Materiality, Risk Assessment & Internal Control
1. Internal Financial Controls (IFC) under Section 143(3)(i)
Section 143(3)(i) requires the statutory auditor to report on whether the company has an adequate Internal Financial Controls Over Financial Reporting (ICFR) system in place and the operating effectiveness of such controls.
🏛️ Private Company Exemption Thresholds (Notification June 2017)
Section 143(3)(i) reporting on ICFR does NOT apply to a Private Limited Company if:
- It is a One Person Company (OPC) or a Small Company; OR
- It has Turnover < ₹50 Crore as per latest audited financial statements AND Aggregate Borrowings from banks/FIs < ₹25 Crore at any point of time during the financial year.
2. General IT Controls (ITGC) vs. Application Controls
| Control Type | Definition & Infrastructure Scope | Practical Examples |
|---|---|---|
| IT General Controls (ITGC) | Policies and procedures that relate to many applications and support the effective functioning of application controls across the entity. | • Access security & passwords • Program change management • Data center operations & backups • Program development |
| Automated Application Controls | Manual or automated procedures that typically operate at a business process level to ensure completeness, accuracy, and authorization of transactions. | • 3-way match in ERP (PO vs GRN vs Invoice) • Sequence check on invoice numbers • Mandatory field validations |
3. The Audit Risk Model
📐 Audit Risk = Inherent Risk (IR) × Control Risk (CR) × Detection Risk (DR)
Risk of Material Misstatement (RMM = IR × CR): The entity's risks existing independently of the audit.
Detection Risk (DR): The risk that procedures performed by the auditor will not detect a misstatement. DR is inversely related to RMM: When RMM is High, acceptable Detection Risk must be Low (meaning extensive substantive testing!).
4. Deficiency Classification Protocol
| Severity Level | Criteria | Statutory Reporting Action |
|---|---|---|
| Material Weakness | Deficiency such that there is a reasonable possibility that a material misstatement will not be prevented or detected on timely basis. | Modify ICFR opinion → Adverse Opinion on ICFR. |
| Significant Deficiency | Important enough to merit attention by TCWG, but not rising to the level of a material weakness. | Communicate in writing to TCWG under SA 265; does not modify ICFR opinion. |