SOX, IFC and ICOFR: design, implementation and testing
A documented, tested control framework over financial reporting that management can certify and the statutory auditor can rely on.
Internal controls over financial reporting designed, documented, implemented and tested for SOX, Indian IFC and ICOFR requirements.
Directors of Indian companies state in the board's report that internal financial controls are adequate and operating effectively, and statutory auditors report on internal financial controls with reference to the financial statements. Groups listed in the United States add certification under the Sarbanes-Oxley Act. Each statement needs a framework that is designed, documented and tested.
We scope the significant accounts, processes and locations, document each process in narratives or flowcharts and build risk-control matrices that link every financial reporting risk to the controls that address it. Where controls are missing or weak, we design them with process owners and help put them in place, including IT general controls and segregation of duties.
We then test the design and operating effectiveness of each key control, evaluate deficiencies and their severity, and help management remediate before the year end. The result is evidence that management can sign and the auditor can review.
You are listing, listed, part of a US-listed group, or your auditor reports on internal financial controls.
Signs we see most often
- 01You are preparing to list, or have recently listed.
- 02Your group is listed in the United States and must comply with SOX 404.
- 03The statutory auditor has reported deficiencies in internal financial controls.
- 04Processes, systems or the group structure have changed significantly.
- 05Control documentation is out of date or exists only on paper.
- 06Management certifies controls that nobody has tested.
Scoped in writing, run by one accountable team.
Every engagement starts with agreed questions, a reporting line and a confidentiality protocol. The steps below are how this service usually runs; we adapt them to your matter.
- 01ScopeIdentify significant accounts, processes, locations and systems.
- 02DocumentWrite narratives, flowcharts and risk-control matrices.
- 03DesignDesign missing controls, including IT general controls and segregation of duties.
- 04ImplementHelp process owners put the controls in place.
- 05TestTest design and operating effectiveness and evaluate deficiencies.
- 06RemediateSupport remediation and prepare for management's sign-off.
A documented, tested control framework that management can certify and the auditor can rely on.
- A scoping document and risk assessment
- Process narratives, flowcharts and risk-control matrices
- Test plans, test results and deficiency evaluations
- A remediation tracker
- Documentation supporting management's certification
The law and frameworks this work is aligned to
- Companies Act, 2013 s.134(5)(e) and s.143(3)(i)
- ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting
- US Sarbanes-Oxley Act ss.302 and 404
- PCAOB AS 2201, An Audit of Internal Control over Financial Reporting
- COSO Internal Control: Integrated Framework (2013)
- SEBI LODR Reg. 17(8) on certification by the CEO and CFO
References show the standard the work is built to. They do not imply accreditation or endorsement by the bodies that publish them.
This is a summary of the service. For a deeper understanding of how it would work for your organisation, please reach out to us.
Talk to a BDI partnerQuestions clients ask before we start.
What is the difference between IFC and ICOFR?
Internal financial controls, which directors report on, cover the orderly and efficient conduct of the business, including the safeguarding of assets and the prevention and detection of fraud. ICOFR is the narrower set of controls over financial reporting that the statutory auditor reports on.
Can one framework serve SOX and Indian requirements?
Yes. Most of the documentation and testing overlaps. We design one framework and map it to each requirement, so controls are tested once and reported to each audience.
Can you also act as our statutory auditor?
No. The statutory audit is performed by the company's auditor. We help management design, implement and test controls, and the auditor reaches its own conclusion.