Is IFC reporting applicable to your private company?

Short answer: every company must maintain internal financial controls. The separate requirement for the auditor to report on them under Section 143(3)(i) does not apply to a private company that is an OPC or a small company, or has turnover under ₹50 crore, or has borrowings under ₹25 crore — provided it is not in default on its ROC filings.

That last clause is where otherwise-exempt companies get caught. Here is the whole test, in order.

First, separate the two obligations

These are constantly conflated, and almost every argument about "does IFC apply to us" dissolves once they are separated.

So when someone says "IFC is not applicable to us," what is usually true is that the auditor's reporting requirement is not applicable. The controls themselves still are.

The decision tree

Work through it in this order.

Step 1 — Are you a private company?

If the company is listed or public, stop: s.143(3)(i) reporting applies, and for a listed company the directors also carry s.134(5)(e).

Step 2 — Are you an OPC or a small company?

One person company — exempt.

Small company under s.2(85), as amended by GSR 700(E) of 15 September 2022:

Note the contrast with what comes later: both conditions must be satisfied here. Cross either one and you are not a small company.

And the exclusion that catches people: s.2(85) expressly excludes a holding company and a subsidiary company from the definition, whatever their size. A company with ₹50 lakh of capital and ₹5 crore of turnover that happens to be a wholly-owned subsidiary is not a small company. This routinely surprises Indian subsidiaries of foreign parents — a structure common in Bengaluru — which look small on every metric but cannot use this limb at all.

Being excluded here is not the end of the analysis. Move to Step 3.

Step 3 — Do you meet either financial limb?

The reporting requirement does not apply to a private company which:

• has turnover less than ₹50 crore as per the latest audited financial statement; or
• has aggregate borrowings less than ₹25 crore from banks, financial institutions or any body corporate, at any point during the financial year.

These are alternatives. Satisfying either is enough. A company with ₹120 crore of turnover and ₹10 crore of borrowings is still within the exemption, on the borrowings limb.

This is the single most misread part of the notification. It is regularly presented as a cumulative test — turnover under ₹50 crore and borrowings under ₹25 crore — which would shrink the exemption dramatically. The notification uses or.

Two points of detail that decide real cases:

• Turnover is taken from the latest audited financial statement, not from management accounts or the current year's run rate.
• Borrowings are tested at any point during the financial year, not at the year-end. A company that ran a ₹30 crore facility for two months and repaid it before March fails this limb even though its closing balance sheet shows less. Peak borrowing is what matters, and it is worth checking against the year's sanction and utilisation, not just the closing figure.

Step 4 — The proviso: are your ROC filings clean?

Everything above is subject to a condition that is easy to miss:

The exemption is available only to a private company which has not committed a default in filing its financial statements under Section 137 or its annual return under Section 92 with the Registrar.

So a company sitting comfortably inside every threshold can still lose the exemption — because an AOC-4 or MGT-7 was filed late.

This is a real and under-appreciated link between two things that feel unrelated. A missed ROC filing is normally thought about in terms of the ₹100-per-day additional fee. The second-order consequence is that it can pull the company into IFC reporting, with the audit cost and management effort that follows. When weighing whether a late filing "matters", this belongs in the calculation. The first-year ROC deadlines piece covers what the filing obligations themselves look like.

If you are exempt

You still need controls. What the exemption removes is a paragraph in the auditor's report — not the obligation, not the Board's report disclosure under Rule 8(5)(viii), and not the directors' answerability.

In practice, exempt companies that keep controls documented are in a materially better position when they cross a threshold, take on borrowing, or start diligence for a funding round — because the documentation exists rather than having to be reconstructed under time pressure. Growing companies cross ₹50 crore of turnover with very little warning.

If you are not exempt

Then your auditor must report on whether adequate internal financial controls with reference to financial statements exist, and on whether they operated effectively through the year. That phrase matters: since the Companies (Amendment) Act 2017, the auditor's reporting is scoped to financial reporting controls, which is narrower than the broad definition of internal financial controls in the Explanation to s.134(5)(e).

What follows is documentation of significant processes, a risk and control matrix, walkthroughs, and sample-based testing of operating effectiveness across the period — not just at year-end. Where the accounting runs on a system, IT general controls around that system come into scope too, because reports the system produces cannot be relied on if access and change controls around it are weak.

The scope and what it involves is set out on the internal financial controls and IS audit page.

The three misreadings worth avoiding

1. "We're small, so IFC doesn't apply." The controls apply. The auditor's reporting may not.
2. "We need to be under both ₹50 crore and ₹25 crore." No — either limb suffices.
3. "We're a small company because we're tiny." Not if you are a holding or subsidiary company. Size is irrelevant to that exclusion.

This note sets out the general position under the Companies Act 2013 and the exemption notification of 13 June 2017. Applicability turns on your specific figures, shareholding and filing history, and should be confirmed against them before it is relied on.