Internal Financial Controls and the Risk Control Matrix: A Build Guide for Scaling Companies

TL;DR: Internal financial controls (IFC) are the policies and procedures a company uses to run its business in an orderly way, protect its assets, prevent and detect fraud and error, and produce reliable financial information. Under the Companies Act, 2013, every company’s Board’s report must comment on the adequacy of IFC with reference to the financial statements, and the statutory auditor must report on their adequacy and operating effectiveness unless the company is a private company that qualifies for the 2017 exemption. The working document behind all of this is the risk control matrix: a process-by-process map of what can go wrong in the numbers, which control stops it, who runs that control and what evidence proves it ran. Build it before the auditor asks for it, score the gaps, and fix them in three horizons.

Most scaling companies meet internal financial controls for the first time as a line in the auditor’s report. By then the question is no longer whether the controls exist but whether anyone can prove they worked all year.

That gap between having controls and evidencing them is where scaling companies get caught. A founder-run finance team usually has controls. The founder approves large payments, the accountant reconciles the bank, and someone checks the GST return. What it rarely has is a document that ties each control to a specific risk in the financial statements, names an owner, and records evidence that the control operated. That document is the risk control matrix, and it is what an auditor, an investor’s diligence team or an acquirer will ask to see.

Astravise Services builds internal financial controls for companies moving from founder-run finance to institutional finance. This guide covers what the law requires, who is exempt, and how to build a risk control matrix that holds up when someone tests it.

IFC Applicability: Which Companies Must Comply, and Who Is Exempt

Internal financial controls apply to every company in India in some form, but the reporting obligations differ by company type. Four separate provisions do the work, and founders often assume that an exemption from one covers the others. It does not.

The private company exemption. Notification G.S.R. 583(E) of 13 June 2017, issued by the Ministry of Corporate Affairs, says Section 143(3)(i) shall not apply to a private company that is a one person company or a small company, or that has turnover of less than ₹50 crore as per its latest audited financial statement or aggregate borrowings from banks, financial institutions or any body corporate of less than ₹25 crore at any point during the financial year. The exemption is available only to private companies that have not defaulted in filing their financial statements under Section 137 or their annual return under Section 92.

The small company threshold moved in December 2025. The Ministry of Corporate Affairs raised the small company limits through G.S.R. 880(E) of 1 December 2025 to paid-up capital not exceeding ₹10 crore and turnover not exceeding ₹100 crore. Because small companies are one of the exempt categories, more private companies now fall outside auditor reporting on IFC than before. One catch matters for group structures: the proviso to Section 2(85) excludes holding and subsidiary companies from the small company definition, so an Indian subsidiary of a foreign parent, or a startup that has set up its own subsidiary, cannot use that route. It can still qualify through the turnover or borrowings test. The Astravise guide to setting up a GCC in India covers how that subsidiary is structured.

What the exemption does not remove. An exempt private company still has to comment on IFC adequacy in its Board’s report. It also has to keep its books in accounting software with an audit trail that cannot be disabled. The provision to Rule 3(1) of the Companies (Accounts) Rules, 2014 made that mandatory for financial years starting on or after 1 April 2023, and the ICAI Implementation Guide on Reporting on Audit Trail states there is no exemption for small and medium companies. Exemption from auditor reporting is not exemption from controls.

For a company below every threshold, the right starting point is a small set of written finance policies, which the Astravise guide to the five policies every Indian startup should have sets out. The risk control matrix comes next, usually before a fundraise or once turnover approaches ₹50 crore.

What Are Internal Financial Controls Under the Companies Act, 2013?

The Companies Act defines internal financial controls in the Explanation to Section 134(5)(e) as “the policies and procedures adopted by the company for ensuring the orderly and efficient conduct of its business, including adherence to company’s policies, the safeguarding of its assets, the prevention and detection of frauds and errors, the accuracy and completeness of the accounting records, and the timely preparation of reliable financial information.”

That definition covers six outcomes, and it is broader than financial reporting:

1. Orderly and efficient conduct of the business

2. Adherence to the company’s own policies

3. Safeguarding of assets

4. Prevention and detection of fraud and error

5. Accuracy and completeness of accounting records

6. Timely preparation of reliable financial information

The statute does not prescribe a control framework. The ICAI Guidance Note on Audit of Internal Financial Controls Over Financial Reporting, issued by its Auditing and Assurance Standards Board in 2015, is the reference auditors use. Many companies also organise their controls around the COSO Internal Control Integrated Framework, whose 2013 edition is a widely used structure for control design.

The consequences of getting it wrong are now civil. Section 134(8) makes a company in default of Section 134 liable to a penalty of ₹3 lakh, and every officer in default liable to ₹50,000.

IFC vs ICFR: What Is the Difference?

IFC is the wider concept. ICFR, internal control over financial reporting, is the part of IFC that concerns the reliability of the financial statements. The Companies Act makes the distinction in its own wording. Section 134(5)(e) covers internal financial controls in the full sense defined above. Section 143(3)(i) asks the auditor to report on “internal financial controls with reference to financial statements”, which is the ICFR subset. Rule 8(5)(viii) of the Accounts Rules uses the same narrower phrase for the Board’s report.

A practical consequence follows. The risk control matrix the auditor tests is built around financial statement risk. A well-run company extends the same matrix to operational controls, because the Section 134 definition and the board’s oversight cover both.

What Is a Risk Control Matrix, and How Is It Different From a Risk Register?

A risk control matrix (RCM) is a document that lists, process by process, the risks that could cause an error in the financial statements, the controls that address each risk, and the details needed to test those controls: owner, frequency, type and evidence. It is the working map of a company’s ICFR. The auditor tests against it, and management uses it to show the controls are designed and operating.

It is often confused with two other documents:

• A risk register or risk library records enterprise-wide risks, such as regulatory, talent, technology and strategic risks, scored for likelihood and impact and owned at leadership level. The Astravise GCC governance blueprint sets out how to build an entity-wide risk library and heat map for a new capability centre.

• An internal audit plan decides which areas internal audit will review in a period. It uses the RCM as an input but is not the RCM.

The difference is altitude. A risk register asks what could damage the business. A risk control matrix asks what could make this number in the accounts wrong, and what stops it. A company needs both, and they should link: a high-rated financial reporting risk in the register should map to specific rows in the RCM.

How to Build a Risk Control Matrix, Step by Step

A risk control matrix is built process by process, and each row answers the same questions. The columns below are the minimum a matrix needs to stand up to testing.

The build runs in six steps:

1. Scope the processes. Start with the processes that feed the financial statements: record to report, procure to pay, order to cash, payroll, fixed assets, treasury and tax. The Astravise guide to record to report, procure to pay and order to cash defines where each process starts and ends, which is where RCM scoping should start and end too.

2. Walk through each process. Follow one real transaction from start to finish with the people who handle it. Document what actually happens, not what the policy manual says.

3. Write risk statements tied to assertions. Each risk should name what could be wrong in the accounts and which assertion it affects: existence, completeness, accuracy, valuation, rights and obligations, cut-off or presentation.

4. Map the controls. For each risk, record the control that addresses it. If there is none, record the gap. Do not invent a control to fill the row.

5. Add the entity-level and IT general controls. Tone at the top, the delegation of authority, user access management, change management in the ERP, and the audit trail required by Rule 3(1) sit underneath every process control. If user access is weak, an approval control in the ERP proves little.

6. Agree the matrix with the auditor early. The auditor tests what the matrix says. Agreeing scope and key controls before year-end avoids a matrix that is rebuilt during fieldwork.

A matrix for a mid-sized company usually runs to a few hundred rows. The goal is not volume. It is that every material number in the financial statements traces to at least one key control.

Scoring the Matrix and Building the Heat Map

Scoring turns a list of controls into a list of priorities. Each risk gets two ratings on the same scale, typically likelihood and impact from 1 to 5:

• Inherent risk is the rating before any control. It shows where the business is most exposed.

• Residual risk is the rating after the control, based on how well it is designed and whether testing found it operating.

Plot residual risk on a grid of likelihood against impact and the heat map shows where the control environment is thin. The areas that matter are high-impact risks with weak or untested controls: revenue recognition at a period end, manual journal entries posted by the same person who approves them, vendor bank detail changes, and related party transactions.

A financial reporting heat map differs from an enterprise risk heat map in one way that matters. Its impact scale should be anchored to materiality in the financial statements, not to reputational or strategic damage. A control gap in petty cash may score high on likelihood and still sit in the low zone, because it cannot move the accounts materially. A gap in revenue cut-off can sit in the red zone even if it has never caused a problem, because one quarter-end error would.

What an IFC Audit Actually Tests

An IFC audit tests two things about each key control: whether it is designed to address the risk, and whether it operated effectively through the period.

• Design effectiveness is tested through a walkthrough. The auditor follows a transaction through the process and confirms the control exists and, if performed as described, would prevent or detect the error.

• Operating effectiveness is tested by sampling. The auditor selects instances of the control across the year and checks the evidence that each one was performed, by the right person, on time. Sample sizes scale with how often the control runs, so a daily control is tested more times than a quarterly one.

Three findings recur in scaling companies. Controls are performed but not evidenced, such as a reconciliation that was reviewed with no sign-off or date. Controls rely on one person with no segregation of duties. And IT general controls are weak enough that the auditor cannot rely on automated controls at all. The audit trail requirement adds a fourth: under Rule 11(g) of the Companies (Audit and Auditors) Rules, 2014, the auditor reports separately on whether the audit trail operated throughout the year and was not tampered with.

Evidence discipline is the common thread. The same standard of a named owner, an approval and a traceable record that the Astravise BRSR reporting guide applies to sustainability data applies to every key financial control.

A Phased Remediation Plan: Short, Medium and Long-Term Control Fixes

Testing will find gaps. The mistake is trying to fix them all at once, which produces a burst of new controls that nobody operates by the second quarter. Remediation works better across three horizons, prioritised by the heat map.

Each fix should be recorded against the RCM row it closes, with an owner and a target date, and reported to the board or audit committee until it is closed. Month-end close controls are often the fastest win, which the Astravise analysis of faster month-end close through shared services explores in more depth.

Who Should Own IFC in a Scaling Company?

In most scaling companies, IFC has no owner until the auditor’s report creates one. Ownership should sit with the finance leader, with the board or audit committee overseeing it and process owners running the individual controls.

That raises an uncomfortable question for companies without a senior finance leader. An unlisted private company is not required by Section 203 to appoint a CFO, which the Astravise guide to strategic CFO, virtual CFO and bookkeeping explains. So the decision to invest in controls is a business decision, and it tends to be deferred until a fundraise or an audit qualification forces it. Investors now test controls during diligence, and compliance gaps are among the questions that stall a funding round.

Companies running finance through a shared services model have an advantage here. Standardised processes are easier to control and test, and the RCM can be built once for the centre rather than separately for each location. Astravise Agile Shared Services builds controls into those processes from the start.

How Astravise Services Builds Internal Financial Controls

Governance is not a side hustle, and internal financial controls are where that principle becomes testable. Astravise Services builds IFC for scaling companies in four stages:

1. Applicability and scoping. Confirm which obligations apply, including the exemption and small company tests, and which processes are material.

2. RCM build. Walk through each in-scope process, document risks, controls and evidence, and add the entity-level and IT general controls underneath.

3. Test and score. Test design and operating effectiveness, rate residual risk, and produce the heat map.

4. Remediate and hand over. Sequence fixes across the three horizons, report progress to the board, and leave the finance team able to run and evidence the controls without outside help.

The aim is a control environment that survives an audit, a diligence exercise and the company’s own growth, built into the way finance works rather than assembled at year-end. Companies preparing for their first IFC audit, a fundraise or a public listing can start with a diagnostic through Astravise Strategic CFO advisory.

^{[1][2][3][4][5][6][7][8][9][10][11]}