Scope of Reporting under Section 143(3) and 143(11) of the Companies Act, 2013 and in particular on the Existence, Adequacy and Effectiveness of Internal Financial Controls

EXECUTIVE SUMMARY

1. In conducting an audit of financial statements, the overall objectives of the auditor are: (a) To obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, thereby enabling the auditor to express an opinion on whether the financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework; and (b) To report on the financial statements, and communicate as required by the SAs, in accordance with the auditor’s findings.

2. The Companies Act,2013 requires the auditor to carry out his audit in accordance with the standards on auditing and in addition to the expression of opinion on the financial statements under subsection 143(2), report on various other matters: 12 under Section 143(3) and 16 under the Companies (Auditor’s Report), Order 2016  . These 28  items have differing degrees of relevance to the audit objectives as can be seen from Table 1, a few of which may be considered by auditors to have no direct  relevance to reporting on financial statements. The paper writer suggests that matters considered to be of interest to stakeholders but not of direct relevance to the audit of financial statements may be communicated by the auditor through a separate report as a separate engagement so that the focus on audit of financial statements is not lost in satisfying other requirements.

3. In Section I the paper writer conveys his view that in light of the requirement of Section 143(10) of the Companies Act 2013, that audit is carried out as per the standards of ICAI, the auditor is required to give his views and comments on these 28 matters based on such an audit. Hence the pronouncements of ICAI in respect of the corresponding requirements under the Companies Act,1956 in particular clause (g) of Subsection 143(3) would require review and these be reissued incorporating the requirements of the Standards of Auditing. .

4. In Section II the paper writer reiterates that the same applies to the reporting requirements under clause (i) of Section 143(3). The paper writer is of the view that the auditor is not required to carry out the audit of internal financial controls to give his views on the existence, adequacy and effectiveness of the Internal Financial Controls in the company under the said clause. ICAI’s Guidance Note on Audit of Internal Financial Controls over Financial Reporting (2015) unequivocally states that the audit of internal financial controls is an engagement separate from the audit of financial statements. Therefore the auditor has to convey his view on this issue based on the audit and additional procedures are not required. The paper writer suggests a format for reporting under this clause.

5. The paper writer also suggests that the view in ICAI’s Guidance Note  that the requirements of reporting under clause (i) of Section 143(3) is restricted only to  internal financial controls over financial reporting would require to be re-examined in light of a separate clause (h) under Section 143(3) requiring   the auditor to report on any  qualification, reservation or adverse remark relating to the maintenance of accounts and other matters connected therewith

6. In conclusion the paper writer reaffirms that ICAI needs to draw the line where auditor’s opinion is sought through audit reports on financial statements on matters which go beyond the requirements of the SAs, so that the purposes and scope of an audit of financial statements are not impacted.

I  REPORTING RESPONSIBILITES OF AUDITORS IN GENERAL

• The auditor of a company under Section 143 of the Companies Act,2013 has the following duties:

1. To make inquiries into the matters set out in Sub section (1)

1. To report under Subsection (2) of Section 143 on the accounts examined by him and on the financial statements laid before the members, whether said accounts, financial statements give a true and fair view of the state of affairs, the profit or loss and cash flows and such other matters as may be prescribed ( italics added). This report is to be issued after taking into consideration the provisions of the Act, requirements of the accounting standards and auditing standards, matters which are to be included in the audit report under the other provisions of the section including the report under the Companies (Auditor’s Report ) Order,2016  prescribed  under subsection (11).

1. Under Subsection (3) of Section 143 to state the following matters in his report:

(a) Whether he has sought and obtained all the information and explanations which to the best of his knowledge and belief were necessary for the purpose of his audit and if not, the details thereof and the effect of such information on the financial statements;

(b) whether, in his opinion, proper books of account as required by law have been kept by the company so far as appears from his examination of those books and proper returns adequate for the purposes of his audit have been received from branches not visited by him;

 (c) whether the report on the accounts of any branch office of the company audited under sub-section (8) by a person other than the company’s auditor has been sent to him under the proviso to that sub-section and the manner in which he has dealt with it in preparing his report;

 (d) Whether the company’s balance sheet and profit and loss account dealt with in the report are in agreement with the books of account and returns;

 (e) Whether, in his opinion, the financial statements comply with the accounting standards;

(f) The observations or comments of the auditors on financial transactions or matters which have any adverse effect on the functioning of the company;

(g) Whether any director is disqualified from being appointed as a director under sub-section (2) of section 164;

(h) Any qualification, reservation or adverse remark relating to the maintenance of accounts and other matters connected therewith;

 (I) whether the company has adequate internal financial controls system in place and the operating effectiveness of such controls;

(j) Such other matters as may be prescribed (italics added).

1. Under Rule 11 of the Companies (Audit and Auditors) Rules,2014 the following matters are to be included in the auditor’s report:

“The auditor’s report shall also include their views and comments (italics added) on the following matters, namely:-

(a) Whether the company has disclosed the impact, if any, of pending litigations on its financial position in its financial statement;

(b) whether the company has made provision, as required under any law or accounting standards, for material foreseeable losses, if any, on long term contracts including derivative contracts;

(c) Whether there has been any delay in transferring amounts, required to be transferred, to the Investor Education and Protection Fund by the company.”

The publications attribute this rule to clause (j) of Subsection 143(3) and not Subsection 143(2).

1. Under Subsection 11 the auditors of such class of companies as specified in an order made by the Central Government shall include in their report a statement on the matters specified in the order. The matters now specified in the Companies (Auditors Report) Order,2016 are as under :

 (i) (a) whether the company is maintaining proper records showing full particulars, including quantitative details and situation of fixed assets;

(b) Whether these fixed assets have been physically verified by the management at reasonable intervals; whether any material discrepancies were noticed on such verification and if so, whether the same have been properly dealt with in the books of account;

(c) Whether the title deeds of immovable properties are held in the name of the company. If not, provide the details thereof;

(ii) Whether physical verification of inventory has been conducted at reasonable intervals by the management and whether any material discrepancies were noticed and if so, whether they have been properly dealt with in the books of account;

(iii) Whether the company has granted any loans, secured or unsecured to companies, firms, Limited Liability Partnerships or other parties covered in the register maintained under section 189 of the Companies Act, 2013.

If so, (a) whether the terms and conditions of the grant of such loans are not prejudicial to the company’s interest;

(b)  Whether the schedule of repayment of principal and payment of interest has been stipulated and whether the repayments or receipts are regular;

(c) if the amount is overdue, state the total amount overdue for more than ninety days, and whether reasonable steps have been taken by the company for recovery of the principal and interest;

(iv) In respect of loans, investments, guarantees, and security whether provisions of section 185 and 186 of the Companies Act, 2013 have been complied with. If not, provide the details thereof.

(v) in case, the company has accepted deposits, whether the directives issued by the Reserve Bank of India and the provisions of sections 73 to 76 or any other relevant provisions of the Companies Act, 2013  and the rules framed thereunder, where applicable, have been complied with?  If not, the nature of such contraventions be stated; If an order has been passed by Company Law Board or National Company Law Tribunal or Reserve Bank of India or any court or any other tribunal, whether the same has been complied with or not?

(vi) Whether maintenance of cost records has been specified by the Central Government under sub-section (1) of section 148 of the Companies Act, 2013 and whether such accounts and records have been so made and maintained.

(vii) (a) whether the company is regular in depositing undisputed statutory dues including provident fund, employees’ state insurance, income-tax, sales-tax, service tax, duty of customs, duty of excise, value added tax, cess and any other statutory dues to the appropriate authorities and if not, the extent of the arrears of outstanding statutory dues as on the last day of the financial year concerned for a period of more than six months from the date they became payable, shall be indicated;

(b) where dues of income tax or sales tax or service tax or duty of customs or duty of excise or value added tax have not been deposited on account of any dispute, then the amounts involved and the forum where dispute is pending shall be mentioned. (A mere representation to the concerned Department shall not be treated as a dispute).

(viii) Whether the company has defaulted in repayment of loans or borrowing to a financial institution, bank, Government or dues to debenture holders? If yes, the period and the amount of default to be reported (in case of defaults to banks, financial institutions, and Government, lender wise details to be provided).

(ix) Whether moneys raised by way of initial public offer or further public offer (including debt instruments) and term loans were applied for the purposes for which those are raised. If not, the details together with delays or default and subsequent rectification, if any, as may be applicable, be reported;

(x) whether any fraud by the company or any fraud on the Company by its officers or employees has been noticed or reported during the year; If yes, the nature and the amount involved is to be indicated;

(xi) Whether managerial remuneration has been paid or provided in accordance with the requisite approvals mandated by the provisions of section 197 read with Schedule V to the Companies Act? If not, state the amount involved and steps taken by the company for securing refund of the same;

(xii) whether the Nidhi Company has complied with the Net Owned Funds to Deposits in the ratio of 1: 20 to meet out the liability and whether the Nidhi Company is maintaining ten per cent unencumbered term deposits as specified in the Nidhi Rules, 2014 to meet out the liability;

(xiii) Whether all transactions with the related parties are in compliance with sections 177 and 188 of Companies Act, 2013 where applicable and the details have been disclosed in the Financial Statements etc., as required by the applicable accounting standards;

(xiv) whether the company has made any preferential allotment or private placement of shares or fully or partly convertible debentures during the year under review and if so, as to whether the requirement of section 42 of the Companies Act, 2013 have been complied with and the amount raised have been used for the purposes for which the funds were raised. If not, provide the details in respect of the amount involved and nature of non-compliance;

(xv) Whether the company has entered into any non-cash transactions with directors or persons connected with him and if so, whether the provisions of section 192 of Companies Act, 2013 have been complied with;

(xvi) Whether the company is required to be registered under section 45-IA of the Reserve Bank of India Act, 1934 and if so, whether the registration has been obtained.

.

• It is seen that there is some overlap in the above reporting requirements. The matters on which the auditor is required to report under clauses (a), (b),(c),(e), (f),(g) of the Section 143(3) and most of the clauses of the CARO 2016 are various facets of Internal Financial Controls as defined under  clause (e) of Sub-section 5 of Section 134 viz. “the policies and procedures adopted by the company for ensuring the orderly and efficient conduct of its business, including adherence to company’s policies, the safeguarding of its assets, the prevention and detection of frauds and errors, the accuracy and completeness of the accounting records, and the timely preparation of reliable financial information” on which the auditor is required to report under clause(i) of Subsection 143(3).

• Subsection (9) of Section 143 of the Act requires the auditor to comply with the auditing standards and till such time the Central government prescribes these auditing standards the auditor shall comply with those auditing standards specified by ICAI. The matters to be included in an auditor’s report would be a mixture of an opinion, statement of fact, information and the auditor’s views and comments all based on the audit which as per Subsection (9) read with subsection (10) is required to be  carried out as per the standards of auditing specified by ICAI. The Standards on Auditing not only set out the procedures to be followed by the auditor but also the scope of an audit. SA200: OVERALL OBJECTIVES OF THE INDEPENDENT AUDITOR AND THE CONDUCT OF AN AUDIT IN ACCORDANCE WITH STANDARDS ON AUDITING states the objectives of the audit in paragraph 11 as under:

“Overall Objectives of the Auditor

11. In conducting an audit of financial statements, the overall objectives of the auditor are: (a) To obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, thereby enabling the auditor to express an opinion on whether the financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework; and (b) To report on the financial statements, and communicate as required by the SAs, in accordance with the auditor’s findings.”

This is further explained in the Section “Application and Other Explanatory Material”. Paragraph A1 explains this scope as under:

“Scope of the Audit (Ref: Para. 3)

A1. The auditor’s opinion on the financial statements deals with whether the financial statements are prepared, in all material respects, in accordance with the applicable financial reporting framework. Such an opinion is common to all audits of financial statements. The auditor’s opinion therefore does not assure, for example, the future viability of the entity nor the efficiency or effectiveness with which management has conducted the affairs of the entity. In some cases, however, the applicable laws and regulations may require auditors to provide opinions on other specific matters, such as the effectiveness of internal control, or the consistency of a separate management report with the financial statements. While the SAs include requirements and guidance in relation to such matters to the extent that they are relevant to forming an opinion on the financial statements, the auditor would be required to undertake further work if the auditor had additional responsibilities to provide such opinions.”

It is evident that in respect of additional reporting requirements under the Companies Act, 2013 the auditor may be required to carry out additional procedures if required by the Companies Act, 2013. It is further evident from Subsection 143(2) that the scope of the audit is to report on the truth and fairness of the financial statements under audit. This report is to be issued after taking into consideration the provisions of the Act, requirements of the accounting standards and auditing standards, matters which are to be included in the audit report under the other provisions of the section including the report under the Companies (Auditor’s Report ) Order,2016  prescribed  under subsection (11).

 However the Companies Act, 2013 only requires the auditor to carry out the audit in compliance with the requirements of the auditing standards. It does not require the auditor to carry out additional procedures to report on the matters specified under Sub sections  (3) or (11) of Section 143.It is also clear from Rule 11 that the auditor has to only give “his views and comments” on the matters referred therein and not “findings” based on additional procedures. So the issue is to determine how the auditor would be able to discharge his reporting responsibility in respect of these matters required to be stated in his audit report which will be considered before framing his opinion under Subsection (2) of Section143 of the Act.

• Table 1 analyses each of these requirements with the Scope of the Audit as set out in the SAs and classifies the reporting requirements into following categories ( based on the author’s views) :
  1. Reporting within the Scope of the reporting requirements of SAs
  2. Reporting on matters enquired into or findings from procedures carried out during the course of the audit.
  3. Other matters

Most of the matters classified by me under “Other Matters” in the table are requirements from the Companies (Auditor’s Report) Order 2016 (CARO 2016). ICAI in its publication Statement on the Companies (Auditor’s Report) Order 2003 (CARO 2003) has advised the following approach to the requirements of the Order in the section “General Approach” covering paragraphs 31 to 42. Paragraph 31 and 32 are reproduced below:

“31. In formulating the general approach to the requirements of the order, it is necessary to take a view regarding the objective behind the issuance of the order. The order does not replace an audit by an investigation in respect of the matters specified therein. Several of these matters, in any case, are covered by an auditor in normal course of his audit and the emphasis of the order is not, therefore, on requiring the auditor to carry out an investigation but on requiring him to give specific information on certain aspects of his work.

32. The auditor should, in regard to the requirements of the order, apply the same degree of examination, as he would do in a normal audit. Thus, the degree of examination required should be such as is adequate to enable the auditor to comment on matters specified in the order. In this context, the auditor should also comply with the requirements of the Standards on Auditing issued by the institute.”

The Statement then goes on to give in a detailed manner, the procedures to be followed by the auditor in order to give his report on the matters contained in the order. Some of these procedures, such as the reporting on Fixed Asset records and their verification read like additional procedures to establish the reliability of the asset records. CARO 2003 replaced the Manufacturing and Other Companies (Auditor’s Report) Order, 1988 (MAOCARO 1988) which was a successor to Manufacturing and Other Companies (Auditor’s Report) Order, 1975.  The original statement of ICAI dealt with the requirements of the MAOCARO, 1975, which was updated when it was superseded by     MAOCARO, 1988 later CARO, 2003. When MAOCARO 1975 was issued, auditing standards had not been formulated in India. The first of the auditing standards made their appearance only in early 80s.  Therefore ICAI did not have a framework for reference as to the scope and objective of an audit at the time of issue of the Statement on MAOCARO 1975. The auditor simply carried out additional procedures to issue his report on the matters to be reported upon in that Order. When MAOCARO 1975 was replace by MAOCARO 1988 old points were dropped and new points were added. Same was the case when CARO, 2003 replaced MAOCARO 1988. ICAI has not come out with any new publication relating to CARO, 2015 or CARO, 2016. ICAI  in its GUIDANCE ON REPORTING UNDER THE COMPANIES (AUDITOR’S REPORT) ORDER 2015 has opined that in respect of reporting under CARO 2015, there are no new requirements and  the relevant paragraphs of Statement on CARO 2003 which were to be referred for reporting under CARO 2015 were cross referenced . It is therefore suggested that ICAI publish a new publication on CARO 2016 which should use the auditing standards as the reference point so as to guide the auditor in giving his report on the matters to be reported under that order. Similar procedure should be adopted for other matters required to be reported by the auditor under subsection 143(3) while revising the guidance issued in respect of these matters under the Companies Act, 1956.[1]

• In respect of matters clearly out of the scope of the financial statement audit, such as determining whether a director is disqualified under Section 164(2) from being appointed as a director, ICAI should approach the Central Government and request that the Government to drop such clauses as they are not relevant to the audit and could even divert the auditor from doing his work. Alternatives could be suggested such as the auditor without much additional work could report whether the auditee Company has not filed its financial Statements and Annual Report for 3 years subjecting its director to disqualification under Section 164(2). Even more appropriate would be for the Management to report compliance on these matters which are of interest to the Government and the auditor to report thereupon based on additional procedures as considered necessary as a separate engagement in a separate report. This engagement just as the report on Corporate Governance would be carried out separately after the issue of the audit report on the financial statements ( which for listed companies is to be issued within two months of the close of the financial year) and before the Annual General Meeting where the accounts are laid. It would be then clear that such an engagement is separate from the audit of the financial statements of the company.

• In respect of reporting requirements requiring the auditor to give his observations, views and comments, these should be based on normal audit procedures as required by the auditing standards as no additional procedures are required to be carried out by the auditor under Section 143 to include the matters required to be stated under subsections 143(3) or 143(11) in his report. An expression of views or observations or a plain statement of fact from the normal audit procedures is sufficient. This also applies to the reporting on existence, adequacy and effectiveness of internal financial controls in the company under clause (i) of section 143(3). It is evident from Subsection 143(2) that the contents of the report on the matters required to be included in the auditor’s report under Subsections 143(3) or (11) would be considered before giving his opinion on the financial statements.

II MATTERS TO BE STATED WITH RESPECT TO INTERNAL FINANCIAL CONTROLS

• That the audit of internal financial controls to express an opinion on their existence, adequacy and operating effectiveness is outside the scope of the audit under the auditing standards is very clearly brought out in ICAI’s publication Guidance Note on Audit of Internal Financial Controls Over Financial Reporting ( 2015 ). In the Foreword to the Publication by the President it is made clear (italics added by me) :

“The Companies Act, 2013 has introduced many new reporting requirements for the statutory auditors of companies. One of these requirements is given under the Section 143(3) (i) of the Act requiring the statutory auditor to state in his audit report whether the company has adequate internal financial controls system in place and the operating effectiveness of such controls. The section has cast onerous responsibilities on the statutory auditors because reporting on internal financial controls is not covered under the Standards on Auditing issued by the ICAI and also because of the fact that no framework has been prescribed under the Companies Act, 2013 and the Rules there under for the evaluation of internal financial controls. “Therefore, a need was felt for providing appropriate guidance on this section so that the requirements and expectations of the section can be fulfilled in letter and spirit by the auditors”

The foreword goes on to state that the “Guidance Note is a comprehensive and self contained document” (in relation to audit of Internal Financial Controls).

• The Guidance Note on IFC in the section “Scope of reporting on internal financial controls under clause (i) of Subsection 3 of Section 143 of the Companies Act, 2013” straight away presumes without any discussion  that  the obligation of the auditor under the said section is to  audit of internal financial controls over financial reporting and issue a report thereon. Relevant extracts are reproduced below:

“I. Scope of reporting on internal financial controls under clause (i) of Subsection 3 of Section 143 of the Companies Act, 2013

Clause (i) of Sub-section 3 of Section 143 of the Companies Act, 2013 (“the 2013 Act” or “the Act”)  requires the auditors’ report to state whether the company has adequate internal financial controls system in place and the operating effectiveness of such controls.   The scope for reporting on internal financial controls is significantly larger and wider than the reporting on internal controls under the Companies (Auditor’s Report) Order, 2015 (“CARO”). Under CARO, the reporting on internal controls is limited to the adequacy of controls over purchase of inventory and fixed assets and sale of goods and services. As such, CARO does not require reporting on all controls relating to financial reporting and also does not require reporting on the “adequacy and operating effectiveness” of such controls.

Management’s Responsibility

The 2013 Act has significantly expanded the scope of internal controls to be considered by the management of companies to cover all aspects of the operations of the company. Clause (e) of Sub-section 5 of Section 134 to the Act requires the directors’ responsibility statement to state that the directors, in the case of a listed company, had laid down internal financial controls to be followed by the company and that such internal financial controls are adequate and were operating effectively.  Clause (e) of Sub-section 5 of Section 134 explains the meaning of the term, “internal financial controls” as “the policies and procedures adopted by the company for ensuring the orderly and efficient conduct of its business, including adherence to company’s policies, the safeguarding of its assets, the prevention and detection of frauds and errors, the accuracy and completeness of the accounting records, and the timely preparation of reliable financial information.” Rule 8(5)(viii) of the Companies (Accounts) Rules, 2014 requires the Board of Directors’ report of all companies to state the details in respect of adequacy of internal financial controls with reference to the financial statements. The inclusion of the matters relating to internal financial controls in the directors’ responsibility statement is in addition to the requirement for the directors to state that they have taken proper and sufficient care for the maintenance of adequate accounting records in accordance with the provisions of the 2013 Act, for safeguarding the assets of the company and for preventing and detecting fraud and other irregularities.

Auditors’ Responsibility

The auditor’s objective in an audit of internal financial controls over financial reporting is to express an opinion on the effectiveness of the company’s internal financial controls over financial reporting and the procedures in respect thereof are carried out along with an audit of the financial statements. Because a company’s internal controls cannot be considered effective if one or more material weakness exists, to form a basis for expressing an opinion, the auditor must plan and perform the audit to obtain sufficient appropriate evidence to obtain reasonable assurance about whether material weakness exists as of the date specified in management’s assessment. A material weakness in internal financial controls may exist even when the financial statements are not materially misstated.”

• The Guidance Note does observe that the audit of IFC over financial reporting is an engagement separate from the reporting on financial statements. Paragraph 8 is reproduced below:

“Reporting by the Auditors

Where auditors are required to express an opinion on the effectiveness of an entity’s internal controls over financial reporting, such opinion is in addition to and distinct from the opinion expressed by  the auditor on the financial statements “

The Guidance Note accordingly requires the auditor to issue a separate engagement letter for the audit and a separate audit report on internal financial controls is required to be appended to the main audit report wherein this report is referred in response to clause (i).

• The Guidance Note also restricts the reporting on IFC only to “IFC over Financial Reporting”. The definition of IFC under Clause (e) of Sub-section 5 of Section 134 explains the meaning of the term, “internal financial controls” as “the policies and procedures adopted by the company for ensuring the orderly and efficient conduct of its business, including adherence to company’s policies, the safeguarding of its assets, the prevention and detection of frauds and errors, the accuracy and completeness of the accounting records, and the timely preparation of reliable financial information.” The Guidance Note defines IFC over Financial Reporting as

“A process designed by, or under the supervision of, the company’s principal executive and principal financial officers, or persons performing similar functions, and effected by the company’s board of directors, management, and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal financial control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorisations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorised acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements .”

The restriction in the Guidance Note  of the definition of the auditor’s responsibility to only financial reporting perhaps arises from the belief that clause (i) of Section 143(3) requires the auditor to carry out audit of IFC and not give his observations, views and comments based on his audit. Secondly the Guidance Note has not examined the auditor’s responsibility with reference to clause (h) where he has to report on any qualification, reservation or adverse remark relating to the maintenance of accounts and other matters connected therewith. Clause (h) more than clause (i) appears to require the auditor to report on matters which come to his notice indicating deficiencies in IFC over Financial Reporting. Otherwise also the difference between IFC as per Clause (e) of Sub-section 5 of Section 134 and IFC over financial reporting appears to be very thin to make a distinction. Hence in my opinion to give full effect to clause (h) and clause (i), the auditor has to report on any  qualification, reservation or adverse remark relating to the maintenance of accounts and other matters connected therewith , indicate under that clause whether in his opinion these are  arising out of deficiencies in IFCs.

 It also appears that the Guidance Note has been issued with the intention that something more is provided by the members taking in view the President’s desire expressed in the preface above that “Therefore, a need was felt for providing appropriate guidance on this section so that the requirements and expectations of the section can be fulfilled in letter and spirit by the auditors”. However as it is now made clear by ICAI standards and reiterated in the Guidance Note  that an audit of IFC  is an engagement separate from an audit of financial statements required to be carried out as per the auditing standards referred to in subsection 143(10) and requiring  the auditor to execute a separate letter of engagement as specified in the Guidance Note and give a separate report on the audit of IFC, the audit of IFC is not within the scope of reporting on internal financial controls under clause (i) of Subsection 3 of Section 143 of the Companies Act, 2013. Therefore, in the opinion of the author the Guidance Note should be applied only for carrying out an audit of IFC if same is required to be carried out under a separate engagement.

• Pending review by ICAI of its present stand on reporting  on internal financial controls under clause (i) of Subsection 3 of Section 143 of the Companies Act, 2013, the auditor has two choices:
  1. Carry out two separate engagements, audit of financial statements and audit of IFC as suggested by the Guidance Note.

1. Otherwise based on his audit of the financial statements he restrict himself only to those observations made during the course of such audit of weaknesses observed in IFC and give a negative assurance on  the existence ,adequacy and effectiveness of IFC. The format would be similar to the report given by auditors of banks in respect of the status of the implementation of the Ghosh and Jilani Committee recommendations at the various offices of the banks. In such a case the auditor may need to disclose that he has not carried out an audit of IFC in view of the expectations created by ICAI through its Guidance Note.

1. Some suggestions on the type of reporting are given below:

1. The auditor’s unmodified report in respect of internal financial controls under clause(i) of Section 143(3) could therefore be as under:

“Attention is drawn to the paragraph x  under the section  “Auditor’s Responsibility”  above  that “the auditor considers internal financial controls relevant to the Company’s preparation of the financial statements that give a true and fair view in order to design audit procedures that are appropriate in the circumstances”. Such consideration of internal financial controls during the course of audit of financial statements is not an audit of   internal financial controls with an objective of expressing a view on the adequacy or effectiveness of these controls. The reporting on internal financial controls is not covered under the Standards on Auditing issued by the ICAI and no framework has been prescribed under the Companies Act, 2013 and the Rules there under for the evaluation of internal financial controls. Based on our audit carried out in the  manner as specified in paragraph x above, nothing  has come to our notice during the course of our audit that the company does not have internal financial controls or that they are inadequate or ineffective.“

1. A modified opinion ( say on the non implementation of access controls and user rights in the accounting software, not taking back ups) could be given as under:

“Attention is drawn to the paragraph x under the section  “Auditor’s Responsibility”  above  that “the auditor considers internal financial controls relevant to the Company’s preparation of the financial statements that give a true and fair view in order to design audit procedures that are appropriate in the circumstances”. Such consideration of internal financial controls during the course of audit of financial statements is not an audit of   internal financial controls with an objective of expressing a view on the adequacy or effectiveness of these controls. The reporting on internal financial controls is not covered under the Standards on Auditing issued by the ICAI and no framework has been prescribed under the Companies Act, 2013 and the Rules there under for the evaluation of internal financial controls. Accordingly based on our audit carried out in the manner as specified under the above section the following material weaknesses were observed in the internal financial controls:

• non implementation of access controls and user rights in the accounting software which may lead to unauthorized access and modification to the books of account of the company with risk of fraud and error and consequences thereof
• proper backups of the accounting data are not found to be taken putting the company at risk of losing information and ability to recover and operate in the case of any disaster.

Other than the above, in respect of matters that are material, nothing has come to our notice during the course of our audit that the company does not have internal financial controls or that they are inadequate or ineffective.”

12. The scope and objectives of the audit of financial statements are now fully formalised through the SAs. Accordingly, the author is of the opinion that when the statute enjoins you to carry out the audit as per the SAs,  the answer to a reporting requirement should be found within the SAs  unless the statute requires you to carry out additional procedures beyond the auditing standards. In the instant  case the reporting on IFC is one of twelve  requirements under subsection 143 (3) and there is no occasion to treat the requirement of reporting on IFC any different from the other requirements to the point that one has to obtain a separate engagement letter to state an opinion  under this clause.  If Management desires that the auditor give a report on IFC based on an audit of IFC, then it is advisable that management voluntarily come forward and request the auditor to report against clause (i) of Section 143(3) based on such audit. This is in the opinion of the author would enhance the value of the auditor’s work.

CONCLUSION

The report of a member of ICAI carrying out assurance services in accordance with the standards of ICAI carries a lot of value. Therefore in view of the high reliance on such member’s work there is always a tendency to call for assurance on various matters considered to be important by the legislature or executive. The paper writer is of the view that ICAI when consulted on reporting requirements such as CARO or under Section 143 should examine the same against the requirements of the Standards and then give its recommendations. If ICAI draws the line when a requirement steps beyond the requirements of SAs it will clarify the scope of an audit to stakeholders and interested parties. Today there is tremendous time pressure on auditors to complete their engagements. As already suggested earlier in this paper, other matters of interest could be verified and reported separately after the issue of the audit report on the financial statements. The period of such coverage could also be different and need not necessarily be the financial year.

TABLE I: REQUIREMENTS OF SECTION 143 OF THE COMPANIES ACT, 2013 VIS-A-VIS THE SCOPE OF THE AUDIT AS REQUIRED BY SAs