Internal Financial Control Assessment and Reporting ...

1 InternalFinancialControl AssessmentandReportingrequirements,CaseS tudies, , 2017 WIRC of ICAI2 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third of ContentsApproach and Methodology under IFC52 Few Relevant Things26 Why Internal Financial Controls (IFC)?3 Applying COSO 20131349 Project Planning under IFC59 Key Outputs/Deliverables67 Illustrative Work Papers75 Status Reporting82 Case Study94 Scope and Coverage under IFC3 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third Internal Financial Controls (IFC)?4 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third Financial Controls (IFC) -BackgroundAsubstantialstepinmakingregul ationsmorecoherent,CompaniesAct,2013hadi ntroducedtheconceptofInternalFinancialCo ntrols(IFC) 'responsibilitiesonIFCislaiddownundersec tion134(3)(c)readwithsection134(5)(e).

2 TheAuditor sresponsibilitiestowardsIFCreportingwasl aiddowninsection143(3)(i).TheAuditCommit tee stermsofreferenceonIFCislaiddownundersec tion177(4)(vii).IFCshavebeendefinedunder section134(5)(e)asfollowing: Thepoliciesandproceduresadoptedbythecomp anytoensureorderlyandefficientconductofi tsbusiness,includingadherencetocompany spolicies,safeguardingofitsassets,preven tionanddetectionoffraudsanderrors,accura cyandcompletenessofaccountingrecords,and thetimelypreparationofreliablefinanciali nformation. 'toneatthetop' 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third , ,asenvisagedintheCompaniesAct,2013,areas follows: Section134 Directorsofalllistedcompanieshavetorepor tthatthelaiddownIFCsofthecompanyhavebeen followedandthatsuchIFCareadequateandwere operatingeffectively.

3 Section177 Everyauditcommitteeshallactinaccordancew iththetermsofreferencespecifiedinwriting bytheboardwhichshall,interalia,include,e valuationofinternalfinancialcontrolsandr iskmanagementsystems. Section143-Theauditor (E),464(E),466(E)dated5thJune,2015(amend edon13thJune,2017),whetherthecompanyhasa dequateIFCsysteminplaceandtheoperatingef fectivenessofsuchcontrols. ScheduleIV AsperpartIIofclause49listingagreement,ro leofAuditCommitteeshallincludeevaluation ofinternalcontrolandriskmanagement. AsperpartVofclause49listingagreement, Requirements on IFC Companies Act, 20136 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third Companies (Accounts) Rules, 2014 AsperRule8(4)oftheCompanies(Accounts)Rul es,2014:- Everylistedcompanyandeveryotherpubliccom panyhavingapaidupsharecapitaloftwentyfiv ecrorerupeesormorecalculatedattheendofth eprecedingfinancialyearshallinclude,inth ereportbyitsBoardofdirectors,astatementi ndicatingthemannerinwhichformalannualeva luationhasbeenmadebytheBoardofitsownperf ormanceandthatofitscommitteesandindividu aldirectors.

4 AsperRule8(5)(viii)oftheCompanies(Accoun ts)Rules,2014:-Inadditiontotheinformatio nanddetailsspecifiedinsub-rule(4),therep ortoftheBoardshallalsocontain Thedetailsinrespectofadequacyofinternalf inancialcontrolswithreferencetotheFinanc ialStatements. Statutory Requirements on IFC Board Report7 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third of IFCS ection ResponsibilityListed CompanyUnlisted Public CompanyPrivate Company134(3)(c) read with 134 (5) (e)Directors ResponsibilityStatementYesYes*,Note 1No, Note 1177 (4) (vii) and 177 (5)Audit CommitteeYesYes**,Note 2No**, Note 2143 (3) (i)Audit Report**Note 3 YesYesYesNote 4 Section 149 (8) read with Schedule IVIndependent DirectorsYesYes**,Note 2No**, Note 2*Note1:WhilsttheActspecifiesonlistedcom panies,Rule8(5)(viii)oftheCompanies(Acco unts)Rules,2014readwithRule8(4)talksabou tlistedandunlistedpubliccompaniesonlywit hpaidupcapitalofRs25croreormorecalculate dattheendoftheprecedingfinancialyear.

5 **Note2:AllPublicCompanieswithpaidupcapi talofINR10croreormore,TurnoverofINR100cr oresormoreandLoan,borrowing, **Note3:AuditorReportcommentuponIFCislim itedtoICFR asperICAI guidelines.**Note4:ChapterX,clause(i)ofs ub-section(3) 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third party. Section2(62)oftheCompaniesAct,2013define s onepersoncompany Section2(85)definesaSmallCompanyas smallcompany meansacompany,otherthanapubliccompany, (i)paid-upsharecapitalofwhichdoesnotexce edfiftylakhrupeesorsuchhigheramountasmay beprescribedwhichshallnotbemorethanfivec rorerupees;or(ii)turnoverofwhichasperits lastprofitandlossaccountdoesnotexceedtwo crorerupeesorsuchhigheramountasmaybepres cribedwhichshallnotbemorethantwentycrore rupees:ProvidedthatnothinginthisSections hallapplyto (A)aholdingcompanyorasubsidiarycompany;( B)acompanyregisteredunderSection8;or(C)a companyorbodycorporategovernedbyanyspeci alActDefinitions:-9 2017 Protiviti.

6 CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third Equivalents Abroad Globally,auditor ,inUSA,Section404oftheSarbanesOxleyActof 2002,prescribesthattheregisteredpublicac countingfirm(auditor)ofthespecifiedclass ofissuers(companies)shall,inadditiontoth eattestationofthefinancialstatements, 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third Scope for (CARO) ThescopeforreportingonIFCsissignificantl ylargerandwiderthanthereportingoninterna lcontrolsundertheCompanies(Auditor sReport)Order,2016( CARO ). UnderCARO,thereportingoninternalcontrols islimitedtotheadequacyofcontrolsoverpurc haseofinventoryandfixedassetsandsaleofgo odsandservices. CARO doesnotrequirereportingonallcontrolsrela tingtofinancialreportingandalsodoesnotre quirereportingonthe adequacyandoperatingeffectiveness Auditor sreportingonIFCsisarequirementspecifiedi ntheCompaniesAct,2013andthereforewillapp lyonlyincaseofreportingonfinancialstatem entspreparedundertheActandreportedunderS ection143.

7 Accordingly,reportingonIFCsshallnotbeapp licablewithrespecttointerimfinancialstat ements,suchasquarterlyorhalf-yearlyfinan cialstatements(unlesssuchreportingisrequ iredunderanyotherlaworregulation).11 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third Scope for Reporting (continued)ContextofReporting TheCompaniesAct,2013(TheAct)specifiesthe auditor sreportingoninternalfinancialcontrolsonl yinthecontextofauditoffinancialstatement s. TheTerm Internalfinancialcontrols statedinTheActrelatesto internalfinancialcontrolsoverfinancialre porting inaccordancewiththeobjectivesofanauditst atedinSA200 OverallObjectivesoftheIndependentAuditor andtheConductofanAuditinAccordancewithSt andardsonAuditing Further,Rule8(5)(viii)oftheCompanies(Acc ounts)Rules,2014requirestheBoardofDirect ors reportofallthecompaniestostatethedetails inrespectofadequacyofinternalfinancialco ntrolswithreferencetothe financialstatements only.

8 Inlightoftheabove, 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third of IFC Under Companies Act 2013 IFC is an important tool to augment effective Corporate Governance:13 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third COSO 201314 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third 2013 The COSO (Committee of Sponsoring Organizations of the Treadway Commission) 2013 Framework should be utilized to design and review an IFC FrameworkTheCOSO2013 ,Divisions, ,implementingandoperatinganeffectiveinte rnalcontrolenvironment,aswellas, 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third 2013 Control Environment16 2017 Protiviti.

9 CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third 2013 Control Environment (continued)17 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third 2013 Risk Assessment18 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third 2013 Risk Assessment (continued)19 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third 2013 Risk Assessment (continued)20 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third 2013 Control Activities21 2017 Protiviti.

10 CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third 2013 Control Activities (continued)22 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third 2013 Information and Communication23 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third 2013 Monitoring Activities24 2017 Protiviti. CONFIDENTIAL: This document is for your Company's Internal use only and may not becopied nor distributed to another third Environment & Risk Assessment PrinciplesrelatingtotheControlEnvironmen tcomponentinclude: Theorganizationdemonstratesacommitmentto integrityandethicalvalues Theboardofdirectorsdemonstratesindepende ncefrommanagementandexercisesoversightfo rthedevelopmentandperformanceofinternalc ontrol Managementestablishes,withboardoversight ,structures,reportinglines,andappropriat eauthoritiesandresponsibilitiesinthepurs uitofobjectives Theorganizationdemonstratesacommitmentto attract,develop,andretaincompetentindivi dualsinalignmentwiththeobjectives Theorganizationholdsindividualsaccountab lefortheirinternalcontrolresponsibilitie sinthepursuitofobjectivesPrinciplesrelat ingtotheRiskAssessmentcomponentinclude.