Executive Summary
Internal financial controls became a reporting matter for a Kerala manufacturer because it grew, not because anything went wrong. Turnover crossed the level at which the exemption available to smaller private companies ceases to apply, and the auditor’s report for the coming year would have to address controls.
The company had controls. It had operated for two decades without a significant loss, and the managing director reviewed a great deal personally. What it did not have was documentation, a risk and control matrix, or evidence that reviews had been performed. A control that leaves no trace cannot be tested.
JPKAD & Associates was engaged to prepare the company for the reporting year, working ahead of the statutory audit rather than as part of it. The audit itself was conducted by the company’s own auditor. The central design problem was segregation of duties, which cannot be solved at eleven people in the finance and stores functions. It was answered with compensating controls and with evidence of review.
- Crossing a threshold can bring a company into reporting it was previously outside, without anything else changing.
- Segregation of duties cannot be achieved at small headcount, so compensating controls carry the weight.
- A control that is performed but not evidenced cannot be tested, which is the most common gap of all.
- Design effectiveness and operating effectiveness are different questions and both are asked.
- Information technology general controls decide whether every other control can be relied upon.
Crossing a threshold into new reporting requirements? Explore our assurance work.
Client Overview
The client manufactures fabricated metal products at a plant in Kerala, supplying industrial and construction customers across South India. It is a private limited company owned by a single family and run by two of its members.
The finance and stores functions together employ eleven people, covering accounts, purchase, stores, dispatch and payroll. Accounting runs on a mid market enterprise system that has been in place for years and is well understood by the people using it, forming the backbone of the company’s accounting and financial reporting.
The managing director reviews payments personally, knows the vendor base and notices anomalies quickly. That personal oversight is genuine and it is why nothing significant has gone wrong. It is also undocumented. When the reporting requirement arrives, an auditor cannot rely on a review nobody recorded, however diligently it was performed.
Business Challenges
The company was not weak on control. It was weak on the evidence of control, which is a different problem and the one that reporting actually tests. Four issues had to be worked through before the reporting year began.
Why did the reporting requirement suddenly apply?
Because the exemption from reporting on internal financial controls available to certain smaller private companies operates by reference to turnover and borrowings. The company crossed the relevant level during a growth year, so the exemption no longer applied for the year that followed. Nothing about the business changed on the day it crossed. The obligation attached because of a number in the accounts.
The directors were also unaware that the board report carries its own requirement to comment on the adequacy of internal financial controls, a company law matter that applies more widely.
Why is segregation of duties impossible at this size?
Because the textbook design requires that the person who creates a vendor, the person who records a purchase, the person who prepares a payment and the person who releases it are four different people. In a finance function of this size, one person was performing three of those four steps, and any redistribution simply moved the concentration elsewhere.
Hiring to solve it would have added cost the company could not justify against a risk it had never actually suffered. This is the central design question in every owner managed business, and pretending otherwise produces a control matrix that describes a company that does not exist.
What does it mean that controls were not evidenced?
The managing director reviewed the payment list every week and questioned anything unfamiliar. That review is a genuine control and it left no trace at all. Bank reconciliations were prepared monthly and were accurate, and nothing recorded that anyone had reviewed them or when. Purchase orders were approved verbally in a small office where everyone sits within speaking distance of each other.
An auditor cannot test what leaves no record. The remedy is rarely a new control, it is making an existing one visible.
Why did system access turn out to matter most?
Because several users held administrative rights in the accounting system, including two who had no operational need for them. One account belonged to a former employee and had never been disabled, which nobody had noticed because it was not being used.
Where access is not controlled, every automated control and every system generated report above it becomes difficult to rely upon. It is also the cheapest layer to fix. Access reviews cost administrative time rather than headcount, and they change the reliability of everything else.
Have controls that work but leave no evidence? Read more about our audit and assurance services.
Business Objectives
The directors wanted to be ready before the year began rather than to discover problems during the audit, and they wanted a control design that reflected how the company actually operates.
What did the company need to achieve?
A documented control framework covering the significant cycles, prepared before the reporting year rather than during it. Controls that people would actually perform, since a matrix describing an idealised company fails on its first test of operating effectiveness. Evidence attaching to each control, because the gap here was visibility rather than absence. And a clear position on segregation of duties, so that the compensating design was deliberate and documented rather than an omission.
They also wanted the framework to survive the next few years without a rebuild, since the company expects to keep growing past the thresholds rather than back below them.
Why was working ahead of the audit important?
Because remediation during a reporting year is expensive and it leaves part of the year untested by any improved control. Controls need to operate throughout the period to be tested for operating effectiveness, so a control introduced in the last quarter helps very little.
Preparing ahead also allowed the design to be discussed with the auditor before it was implemented rather than defended afterwards. The directors were told plainly that this preparation does not guarantee any particular audit conclusion, which remains a matter for the auditor’s judgement.
What defined success for this engagement?
A risk and control matrix covering each significant cycle, with the control owner, frequency and evidence stated against every control. Compensating controls documented where segregation of duties could not be achieved, with the reasoning recorded. System access cleaned up and a periodic access review established, since that layer underpins everything above it. And the finance team performing the controls as designed for a full quarter before the reporting year began.
Success also meant the finance head owning the documentation afterwards, with a scheduled annual refresh rather than a file that ages quietly.
Want to be ready before the year starts rather than during it? Explore our approach through our contact page.
Solution Strategy
Design followed the business rather than a template. Every cycle was walked through as it actually runs, and the matrix was written from what was observed rather than from what should ideally happen. Compensating controls were treated as the primary design answer rather than as a concession, because at this size they are the only honest answer.
How were the internal financial controls cycles identified and documented?
By working from the financial statements backwards, identifying which line items are material and which processes produce them. That produced five cycles for detailed work, being procure to pay, order to cash, inventory and costing, payroll, and the financial close.
Each was documented as a narrative and a flow, prepared by walking the process with the people who perform it rather than by interviewing a manager. Walking it surfaced two steps that differed from what management believed happened, which is ordinary and is exactly why walkthroughs are done.
How were compensating controls designed around segregation of duties?
By accepting the concentration and then building detective controls around it, rather than pretending the concentration could be removed. Vendor master changes now generate a report reviewed by a second person, with the review recorded, so a new vendor cannot be created and paid unnoticed.
Payments above a threshold require release by a second authorised person in the banking system, which is a genuine separation at the point that matters most. The managing director’s weekly payment review continues, and it now leaves a record, which converts a real control into a testable one.
How was the evidence problem solved?
By deciding, for each control, what artefact it should leave behind, and then making that artefact a natural product of performing the control. Reconciliations are signed and dated by preparer and reviewer, and the reviewer records the date of review rather than only initialling.
Approvals moved into the system where the system supports it, since a system approval is evidenced automatically and needs no discipline to record. Where a control genuinely happens in conversation, a short standing note is completed. The aim was the least additional effort that produces a record.
How were technology general controls addressed?
By reviewing every user account, removing those no longer required and reducing administrative rights to the two people who need them. A joiner and leaver routine now links human resources to system access, so an account is disabled on the last working day rather than eventually.
A quarterly access review is performed and recorded, listing users, roles and any changes since the previous review. Change management and backup arrangements were documented, since reliance on system generated reports depends on both.
How was the framework tested before the year began?
Through a dry run across one quarter, testing design first and then whether each control actually operated as described. Design testing asks whether the control would address the risk if performed. Operating testing asks whether it was performed, consistently, on a sample.
Three controls failed the dry run, all for the same reason, which was that the evidence step had been designed as an extra task rather than a by product. Those three were redesigned so that performing the control produces the record automatically, and they passed on retest.
Need a control design that matches your actual headcount? Read more about our management consultancy work.
Frameworks and Documentation Used
Nothing bespoke was invented. Established frameworks and the professional guidance already applicable to this reporting were used, because a company should not have to defend a novel approach as well as its controls.
Which frameworks informed the design?
The internationally recognised internal control framework provided the structure, covering the control environment, risk assessment, control activities, information and communication, and monitoring. The professional guidance issued for audits of internal financial controls over financial reporting informed what the auditor would be looking for.
The statutory requirements themselves set the boundary, being the auditor’s reporting requirement and the separate board report requirement. Using recognised references matters, because a framework the auditor already knows removes an argument that has nothing to do with the company’s controls.
What does the risk and control matrix contain?
For each cycle, the risks that could cause a material misstatement, expressed in terms of what could go wrong rather than as general categories. Against each risk, the control that addresses it, whether it is preventive or detective, and whether it is manual or automated.
The control owner by role rather than by name, the frequency, and the evidence the control produces. A cross reference to the financial statement assertion the control supports, which is what connects the matrix to the audit rather than leaving it as a process document.
How is the documentation maintained?
As a single controlled file with a version history, owned by the finance head rather than distributed across personal folders. Process narratives and flows are updated when a process changes, and a change to a process triggers a review of the related controls.
The quarterly access review, the vendor master review and the reconciliation reviews all file their evidence in defined locations. An annual refresh of the matrix is scheduled ahead of the year end, so it does not drift away from how the business actually runs.
Implementation Process
The engagement ran across roughly fourteen weeks and finished a quarter before the reporting year began, which was the point of starting when it did. Walking the processes with the people who perform them took the first three weeks and shaped everything after.
How were the walkthroughs conducted?
By following a transaction end to end, from purchase requisition to payment and from customer order to receipt, with the person who performs each step. Documents were examined as they exist rather than as they are described, which is how two undocumented steps were found.
People were asked what they do when something is unusual, since exception handling is where control weaknesses concentrate. Nothing was recorded as a deficiency during the walkthrough. Observation came first and evaluation followed, which keeps people candid.
How was the segregation position agreed with the directors?
By setting out the concentration plainly, showing which incompatible steps sat with one person, and pricing the alternative of additional headcount. The directors chose compensating controls, which was the reasonable decision, and the reasoning was documented rather than left implicit.
Documenting the reasoning matters, because a compensating design that looks like an oversight is treated differently from one that was chosen. A review point was set at the next significant growth step, since the same concentration becomes less acceptable as volume rises.
How was the finance team brought along?
By explaining that the objective was evidence rather than distrust, which is the fear that makes control work difficult in a small owner managed office. Controls were designed with the people performing them, and two of the evidence steps were changed on their suggestion to fit how work actually flows.
Training was practical and short, covering what each person now records and where it is filed. The dry run was framed as a test of the design rather than of the people, and the three failures were treated as design problems, which they were.
How was the auditor involved?
The framework and the matrix were shared with the company’s auditor before implementation, so that any concern could be raised while it was still cheap to address. The auditor’s questions led to two additions, both in the financial close cycle, which is commonly the least documented area in an owner managed business.
No assurance was sought or given on the audit conclusion, which remains a matter for the auditor’s own judgement at the appropriate time. Keeping that boundary clear protected both roles, and it is why the preparation work was completed well before the audit period began.
Want the design agreed before the reporting year starts? Explore how we can help through our contact page.
Business Results
Results are described here in direction of change rather than in figures. Control conclusions depend on the facts and on the judgement of the auditor, and no outcome of an audit is implied or predicted here. What follows is what the company reported after the preparation work concluded.
What changed about documentation?
Five significant cycles are documented as narratives and flows that match how the work is actually performed. A risk and control matrix exists for each, stating the risk, the control, its owner by role, its frequency and the evidence it produces.
Compensating controls are recorded with the reasoning for them, so the design reads as a decision rather than as a gap. The whole file sits under version control with the finance head as owner, rather than across personal folders.
What changed about how controls operate?
Reviews now leave a record. The managing director’s weekly payment review, which was always performed, is now visible. Vendor master changes generate a report that a second person reviews, which addresses the concentration at the point it matters.
Payments above a threshold require a second release in the banking system, which is a genuine separation rather than a documented intention. Reconciliations carry preparer and reviewer sign off with dates, replacing initials that could not evidence when a review happened.
What changed in the technology layer?
Administrative rights sit with two people who need them, rather than with several who did not. The former employee account that had never been disabled was removed, along with two others that were no longer required.
A joiner and leaver routine links human resources to system access, so removal happens on the last working day. A quarterly access review is performed and recorded, which is the control that keeps the rest of the layer from drifting back. Change management and backup arrangements were documented as well, since reliance on system generated reports depends on both being in order.
What changed for the directors and the finance team?
The directors understand what the reporting requirement asks and why documentation matters as much as the control itself. They also know the exemption position can change again with growth, and that the board report requirement applies more widely.
The finance team performed the controls as designed for a full quarter before the reporting year began, which was the objective. Two people suggested changes to evidence steps during design, which is the clearest sign that the framework fits the office rather than a template.
Want reviews that are performed and visible? Explore our advisory work through our contact page.
Lessons Learned
The company had better control than its documentation suggested and weaker technology control than anyone assumed. Both findings are ordinary in an owner managed business.
What surprised the directors most?
That the managing director’s personal review, which everyone regarded as the strongest control in the business, could not be tested because it left no trace. That an account belonging to an employee who left years earlier had remained active, unnoticed because nobody was using it.
The obligation had attached because of a number in the accounts rather than because of anything the company had done. That the board report carries its own requirement on internal financial controls, which applies whether or not the auditor reporting exemption is available.
What worked better than expected?
Walking the processes with the people who perform them. It found two steps that differed from what management believed happened. Designing evidence as a by product of the control rather than as an additional task — the three dry run failures all came from getting that wrong.
Sharing the framework with the auditor before implementation, which produced two useful additions while changes were still inexpensive. Framing the dry run as a test of design rather than of people, which kept the finance team engaged rather than defensive.
What would be done differently next time?
System access would be reviewed in the first week rather than the fifth, since it is cheap to fix and it underpins everything above it. The financial close cycle would be documented first rather than last, since it is consistently the least documented and it drew the auditor’s questions.
The dry run would run across two quarters rather than one, to give a fuller view of controls that operate monthly. The segregation reasoning would be put to the directors at the very start, since it is the decision every other design choice depends on.
What should other Kerala manufacturers check?
Look at turnover and borrowings against the exemption thresholds, because growth can bring reporting requirements without any warning. Ask what evidence each important control leaves behind. Where the honest answer is none, that control cannot be tested.
Review the user list in the accounting system and identify who holds administrative rights and whether any account belongs to a former employee. Establish whether the board report has ever commented on internal financial controls, since that requirement is frequently overlooked. Finally, ask who owns the control documentation, because a framework without an owner drifts away from the business within two years.
Frequently Asked Questions
1. What are internal financial controls over financial reporting?
They are the policies and procedures that give reasonable assurance about the reliability of financial reporting and the preparation of financial statements. They operate at three levels, being entity level controls that set the environment, process level controls within each significant cycle, and information technology general controls that determine whether reliance can be placed on systems and reports.
2. Which companies have to report on internal financial controls?
The auditor’s reporting requirement under the Companies Act applies subject to an exemption available to certain smaller private companies by reference to turnover and borrowings. Growth past those levels brings the requirement into effect without anything else changing. Separately, the board report of a private company is required to comment on the adequacy of internal financial controls, and that applies more widely.
3. What is the difference between design and operating effectiveness?
Design effectiveness asks whether a control, if performed as described, would address the risk it is intended to address. Operating effectiveness asks whether it was actually performed, consistently, throughout the period. Both questions are asked. A well designed control that operated for only the final quarter provides limited assurance for the year as a whole.
4. How do small companies handle segregation of duties?
They usually cannot achieve it, and the honest answer is to accept the concentration and build compensating controls around it. Reports on changes to sensitive master data reviewed by a second person, dual release of payments above a threshold in the banking system, and recorded management review are common. The reasoning for the compensating design should be documented rather than left implicit.
5. Why does evidence matter as much as the control itself?
Because a control that leaves no trace cannot be tested. Many owner managed businesses have genuinely strong oversight that is entirely undocumented, such as a proprietor reviewing every payment personally. The remedy is rarely a new control. It is deciding what artefact the existing control should leave and making that artefact a by product of performing it.
6. What is a risk and control matrix?
A document that sets out, for each cycle, the risks that could cause a material misstatement, the control addressing each risk, whether the control is preventive or detective and manual or automated, who owns it, how often it operates, what evidence it produces, and which financial statement assertion it supports. That last cross reference is what connects it to the audit.
7. Why do technology general controls matter so much?
Because they sit underneath everything else. If user access is not controlled, if privileged rights are widely held, or if accounts of former employees remain active, then reliance on any automated control or system generated report above that layer becomes difficult. It is also the cheapest layer to fix, since access reviews cost administrative time rather than headcount.
8. When should preparation begin?
Before the reporting year starts, ideally by a quarter. Controls need to operate throughout the period to be tested for operating effectiveness, so a control introduced late in the year provides limited assurance. Preparing early also allows the design to be discussed with the auditor while changes are still inexpensive rather than defended during the audit.
9. Does preparation guarantee a clean audit conclusion?
No, and any adviser suggesting otherwise should be treated with caution. The audit conclusion on internal financial controls is a matter for the auditor’s own judgement based on their testing. Preparation improves the documentation, the design and the evidence available. It does not substitute for the auditor’s work or predict its outcome.
10. How long does readiness work take?
This engagement ran about fourteen weeks and finished a quarter before the reporting year began. Walking the processes took the first three weeks and shaped everything afterwards. The duration depends far more on how many cycles are significant and how much documentation already exists than on the size of the business.
Conclusion
Internal financial controls became a reporting matter for this Kerala manufacturer because turnover crossed a threshold, not because anything had gone wrong. Two decades of trading without a significant loss said something real about how the company was run, and none of it could be tested, because the managing director’s weekly payment review left no trace and reconciliations carried initials rather than dates. The problem was evidence, not control.
The exception was the technology layer, where several people held administrative rights they did not need and an account belonging to an employee who had left years earlier was still active. That layer sits underneath everything else and it was the cheapest thing to fix.
On segregation of duties there was no clever answer, because eleven people cannot be split four ways. The concentration was accepted, compensating controls were built around it, and the reasoning was written down so that the design reads as a decision rather than as an omission. The preparation finished a quarter before the reporting year began, so controls could operate for the full period.
If your company is approaching those thresholds, the useful question is not whether you have controls. It is what evidence each one leaves behind. JPKAD & Associates supports companies preparing for internal financial controls reporting alongside their statutory auditor, and you can read more through the contact page.
See also our case studies on governance for a Thrissur startup and risk advisory for a logistics company.
This case study is published for general information only. Client identity and commercially sensitive details have been withheld. Outcomes are described qualitatively, without figures, because control conclusions depend on the facts and on the judgement of the auditor. The statutory audit was conducted by the company’s own auditor. Nothing here is audit or legal advice on any specific matter.