/ activities. By measuring each and every process/activities one will be in a position to evaluate how effective and adequate controls are in place.
Conclusion:
Adopting a questionnaire and evaluating it with your SOP is one of the simplest method in ensuring compliance with IFC guidelines. Since each and every activity in the organization activity has a financial impact, measuring each process and ensuring its effectiveness control mechanism will have favorable impact in qualifying financial statements positively.
The entire process has to be carried out either by Finance department with assistance of in-house audit department/external audit firms since the onus of getting financials signed lies with Finance & Accounts. Apart from which, the process can also be used by external auditors in suggesting their clients on how to approach in complying with IFC or how to do an IFC audit.
CAclubindia
