Applicability of ICFR In India: Who Must Comply And Who Is Exempt?
If your company is listed or is a large unlisted company or a private company which exceeds the prescribed limit of borrowings and turnover, or a private company company who is in default in filing its financial statements then ICFR is applicable, the applicability of ICFR decides whether your statutory auditor must give a separate opinion on your internal controls over financial reporting this year. The statutory auditor’s obligation arises under Section 143(3)(i) of the Companies Act, 2013. The responsibilities of the board and the audit committee are set out separately in Sections 134 and 177.
This guide explains who is covered, who is exempt, and how an internal auditor supports ICFR compliance through control testing, deficiency tracking, and audit committee reporting. It is written for internal auditors, CFOs, finance heads, and compliance teams.
Key Takeaways
- Applicability of ICFR is automatic for listed and public companies; private companies use a two-part test plus a filing check.
- ICFR is the financial reporting part of the wider internal financial controls concept.
- A January 2026 circular from the National Financial Reporting Authority (NFRA) puts timely, written reporting of significant deficiencies in focus.
Applicability of ICFR at a Glance
The table below classifies each type of company by its ICFR reporting position, so you can identify your category before moving to the detailed explanation.
Company type | Auditor reports on ICFR (Sec. 143(3)(i))? | Related duties |
Listed company | Yes, no size exemption | Directors’ statement under Sec. 134(5)(e) and CEO/CFO certificate under Reg. 17(8) of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 |
Unlisted public company | Yes, no size exemption | Board’s report under Rule 8(5)(viii) and audit committee evaluation under Sec. 177(4)(vii) |
Private company: turnover below ₹50 crore AND borrowings below ₹25 crore, no filing default | Exempt | Controls still good practice |
Private company above either limit, or in filing default | Yes | Same as above |
One Person Company or small company | Exempt | Basic controls advisable |
What Is ICFR, and How Is It Different from Internal Financial Controls?
The two terms are often used as if they meant the same thing, but they do not.
Point | Internal financial controls (IFC) | Internal controls over financial reporting (ICFR) |
Source | Sec. 134(5)(e), Companies Act, 2013 | Sec. 143(3)(i), as read by the ICAI Guidance Note |
Scope | Wider: operations, assets, fraud prevention, records | Narrower: financial reporting controls behind reliable financial statements |
Owner | Board and management | Management designs; statutory auditor reports |
The ICAI Guidance Note limits auditor reporting to financial reporting controls, and Rule 8(5)(viii) ties the board’s report to financial statements, as this Roedl & Partner overview explains.
ICFR Applicability in India: Who Is Covered and Who Is Exempt?
ICFR applicability in India depends mainly on how your company is classified under the Companies Act, 2013.
Listed and Unlisted Public Companies
The MCA exemption notification carves out only certain private companies, so the applicability of ICFR is effectively automatic for listed and public companies.
Applicability of ICFR to Private Companies: The Two-Part Test
The MCA notification of June 13, 2017 (G.S.R. 583(E)) exempts a private company only when both limits hold:
- Turnover is below ₹50 crore in the latest audited financial statements.
- Borrowings from banks, financial institutions or any body corporate stayed below ₹25 crore at all times during the year.
The exemption is available only if the company has filed its financial statements under Section 137 and its annual return under Section 92 without any default.
A Common Misreading: ‘And’ vs ‘Or’
Several online sources still describe the exemption as applying when either the turnover limit of ₹50 crore or the borrowing limit of ₹25 crore is met. This reflects the text of the first notification, issued in June 2017. The Ministry of Corporate Affairs amended it a month later through Notification 2218(E) of 13 July 2017, clarifying “and” for “or”. A private company must therefore satisfy both limits together to claim the exemption.
Edge Cases the Thresholds Do Not Show
Situation | Why it matters | Internal auditor’s check |
Filing default under Sec. 137 or 92 | Exemption is lost | MCA filing history for the year |
Borrowings measured ‘at any point’ | A mid-year peak counts, not only year-end | Peak balance across all facilities |
Turnover on latest audited figures | Crossing ₹50 crore flips applicability next cycle | A forward turnover forecast |
Holding or subsidiary company | Falls outside the small company definition | Group structure and group auditor needs |
For the year-end workload this creates, see our statutory audit checklist for CFOs.
Which Thresholds Decide Applicability of ICFR?
These are the figures that decide whether ICFR or internal audit rules apply to you:
Parameter | Figure | Applies to |
Private company turnover | Below ₹50 crore | Sec. 143(3)(i) exemption |
Private company borrowings | Below ₹25 crore at any time in the year | Sec. 143(3)(i) exemption |
Small company limits | Paid-up capital not exceeding ₹4 crore, together with turnover not exceeding ₹40 crore | Exemption route (DPNC note) |
Internal audit: turnover | ₹200 crore or more | Unlisted public and private companies, Sec. 138 |
Internal audit: borrowings | Above ₹100 crore | Unlisted public and private companies |
Internal audit: paid-up capital | ₹50 crore or more | Unlisted public companies only |
Internal audit: outstanding deposits | ₹25 crore or more | Unlisted public companies only |
COSO framework | 5 components, 17 principles | Common design criteria (COSO) |
If you are unsure which category applies, a chartered accountant can assess your most recent audited financials and compliance filing record and confirm your position.
How Can You Test Applicability Of ICFR in Six Questions?
Work through these in order and record the answers in an applicability memo for the statutory auditor.
# | Question | Answer path |
1 | Is the company listed or an unlisted public company? | Yes means ICFR reporting applies. Continue only for private companies. |
2 | Is the company classified as an OPC or a small company under the Act? | Yes means exempt. A small company cannot be a holding company, a subsidiary or a Section 8 company. |
3 | Is turnover below ₹50 crore in the latest audited statements? | No means ICFR reporting applies. |
4 | Did borrowings stay below ₹25 crore at all times in the year? | No means ICFR reporting applies. |
5 | Was there any default under Section 137 or Section 92? | Yes means ICFR reporting applies. |
6 | Has the conclusion been documented and shared with the auditor? | Record the memo and review it at each year end. |
Two illustrative examples (hypothetical, not actual clients)
- A private company has turnover of ₹42 crore as per latest audited financials, but borrowings peaked at ₹28 crore for one month during the year. The peak breaches the ₹25 crore limit, so the company is covered.
- A private company has turnover of ₹38 crore and borrowings under ₹10 crore, with filings up to date. It is within both limits, so the auditor ICFR report is not required.
Once the memo is signed off, our statutory audit checklist for CFOs shows what the auditor will ask for next.
2026 Regulatory Radar: What Changed for ICFR Compliance
A few 2026 developments have raised the bar on how control issues are documented and reported.
Date | Development | Why it matters |
Jan 7, 2026 | NFRA circular on auditor and governance communication (SA 260, SA 265) | Significant control deficiencies must reach the board or audit committee in writing, on time (NFRA, KPMG) |
Mar 23, 2026 | Corporate Laws (Amendment) Bill, 2026 introduced in the Lok Sabha | Proposes more specific Board’s report comments on auditor qualifications and wider NFRA powers. A Joint Parliamentary Committee has reported and the revised bill is awaited. |
Mar 31, 2026 | NFRA interaction series on provisions | Stresses design and operating effectiveness of controls over provisions (KPMG update) |
May 2026 | FY 2025-26 CEO/CFO certificates under Reg. 17(8) | Cover internal controls for financial reporting and disclosed deficiencies (sample) |
Our read: documented, timely reporting of control deficiencies now sits close to the center of corporate governance.
What Is the Role of Internal Auditors in ICFR?
Internal auditors sit between management and the statutory auditor, and their work shapes how both sides view the control environment. Management owns the controls, the statutory auditor opines, and Section 144 keeps the two audit roles separate.
Who Does What in ICFR?
Party | Primary role | Key output |
CFO and finance team | Design, operate and self-assess controls | Process notes, risk and control matrix |
Board and audit committee | Oversee and evaluate controls | Review minutes, remediation directions |
Internal auditor | Independent control testing; report deficiencies | Test results, issue log |
Statutory auditor | Opinion on ICFR | Sec. 143(3)(i) report |
CEO and CFO (listed) | Certify responsibility; disclose deficiencies | Reg. 17(8) certificate |
Internal Audit and ICFR: The Six-Stage Cycle
Stage | What the internal auditor does | Output |
1. Scoping and risk assessment | Link financial statement line items to processes; rank risks | Scope memo, heat map |
2. Walkthroughs | Trace a transaction end to end | Walkthrough notes |
3. Design review | Check each control would prevent or detect errors | Design gap list |
4. Control testing | Test operating effectiveness across the period | Workpapers |
5. Deficiency evaluation | Grade each issue by severity | Deficiency log |
6. Reporting | Report to the audit committee; track fixes | Quarterly report |
Entity-Level Controls
A code of conduct, whistleblower channel, delegation of authority and audit committee oversight set the tone.
Process-Level Controls
These cover procure-to-pay, order-to-cash, payroll, fixed assets, treasury and the financial close.
IT General Controls
User access, change management and spreadsheets support nearly every control, so test them early.
For how reports should land with senior management, see why CFOs should review internal audit reports every quarter, and use these internal audit KPIs to measure the function
How Should Internal Auditors Grade Control Deficiencies?
Not every gap is equal, so a three-tier view keeps the audit committee focused on what matters.
Grade | Meaning | Escalation |
Control deficiency | A control is missing, badly designed or not operating | Process owner; track to closure |
Significant deficiency | Merits the attention of those overseeing financial reporting | Written communication to management and audit committee (SA 265) |
Material weakness | Reasonable possibility that a material misstatement will not be prevented or detected on time | Immediate escalation; may lead to a modified opinion |
Outcomes range from unmodified to qualified, adverse or disclaimer. See PKC’s IFC guide and the ICAI Guidance Note for the full reporting options.
Where Control Gaps Hide: A Heat Map for Financial Reporting Controls
The areas below are illustrative starting points from common audit experience.
Area | Typical gap | Internal auditor’s test |
Period-end journal entries | Manual entries without independent approval | Sample entries near close; compare preparer and approver |
Vendor and customer master | Unreviewed changes | Compare change reports to approvals |
User access | Same person creates and approves | Review access matrix for conflicts |
Reconciliations | Old items left open | Age open items; check sign-offs |
Provisions and estimates | No second review | Trace inputs to source |
Documentation quality affects timing too, as covered in our notes on common audit documentation mistakes and the prepared-by-client (PBC) list.
A 90-Day Internal Auditor Playbook for ICFR Compliance
A fixed timeline helps an internal audit team move from the applicability check to the audit committee report without a year-end rush.
Window | Focus | Deliverables |
Days 1 to 30 | Confirm applicability; refresh risk assessment and risk and control matrix | Applicability memo, scope |
Days 31 to 60 | Walkthroughs and design review; agree test plan with statutory auditor | Design gap log, test calendar |
Days 61 to 90 | Control testing, deficiency grading, audit committee pack | Graded issue log, remediation owners |
Our guide to reducing audit timelines and this startup pre-fieldwork checklist can help you plan.
How Does CARO 2020 Connect to Internal Audit and ICFR?
CARO 2020 reporting links directly to the internal audit work described above. It asks the statutory auditor whether the company has an internal audit system commensurate with its size and whether it considered those reports. See our CARO 2020 explainers for FY 2025-26 and the internal audit clause checklist.
What Mistakes Do Teams Make When Assessing the Applicability of ICFR?
Common errors in ICFR assessments include:
- Treating internal financial controls and ICFR as one concept.
- Reading the private company test as ‘or’ instead of ‘and’.
- Checking thresholds once a year instead of when borrowings or filings change.
- Documenting design but skipping control testing across the period.
- Raising control deficiencies only at year-end.
Applicability of ICFR: When Does It Not Apply?
Knowing the exclusions is just as important as knowing the triggers.
- Auditor reporting does not apply to qualifying One Person Companies, small companies and private companies within both limits, with no filing default.
- Exempt companies may still adopt financial reporting controls; lenders, investors and group auditors may ask for them.
Where Can You Get Help With ICFR Applicability?
Many finance teams settle the applicability question with a short written memo that the statutory auditor can review. SGGK & Co. LLP supports finance teams with ICFR documentation (standard operating procedures and risk and control matrices) and internal audit services in Bangalore for companies where it is not the statutory auditor. You can read about our audit support services, meet the partners, or get in touch to discuss your situation.