A Practical Guide to IFC Testing as per India’s Companies Act, 2013: Framework, Implementation and Compliance

Quick Answer

IFC testing as per India’s Companies Act is the process of documenting, evaluating and testing a company’s Internal Financial Controls (IFC) to confirm that they are adequately designed and operating effectively. It supports the directors’ statements in the Board’s Report under Section 134 and the statutory auditor’s report under Section 143(3)(i). In practice, it involves scoping significant accounts and processes, building a Risk and Control Matrix (RCM), performing a Test of Design (TOD) and a Test of Operating Effectiveness (TOE), testing IT General Controls, and evaluating and remediating deficiencies before the balance sheet date.

1. Introduction and Regulatory Background

Corporate governance in India underwent a structural shift with the enactment of the Companies Act, 2013. Under the Companies Act, 1956, internal controls were largely viewed through the lens of internal audit checks, voluntary operating standards and routine accounting reconciliations. Corporate accounting failures in India and abroad showed that informal, loosely monitored procedures were not enough to prevent material misstatement, fraud and misuse of capital.

The 2013 Act responded by placing explicit statutory responsibility for financial integrity on directors, audit committees and auditors. For boards, audit committees, management teams and practising auditors, conducting thorough IFC testing as per India’s Companies Act is no longer a discretionary best practice. It is a legal requirement that carries regulatory, financial and reputational consequences.

At its core, the Indian framework takes a holistic view of corporate health. It requires companies to establish, document, test and sustain mechanisms that safeguard assets, prevent and detect fraud and error, keep accounting records complete and accurate, and produce reliable financial information on time. Multinational groups operating in India often bring control philosophies from frameworks such as the US Sarbanes-Oxley Act of 2002 (SOX). The Indian regime, however, has its own thresholds, responsibilities and reporting requirements that need to be addressed locally.

In my experience leading IFC engagements across manufacturing, services, technology and Global Capability Centres (GCCs), the companies that handle IFC well treat it as a year-round management discipline. Those that struggle usually treat it as a documentation exercise that starts in February.

2. The Statutory Framework and Legal Mandates

To appreciate the scope of control testing, organisations must first understand the statutory text of the Companies Act, 2013, which is available on India Code and the Ministry of Corporate Affairs (MCA) website. The Act defines IFC broadly but divides obligations between management and independent assurance.

The statutory definition: Explanation to Section 134(5)(e)

The Explanation to Section 134(5)(e) defines the term as follows:

“Internal financial controls means the policies and procedures adopted by the company for ensuring the orderly and efficient conduct of its business, including adherence to company’s policies, the safeguarding of its assets, the prevention and detection of frauds and errors, the accuracy and completeness of the accounting records, and the timely preparation of reliable financial information.”

This definition makes it clear that the legislature conceived Internal Financial Controls (IFC) as a broad umbrella covering three tiers:

1. Operational controls, which drive procedural efficiency, consistency and adherence to policy.
2. Asset safeguarding and fraud prevention controls, which protect physical and intellectual assets, prevent leakages and identify unauthorised transactions.
3. Internal Controls over Financial Reporting (ICFR), which are the accounting processes, approvals, system validations and reconciliations that ensure the financial statements give a true and fair view.

Who is responsible for what

The Act distributes IFC obligations across four groups.

1. The Board of Directors

For listed companies, Section 134(5)(e) requires the Directors’ Responsibility Statement in the Board’s Report to state that the directors have laid down internal financial controls to be followed by the company, and that such controls are adequate and were operating effectively.

For all other companies, Section 134(3)(q) read with Rule 8(5)(viii) of the Companies (Accounts) Rules, 2014 requires the Board’s Report to state the details in respect of the adequacy of internal financial controls with reference to the financial statements. Independent directors also have a duty under Schedule IV to satisfy themselves on the integrity of financial information and that financial controls are strong and defensible.

A contravention of Section 134 can attract a penalty under Section 134(8). Following the Companies (Amendment) Act, 2020, this is ₹3 lakh for the company and ₹50,000 for every officer in default.

2. The Audit Committee

Section 177(4)(vii) requires the Audit Committee to evaluate internal financial controls and risk management systems. In practice, this means reviewing internal audit findings, questioning management on design gaps and monitoring remediation before quarterly and annual sign-offs. For listed entities, the Securities and Exchange Board of India (SEBI) Listing Obligations and Disclosure Requirements (LODR) Regulations add a further layer: under Regulation 17(8), the CEO and CFO certify to the board that they accept responsibility for establishing and maintaining internal controls for financial reporting and have evaluated their effectiveness.

3. The Internal Auditor

Section 138 read with Rule 13 of the Companies (Accounts) Rules, 2014 requires prescribed classes of companies to appoint an internal auditor. A well-structured internal audit function is usually the engine that performs or coordinates management’s IFC testing.

4. The Statutory Auditor

Independent verification is required under Section 143(3)(i). Following the Companies (Amendment) Act, 2017, the auditor’s report must state whether the company has adequate internal financial controls with reference to financial statements in place and the operating effectiveness of such controls. The auditor’s reporting is therefore limited to ICFR, while the directors’ responsibility under Section 134 covers the broader IFC definition. The auditor performs this work under the Guidance Note on Audit of Internal Financial Controls Over Financial Reporting issued by the Institute of Chartered Accountants of India (ICAI).

Exemption from auditor reporting for certain private companies

To reduce the compliance burden on smaller entities, MCA notification G.S.R. 583(E) dated 13 June 2017, read with the corrigendum dated 13 July 2017, exempts the following private companies from auditor reporting under Section 143(3)(i):

1. One Person Companies (OPCs) and Small Companies.
2. Private companies that have turnover of less than ₹50 crore as per the latest audited financial statements and aggregate borrowings from banks, financial institutions or any body corporate of less than ₹25 crore at any point of time during the financial year.

The exemption is available only to a private company that has not committed a default in filing its financial statements under Section 137 or its annual return under Section 92. The definition of Small Company itself was widened by notification G.S.R. 880(E) with effect from 1 December 2025, raising the limits to paid-up capital of up to ₹10 crore and turnover of up to ₹100 crore. Companies near these thresholds should re-examine their position each year.

The exemption covers only the auditor’s reporting. The Board’s Report must still address the adequacy of IFC under Rule 8(5)(viii), and directors remain bound by their duties under Section 166. Disciplined internal governance therefore remains necessary for every company.

Summary of IFC obligations

Stakeholder	Provision	Obligation
Board of a listed company	Section 134(5)(e)	State that IFC are laid down, adequate and operating effectively
Board of any other company	Section 134(3)(q), Rule 8(5)(viii)	Report adequacy of IFC with reference to financial statements
Audit Committee	Section 177(4)(vii)	Evaluate IFC and risk management systems
CEO and CFO of a listed entity	SEBI LODR Regulation 17(8)	Certify responsibility for and evaluation of internal controls
Statutory auditor	Section 143(3)(i)	Report on adequacy and operating effectiveness of IFC over financial reporting
Statutory auditor	Section 143(3)(j), Rule 11(g)	Report on use and preservation of audit trail in accounting software

3. The Core Components of an IFC Framework

To carry out methodical IFC testing as per India’s Companies Act, most companies structure their controls against a recognised framework. The most widely used is the Internal Control – Integrated Framework (2013) published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), which is built on 17 principles grouped into five components:

1. Control Environment

The control environment sets the tone of the organisation. It includes ethical values, integrity, governance philosophy, organisational structure, assignment of authority and human resource practices set by the board and senior leadership. If the control environment is weak, even well-designed transactional controls can fail.

2. Risk Assessment

Every company faces internal and external risks that could affect its reporting objectives. A sound risk assessment identifies potential sources of material misstatement, from complex supply chains to regulatory and tax changes, and estimates the likelihood and financial impact of each. It should also consider the risk of fraud specifically.

3. Control Activities

Control activities are the policies, procedures, system validations and manual reviews that mitigate risks. They operate at all levels of the organisation and include:

• Segregation of duties, for example ensuring that the person who updates vendor bank details cannot approve the payment
• Dual authorisation for large disbursements
• Automated three-way matching of purchase orders, goods receipt notes and invoices
• Physical verification of assets and inventory

4. Information and Communication

A control framework relies on timely and accurate information. This component assesses whether financial information is recorded accurately in the ERP and whether communication channels allow staff to report exceptions, errors or whistle-blower concerns without fear of reprisal.

5. Monitoring Activities

Controls cannot remain static. Monitoring involves ongoing evaluations, management self-assessments and independent internal audits to confirm that controls continue to function as the business changes.

4. End-to-End IFC Testing Lifecycle: A Step-by-Step Blueprint

IFC testing moves from high-level scoping down to individual transactions. The cycle generally follows five phases.

Phase 1: Scoping and materiality

Testing teams begin by analysing the financial statements and general ledger to set quantitative and qualitative materiality. Quantitative benchmarks are commonly set as a percentage of a relevant base, such as revenue, profit before tax or total assets, depending on the company’s profile. Auditors determine materiality under SA 320, and management’s scoping is most efficient when it is broadly aligned with the auditor’s.

Significant account balances and significant classes of transactions are then mapped to core business processes, typically:

1. Procure-to-Pay (P2P)
2. Order-to-Cash (O2C)
3. Hire-to-Retire (H2R)
4. Record-to-Report (R2R), including the financial statement close process
5. Inventory and warehouse management
6. Fixed asset management, from acquisition to retirement
7. Treasury, debt and cash management
8. Statutory compliance and tax provisioning, including indirect tax processes such as GST reconciliation

Locations and legal entities are also scoped. For a group, the consolidated financial statements must be considered, since auditor reporting on IFC applies to the Indian component companies that form part of the consolidation.

Phase 2: Process mapping and the Risk and Control Matrix (RCM)

Before testing, teams document how transactions flow through process narratives and flowcharts. Every failure point, known as “What Could Go Wrong” (WCGW), is identified and linked to the controls that address it in a structured Risk and Control Matrix (RCM).

The RCM is the foundation of any IFC programme. For each control it should capture:

RCM attribute	What it records
Control objective	The specific error or fraud scenario the control prevents or detects
Control type	Preventive (stops an error before entry) or detective (finds it after entry)
Nature	Manual, automated (system-enforced) or IT-dependent manual (manual review of a system report)
Frequency	Transactional, daily, weekly, monthly, quarterly or annual
Assertions addressed	Completeness, accuracy, valuation, existence, rights and obligations, presentation and disclosure
Control owner	The named person responsible for performing the control
Evidence	What is retained to show the control was performed
Key control	Whether the control is relied on for IFC conclusions

A good RCM focuses on key controls. In my experience, an RCM that lists every activity as a control becomes expensive to test and adds little assurance.

Phase 3: Test of Design (TOD)

The team next performs a formal Test of Design (TOD), usually through a walkthrough of a single transaction from initiation to its recording in the general ledger.

The purpose of the TOD is not to check whether the control worked many times. It is to confirm whether the control, as designed and documented in the RCM, is capable of preventing or detecting a material misstatement. If there is inadequate segregation of duties, or if a key calculation relies on an unprotected spreadsheet with no checks, the design is deficient and testing operating effectiveness would be premature.

Phase 4: Test of Operating Effectiveness (TOE)

Once the design is confirmed, teams carry out the Test of Operating Effectiveness (TOE). The question shifts from design to execution: Did the control operate consistently throughout the period?

Testing techniques, usually used in combination, include:

1. Inquiry: interviewing control owners about how they perform the control. Inquiry alone is never sufficient evidence.
2. Observation: watching the control owner perform the activity, such as a physical count.
3. Inspection: examining documents for signatures, electronic approvals, date stamps and supporting calculations.
4. Re-performance: independently performing the control again, such as recalculating depreciation or re-performing a reconciliation, to confirm the same result.

Sample sizes depend on the frequency of the control and the level of reliance. The ICAI Guidance Note does not prescribe fixed numbers, but the ranges below are commonly used in practice for manual controls:

Control frequency	Indicative sample size
Annual	1
Quarterly	2
Monthly	2 to 5
Weekly	5 to 15
Daily	20 to 40
Multiple times a day	25 to 60

Automated controls can often be tested with a single instance, provided the related IT General Controls are effective. This is one of the main reasons ITGC testing matters.

A practical example

Consider the control: “All vendor master changes are approved by the Finance Controller in the ERP before they become active.” The TOD walkthrough confirms that the ERP workflow routes changes for approval and that the requester cannot approve their own change. For the TOE, the tester extracts the full list of vendor master changes for the year from the system, confirms the completeness of that list, selects a sample of 25, and inspects the approval log for each. If two changes to bank details were activated without approval, that is a deviation that must be evaluated, not explained away.

Phase 5: Remediation, retesting and roll-forward

Any failure found during the Test of Operating Effectiveness (TOE) must be documented as an exception. Management must assess the root cause: was it an isolated lapse, or does it point to a systemic breakdown?

Remediation may involve re-performing controls, updating policies or changing system configurations. Once a control has been remediated, it must operate for a sufficient period before it is retested with a fresh sample.

Because interim testing is often completed around December for companies with an April to March financial year, teams perform roll-forward testing in the last quarter to confirm that controls continued to operate through the year end. This matters because the auditor’s opinion on IFC is given as at the balance sheet date.

5. Entity-Level Controls vs Process-Level Controls

A common mistake is to focus only on process-level controls and neglect the controls that operate across the organisation.

Entity-Level Controls (ELCs)

Entity-Level Controls shape oversight and culture across the company. They fall into two groups:

• Direct ELCs operate at a level that can prevent or detect misstatements, such as the Audit Committee’s review of related-party transactions, management’s analytical reviews of results and budget-to-actual variance monitoring.
• Indirect ELCs influence behaviour, such as employee background checks, a published code of conduct, conflict-of-interest declarations and a functioning whistle-blower mechanism.

If ELCs are deficient, the reliability of transactional controls is compromised. For example, if senior management can override credit limits for favoured customers, process-level sales controls lose their practical effect. Management override is one of the most common root causes of fraud, so controls over it deserve specific attention.

Process-Level Controls (PLCs)

Process-Level Controls are embedded in day-to-day business activities. Examples include:

• Matching goods received against purchase orders before a liability is recorded
• Physical counts of high-value inventory at month end
• Automated reconciliation of payment gateway settlements with bank records
• Review and approval of non-routine journal entries before posting

6. IT General Controls (ITGC), Application Controls and Audit Trail

Financial statements today depend on the integrity of ERP systems such as SAP S/4HANA, Oracle or Microsoft Dynamics. Testing business process controls without testing the underlying IT environment leaves the IFC conclusion incomplete. Frameworks such as ISACA’s COBIT are commonly used to structure IT control reviews.

IT General Controls (ITGC)

ITGCs support the reliability of all applications and data. They cover four domains:

1. Access to programs and data: user provisioning and removal, privileged access, password policies, multi-factor authentication and periodic user access reviews.
2. Program changes: ensuring that changes, patches and configuration updates are requested, tested, approved and moved to production in a controlled way.
3. Computer operations: batch jobs, interfaces, backups, disaster recovery testing and incident management.
4. Program development: ensuring that new systems and migrations follow a formal system development life cycle, including data migration checks.

Automated application controls

Application controls are business rules and validations built into the software. Examples include:

• Blocking payment release without a three-way match of purchase order, goods receipt note and vendor invoice
• Tolerance limits that route purchases above approved values for additional approval
• Preventing postings into closed accounting periods

Audit trail: an IFC requirement in its own right

For financial years beginning on or after 1 April 2023, the proviso to Rule 3(1) of the Companies (Accounts) Rules, 2014 requires every company that maintains books of account in accounting software to use software that records an audit trail of each transaction, creates an edit log of each change, and does not allow the audit trail to be disabled. The auditor reports on this under Section 143(3)(j) read with Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014. The ICAI Journal’s overview of audit trail requirements notes that a lapse in this area can also affect the auditor’s report on IFC. In practice, audit trail configuration, database-level access and log retention should now be part of every ITGC review. Many companies use independent IT audit and ITGC reviews to test this before the statutory audit.

7. Control Deficiencies, Remediation and Statutory Reporting

When testing shows that a control is poorly designed or did not operate, management and the Audit Committee must assess the severity of the deficiency. The ICAI Guidance Note classifies deficiencies into three levels:

1. Control deficiency: the design or operation of a control does not allow management or employees, in the normal course of their work, to prevent or detect misstatements on a timely basis. Isolated documentation lapses usually fall here.
2. Significant deficiency: a deficiency, or combination of deficiencies, in IFC over financial reporting that is less severe than a material weakness but important enough to merit the attention of those charged with governance.
3. Material weakness: a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis.

When evaluating severity, consider both the likelihood and the potential magnitude of misstatement, the existence of compensating controls, and whether several smaller deficiencies affect the same account or assertion.

Impact on the auditor’s report under Section 143(3)(i)

The auditor’s opinion on IFC over financial reporting is given as at the balance sheet date:

Opinion	When it applies
Unmodified	IFC are adequate and operating effectively as at the balance sheet date. Control deficiencies and significant deficiencies alone do not modify the opinion, though significant deficiencies are communicated to those charged with governance.
Qualified	One or more material weaknesses exist, but their effect is not pervasive.
Adverse	Material weaknesses exist and their effect is pervasive, so IFC cannot be considered effective.
Disclaimer	The auditor cannot obtain sufficient appropriate evidence because of a limitation on scope.

A company’s IFC cannot be considered effective if even one material weakness exists at the balance sheet date. The auditor must also consider whether a modified IFC opinion affects the opinion on the financial statements. Audit quality in this area is overseen by the National Financial Reporting Authority (NFRA) for companies within its remit, which makes the quality of management’s own documentation even more important.

8. How Indian IFC Compares with SOX

Many Indian subsidiaries and GCCs of US-listed groups test controls under both regimes. The US Securities and Exchange Commission (SEC) administers management’s reporting under SOX Section 404, and auditors follow PCAOB AS 2201. The key differences are:

Aspect	Indian IFC (Companies Act, 2013)	SOX (US-listed companies)
Who it applies to	Most Indian companies, with exemptions for certain private companies	SEC registrants and their subsidiaries in scope
Scope of management’s responsibility	Broad IFC, including operational controls	ICFR
Scope of auditor’s opinion	IFC with reference to financial statements	ICFR (for accelerated filers)
Guidance	ICAI Guidance Note	PCAOB AS 2201 and SEC guidance
Date of opinion	Balance sheet date	Fiscal year end

A single, well-designed RCM can usually serve both purposes, with additions to cover the broader Indian IFC definition and India-specific requirements such as audit trail reporting.

9. Common Pitfalls We See in IFC Programmes

From practical experience, the issues that most often lead to weak IFC outcomes are:

1. RCMs copied from templates that do not reflect how the business actually operates.
2. Too many controls labelled as key, which makes testing expensive and diverts attention from the controls that matter.
3. Weak evidence of review controls, where a signature is present but there is no evidence of what was reviewed or what thresholds were applied.
4. Ignoring the completeness and accuracy of system reports used in IT-dependent manual controls.
5. No testing of ITGCs, which undermines reliance on automated controls.
6. Late testing, which leaves no time to remediate before the balance sheet date.
7. Self-testing by control owners, which lacks the objectivity the Audit Committee and auditors need.

10. Best Practices for Ongoing Audit Readiness

Compliance under the Companies Act should not become a year-end fire drill. High-performing finance teams follow these practices:

1. Treat the RCM as a living document. Processes change through ERP migrations, new business lines and restructuring. Review the RCM at least twice a year and whenever a major change occurs.
2. Retain evidence in real time. Do not reconstruct approval trails months later. Archive reconciliations, approvals and verification sheets when the control is performed.
3. Use continuous monitoring. Data analytics in the ERP can flag anomalies such as split purchase orders designed to avoid approval limits as they happen.
4. Keep testing independent. The people who perform controls should not test their own work. Internal audit or an external risk advisory and GRC team provides objective, defensible results.
5. Align with the statutory auditor early. Agree scope, key controls and testing approach before the year starts so that the auditor can place reliance where appropriate.
6. Report to the Audit Committee regularly. A quarterly dashboard of testing status, deficiencies and remediation keeps governance informed and avoids surprises.

Professional bodies such as the Institute of Internal Auditors (IIA) publish useful guidance on internal audit’s role in monitoring controls that can help structure these practices.

Frequently Asked Questions

1. What is the core objective of IFC testing as per India’s Companies Act?

The objective of IFC testing as per India’s Companies Act is to evaluate whether a company’s internal controls are adequately designed and operating effectively. This gives the board, the Audit Committee and the statutory auditor a basis for confirming that records are complete and accurate, assets are protected, fraud risks are addressed and the financial statements give a true and fair view.

2. What is the difference between IFC and ICFR?

Internal Financial Controls (IFC), defined in the Explanation to Section 134(5)(e), cover operational efficiency, adherence to policies, safeguarding of assets, fraud prevention and reliable financial reporting. Internal Controls over Financial Reporting (ICFR) are the subset that directly affects the financial statements. The auditor’s reporting under Section 143(3)(i) covers IFC with reference to financial statements, which is ICFR.

3. What is the difference between a Test of Design (TOD) and a Test of Operating Effectiveness (TOE)?

A Test of Design checks whether a control, if performed as described, is capable of preventing or detecting a material misstatement, usually through a walkthrough. A Test of Operating Effectiveness checks whether the control actually operated consistently throughout the period, by testing a sample of instances.

4. What is a Risk and Control Matrix (RCM)?

A Risk and Control Matrix is the central document of an IFC programme. It links each process risk (“what could go wrong”) to the controls that address it, and records the control’s objective, type, nature, frequency, owner, assertions and evidence.

5. Which private companies are exempt from auditor reporting on IFC?

One Person Companies, Small Companies, and private companies with turnover below ₹50 crore and borrowings below ₹25 crore at all times during the year are exempt, provided they have not defaulted in filing financial statements or annual returns. The exemption applies only to auditor reporting under Section 143(3)(i), not to the Board’s Report.

6. Do unlisted companies need to report on IFC in the Board’s Report?

Yes. While the Directors’ Responsibility Statement on IFC under Section 134(5)(e) applies to listed companies, Rule 8(5)(viii) of the Companies (Accounts) Rules, 2014 requires the Board’s Report of every company to state the adequacy of internal financial controls with reference to the financial statements.

7. Which professional standards guide IFC audits in India?

Statutory auditors follow the ICAI Guidance Note on Audit of Internal Financial Controls Over Financial Reporting, together with the Standards on Auditing. Most companies design their controls using the COSO 2013 Internal Control – Integrated Framework.

8. How many samples should be tested for a control?

The ICAI Guidance Note does not prescribe fixed sample sizes. In practice, sample sizes depend on control frequency and reliance, ranging from one instance for an annual control to 25 to 60 instances for controls performed many times a day. Automated controls can often be tested with one instance if ITGCs are effective.

9. Does a significant deficiency lead to a qualified IFC opinion?

No. Under the ICAI Guidance Note, the auditor’s IFC opinion is modified only when one or more material weaknesses exist at the balance sheet date. Significant deficiencies are communicated to those charged with governance but do not by themselves modify the opinion.

10. Why are IT General Controls important for IFC?

Automated controls and system reports are only reliable if access, changes and operations in the IT environment are controlled. If ITGCs fail, the auditor and management cannot rely on automated controls without much more extensive testing.

11. How does the audit trail requirement relate to IFC?

From financial years beginning on or after 1 April 2023, companies must use accounting software with an audit trail that cannot be disabled, and auditors report on this under Rule 11(g). Weaknesses in the audit trail usually point to ITGC weaknesses and can also affect the auditor’s IFC report.

12. When should IFC testing be performed?

Design documentation and walkthroughs should be completed early in the year, interim operating effectiveness testing by around the third quarter, and roll-forward testing in the final quarter. This leaves time to remediate deficiencies before the balance sheet date.

13. Can a company use its SOX documentation for Indian IFC compliance?

Largely, yes. A SOX-compliant RCM is a strong starting point, but it should be extended to cover the broader Indian IFC definition, India-specific statutory processes and requirements such as audit trail reporting.

Talk to SBC’s Audit and Risk Advisory Team

SBC helps companies design, document and test internal financial controls, from RCM development and ITGC reviews to independent testing and Audit Committee reporting. Explore our IFC and ICFR testing support or Contact SBC to discuss your IFC programme.

Disclaimer

This article is provided for general informational and educational purposes only and should not be considered legal, tax, financial, audit or professional advice. The applicability of the provisions discussed depends on the facts and circumstances of each company. Laws, rules, notifications, thresholds and professional pronouncements change from time to time, and the information in this article may not reflect the latest position. Readers should verify the current position from official sources such as the Ministry of Corporate Affairs, SEBI and the Institute of Chartered Accountants of India, and should consult a qualified professional for advice specific to their circumstances before acting on any information in this article.

Short answer: Risk advisory services help organisations identify and assess business risks, evaluate internal controls, strengthen governance and improve compliance. Depending on the engagement, they cover enterprise risk management, internal audit, internal financial controls testing, process documentation, fraud and cyber risk reviews, and improvement of business processes.

Requirement	Source	What it means in practice
Board’s report must include a statement on the development and implementation of a risk management policy, including elements of risk that may threaten the company’s existence	Section 134(3)(n), Companies Act, 2013	The board must be able to describe how risk is identified and managed
Audit committee terms of reference include evaluation of internal financial controls and risk management systems	Section 177(4)(vii), Companies Act, 2013	The audit committee needs reliable information, not only management assertions
Internal audit for prescribed companies	Section 138 with Rule 13, Companies (Accounts) Rules, 2014	Listed companies, and unlisted public and private companies above prescribed thresholds, must appoint an internal auditor
Statutory auditor reports on internal financial controls over financial reporting	Section 143(3)(i), Companies Act, 2013	Control design and testing should be ready for external scrutiny
Statutory auditor cannot provide internal audit services to the same company	Section 144, Companies Act, 2013	Independence must be checked when appointing providers
Risk Management Committee for the top 1,000 listed entities by market capitalisation, meeting at least twice a year, with cyber security in its remit	Regulation 21, SEBI LODR Regulations, 2015	Listed entities need a formal committee and a documented risk policy
Reporting of specified cyber incidents to CERT-In within six hours of noticing them	CERT-In Directions, April 2022	Incident response must be rehearsed, not improvised
Personal data protection duties, including breach reporting	Digital Personal Data Protection Act, 2023 and Rules, 2025	Obligations are phased in; plan for breach intimation and a detailed report within 72 hours

Line	Who	Role
First	Business management and operations	Own risks, run controls, follow procedures and fix weaknesses
Second	Risk, compliance, information security and other specialist functions	Set methods, advise, monitor exposures and challenge business practices
Third	Internal audit	Provide independent and objective assurance and report to the audit committee
Fourth (extended view)	External assurance providers, such as statutory auditors and independent assessors	Provide assurance within the scope of their engagements; they do not replace management’s responsibility
Fifth (extended view)	Regulators and external stakeholders	Set and enforce requirements and shape expectations through oversight

Risk area	Example risk	Typical control	Monitoring indicator
Procurement	Payment to a fictitious or conflicted vendor	Vendor onboarding checks and independent approval	Exceptions in vendor master changes
Financial reporting	Misstatement through unsupported journal entries	Journal review and monthly reconciliations	Reconciliation ageing
Technology	Unauthorised access to critical systems	Access reviews and privileged-user monitoring	Open access exceptions
Third party	Supplier failure disrupts delivery	Supplier assessment and contingency sourcing	Share of spend with single-source vendors
Compliance	Missed statutory filing	Compliance calendar with named owners	Late or missed filings

Model	Strength	Consider when
In-house	Deep knowledge of the business and quick access	You have scale and the skills to staff a full function
Outsourced	Independence, breadth of expertise and flexible capacity	You lack a dedicated team or need specialist skills
Co-sourced	Combines internal knowledge with external specialists	You want specialist support on specific areas such as IT or analytics

Stage	Characteristics
1. Traditional compliance	Focus on obligations, documented policies, periodic audits and manual control checks
2. Integrated risk management	Risk assessments, compliance activities, controls and assurance plans are aligned across functions
3. Data-driven GRC	Integrated systems, analytics and automated reporting give timely visibility of risk and control performance
4. Continuous and predictive intelligence	Where data quality and governance allow, advanced analytics support early warning and forward-looking assessment

Indicator	What it tells you
Share of critical risks with named owners	Whether accountability is real
Time taken to remediate high-risk findings	Whether management acts on audit results
Recurrence of significant control deficiencies	Whether root causes are being fixed
Share of key controls operating effectively	Quality of the control environment
Compliance exception trends	Whether the compliance process is improving
Timeliness of risk reporting to management	Quality of risk information
Coverage of critical processes by risk assessments	Gaps in visibility
Results of continuity and incident response exercises	Preparedness for disruption

Disclaimer

This article is provided for general informational and educational purposes only. It should not be considered legal, tax, financial or professional advice. Laws, regulations, thresholds and timelines, including those under the Companies Act, 2013, the SEBI Listing Regulations, the CERT-In directions and the Digital Personal Data Protection Act, 2023 and Rules, 2025, may change. Readers should verify the latest information from the relevant government and official sources, and should consult a qualified professional for advice specific to their circumstances. Examples and scenarios are simplified illustrations and do not describe any actual client.