ICFR & Controls
Internal financial controls in India carry statutory weight: directors report on their adequacy, and auditors opine on their operating effectiveness. For a foreign subsidiary, this creates an obligation that is easy to over-engineer and dangerous to ignore — a controls framework imported wholesale from the parent's SOX program suffocates a fifty-person entity, while the absence of any documented framework produces audit observations and directors signing statements they cannot substantiate.
We build ICFR proportionate to the entity: risk-control matrices covering the processes that actually matter — revenue, procurement, payroll, treasury, financial close — with controls designed for the entity's real size and systems; process narratives that document how things work rather than how a template imagines them; testing cycles that evidence operating effectiveness for the auditor's opinion; and remediation tracking that closes gaps before they become repeat observations. Done this way, ICFR stops being a compliance tax and becomes what it was meant to be: management's own assurance that the numbers are right.
What this covers
- Risk-control matrices scoped to the entity's material processes and actual systems.
- Process narratives and control documentation written from observation, not template.
- Design and operating-effectiveness testing on an annual cycle.
- Gap remediation with tracked closure.
- Alignment with parent frameworks (SOX, group control standards) at proportionate depth.
Who needs this
Indian companies within ICFR audit scope; foreign parents extending group control standards to India sensibly; and boards that want the directors' responsibility statement backed by substance.
How we deliver
- Risk-control matrices scoped to your material processes and real systems.
- Narratives documented from observation, then tested for design and operation.
- Gaps remediated and tracked to closure before audit opinions depend on them.
Why A2 Consultants
We build controls proportionate to the entity rather than imported from a template — rigorous enough for the auditor's opinion and the directors' statement, light enough that a fifty-person company can actually operate them.
Engagement & what to expect
First-year engagements run eight to twelve weeks: processes documented from observation, risk-control matrices built to the entity's material streams, design gaps remediated, and operating-effectiveness testing completed ahead of the audit's reliance decision. Subsequent years run as maintenance: annual testing cycles, documentation updates as processes change, and remediation tracking to closure. Where a parent's SOX or group framework applies, we align scope and evidence so one exercise serves both regimes. The sustained deliverable is an unqualified controls opinion and a directors' statement signed without private hesitation.
Controls exist to let you trust your own numbers — proportionate, documented, tested, and then quietly reliable