Your auditor has flagged a
material weakness
in Internal Financial
Controls.
Now what?
Internal Financial Controls (IFC) and Internal Controls over Financial Reporting (ICFR) are mandatory requirements under the Companies Act 2013 for applicable companies. A material weakness is not just an audit observation — it is a potential D&O liability, a lender concern, and a market signal that something is wrong.
The board signed the IFC declaration. Nobody had actually tested the controls.
Directors sign off on the adequacy of Internal Financial Controls every year. Most have never seen the underlying testing documentation. When a material weakness surfaces — in audit, in due diligence, or in a regulatory review — the personal liability lands with the board.
Listed Companies
Auditor reports material weakness in IFC over revenue recognition — stock price falls 12% on announcement. Institutional investors demand board explanation.
PE-Backed Companies
Pre-exit due diligence reveals IFC framework exists on paper only — no testing, no evidence. Buyer uses this to reprice by 15% or demand indemnity.
Banks & NBFCs
RBI inspection identifies IFC gaps in credit appraisal process — mandatory remediation programme imposed. Six-month management distraction.
Subsidiaries of MNCs
Parent company's SOX audit requires ICFR evidence from Indian subsidiary — subsidiary has no documented or tested control framework. Group audit qualified.
Companies Approaching IPO
SEBI requires IFC compliance declaration in DRHP — company discovers 3 months before filing that their IFC framework has never been independently tested.
IFC Scoping & Entity-Level Controls
Identifying in-scope business processes, significant accounts, and entity-level controls — building the foundation of a defensible IFC framework.
Process-Level Control Documentation
Documenting process flows, risk points, and control activities for all in-scope processes — to the standard required by auditors and regulators.
Control Testing & Evidence Collection
Independent testing of all key controls — with evidence documented to support the directors' IFC declaration.
Material Weakness Remediation
Where material weaknesses or significant deficiencies exist — designing remediated controls and supporting management through the remediation programme.
Listed Companies with IFC Obligations
Companies required to include auditor commentary on IFC in their annual report — needing a tested, documented framework behind the declaration.
Companies with Material Weakness Flagged
Organisations where the statutory auditor has identified a material weakness — needing rapid remediation and evidence before the next audit cycle.
Subsidiaries in SOX / ICFR Groups
Indian subsidiaries required to contribute to a group-level ICFR or SOX compliance programme — needing local documentation and testing support.
Companies Approaching IPO or PE Exit
Businesses where IFC adequacy will be scrutinised in the listing process or exit due diligence — needing a clean, tested framework in place beforehand.
Northrop has supported IFC documentation and testing for listed companies, pre-IPO businesses, MNC subsidiaries, and regulated entities — with all work performed to the standard required for auditor reliance.
Signing an IFC declaration without tested evidence is not compliance. It is personal liability.
Every engagement starts with a confidential conversation. No obligation — just clarity on your specific exposure and how Northrop can help.