IFC Applicability for Private Limited Companies

Internal Financial Controls, commonly referred to as IFCs, are one of those compliance concepts that many private company directors have heard of but quietly hope do not apply to them. The reality, as usual, sits somewhere between legal wording and practical interpretation.

This article explains, in plain and experience-based terms, how IFCs apply to private limited companies in India, what is mandatory, what is exempt, where confusion usually arises, and why many private companies underestimate this requirement until an auditor, investor, or lender forces the issue.

This is written for both company management and professionals—directors, CFOs, CAs, internal auditors, and compliance advisors—because IFCs only work when both sides understand their role clearly.

What Are Internal Financial Controls (IFCs) — in Practical Terms?

Internal Financial Controls are not just accounting checks. In real companies, IFCs are the systems and processes that answer questions like:

• Who approves payments, and can the same person record them?
• Can revenue be booked without evidence of delivery?
• Are expenses supported by documents, or just trust?
• Can one employee initiate, approve, and execute a transaction?

Legally, IFCs are defined as controls that ensure:

• Orderly and efficient conduct of business
• Safeguarding of assets
• Prevention and detection of fraud and errors
• Accuracy and completeness of accounting records
• Reliable financial reporting

In practice, IFCs sit at the intersection of finance, operations, and governance, not just bookkeeping.

Why IFCs Became a Serious Compliance Issue in India

The focus on IFCs intensified after corporate failures where financial statements looked clean until they suddenly didn’t. The Companies Act, 2013 introduced IFC-related responsibilities to move companies away from “post-facto correction” toward preventive governance.

The intent was clear:

Problems should be stopped before they hit the balance sheet.

This intent applies regardless of whether a company is listed or private. What differs is how deeply the law enforces reporting.

Applicability of IFCs Under the Companies Act, 2013

1. Responsibility of Directors (Applies to ALL Companies)

Under Section 134(5)(e), the Board of Directors must state in the Board’s Report that:

• The company has laid down internal financial controls, and
• Such controls are adequate and operating effectively

There is no size-based or category-based exemption here.

So even:

• Small private companies
• Family-owned businesses
• Closely held private limited companies

are legally expected to design and maintain IFCs.

This is often the first misunderstanding:

“Auditor reporting exempt hai, toh IFC bhi exempt hoga.”
That is incorrect.

2. Auditor Reporting on IFCs (Conditional for Private Companies)

Section 143(3)(i) requires statutory auditors to report on:

• Adequacy of IFCs, and
• Whether they are operating effectively

However, the Ministry of Corporate Affairs (MCA) issued a notification granting conditional exemption to certain private companies from this auditor reporting requirement.

This exemption does not remove the obligation to have IFCs. It only removes the auditor’s duty to formally report on them.

Which Private Limited Companies Are Exempt from IFC Audit Reporting?

A private company is exempt from auditor reporting on IFCs if it meets any one of the following conditions:

• It is a One Person Company (OPC)
• It is classified as a Small Company
• OR it satisfies both:

• • Turnover is below ₹50 crore, and

  • Aggregate borrowings from banks/FIs are below ₹25 crore

Important condition:
The company must not have defaulted in filing:

• Financial statements (Section 137), or
• Annual returns (Section 92)

If there is a filing default, even a small private company loses the exemption for that year.

What This Means in Reality (Not Just on Paper)

Here’s how this usually plays out in real companies:

• A small private company may not get an IFC paragraph in the audit report
• But directors still sign the Board’s Report claiming IFC adequacy
• During due diligence, bankers or investors ask for IFC documentation
• The company realises controls exist “in people’s heads,” not on paper

This gap is where problems begin.

IFCs: Management Responsibility vs Auditor Responsibility

One reason IFCs create friction is the misunderstanding of who owns them.

• Management designs and implements IFCs
• Auditors only evaluate and report on them

Even where auditor reporting is exempt, management responsibility remains intact.

In other words:

IFCs don’t belong to auditors. They belong to the company.

Common Areas Where Private Companies Fail IFC Expectations

Based on professional experience, the weakest IFC areas in private limited companies are:

• No segregation of duties due to small teams
• Informal approval processes (“verbally approved”)
• Manual accounting entries without review
• Weak controls over related-party transactions
• Lack of documented processes
• Over-dependence on one finance person

These are understandable challenges—but still risks.

Are IFCs Practical for Small Private Companies?

This is where realism matters.

A 10-person private company cannot have the same control framework as a listed entity. The law recognises this indirectly by allowing exemptions from audit reporting.

But “scaled-down” does not mean “non-existent.”

Effective IFCs for small private companies usually look like:

• Basic approval hierarchies
• Periodic independent review by directors
• Clear documentation for key transactions
• Simple but consistent processes

Controls should be proportionate, not cosmetic.

IFCs and Their Role in Funding, Due Diligence, and Growth

Even when not legally enforced through audit reports, IFCs quietly influence:

• Bank loan approvals
• Venture capital and private equity investments
• Mergers & acquisitions
• Internal fraud detection

Many private companies first document IFCs only when someone external demands it. By then, timelines are tight and risks are higher.

Penalties and Consequences of Ignoring IFCs

There is no standalone “IFC penalty.”
But failures can trigger consequences through:

• Misstatements in Board’s Report
• Auditor qualifications
• Director responsibility under Section 134
• Regulatory scrutiny if financial misreporting occurs

In short, IFC failures rarely stand alone—they surface when something else goes wrong.

Who Should Take IFCs Seriously (and Who May Not Need Complexity)

IFCs are especially important for:

• Growing private companies
• Companies with external borrowings
• Investor-backed businesses
• Groups with multiple entities

IFC frameworks may be simpler for:

• Very small, owner-managed companies
• Companies with low transaction volumes

But “simple” still does not mean “ignored.”

Key Statistics & Context

• Over 60% of active Indian companies are private limited companies, making IFC applicability a mass governance issue rather than a niche one
• Most private companies fall below audit-reporting thresholds, but all remain subject to director-level IFC responsibility
• There is no publicly available consolidated government data on how many private companies exceed IFC thresholds—this absence itself reflects why interpretation often varies in practice

Where data is unclear, professional judgment fills the gap.

Final Takeaway: The Real Applicability of IFCs

If you remember only one thing, remember this:

IFCs are mandatory in principle for all companies, but audit reporting on IFCs is conditional for private limited companies.

Ignoring IFCs because an auditor doesn’t report on them is short-sighted. Treating them as a scaled governance tool, rather than a compliance burden, is what separates stable private companies from fragile ones.

Frequently Asked Questions (FAQs)

1. Are IFCs mandatory for all private limited companies?

Yes, directors are required to ensure IFCs exist. Audit reporting may be exempt, but management responsibility is not.

2. Are small private companies fully exempt from IFCs?

No. They may be exempt from auditor reporting, not from maintaining controls.

3. Does turnover below ₹50 crore mean IFCs don’t apply?

It only affects auditor reporting. IFC responsibility still applies to management.

4. Can a private company have informal IFCs?

Controls must exist, but documentation is strongly advisable, especially for accountability.

5. Are IFCs only related to accounting?

No. They cover financial reporting, asset protection, approvals, and fraud prevention.

6. Who is responsible for IFC failures?

Primarily management and directors, not auditors.

7. Does late ROC filing affect IFC exemption?

Yes. Filing defaults remove the exemption for that year.

8. Do investors look at IFCs in private companies?

Almost always, especially during due diligence.

9. Can IFCs be outsourced?

Design support can be outsourced, but ownership cannot.

10. Is IFC compliance expensive for private companies?

It depends on complexity. Proportionate controls are usually cost-effective.