The numbers reconciled, the statutory audit was signed without qualification and the accounts were properly presented. Then an internal audit review found that one person controlled vendor onboarding, payment uploads and the bank reconciliation; that access rights had not been reviewed in two years; and that reconciliations were prepared every month but nobody examined them. There was no fraud, no accounting error and no regulatory notice. The control environment was simply fragile. This article explains why accurate financial statements and strong internal controls are different things, where hidden weaknesses usually sit, and how to test and fix them.
Accurate financial statements show that recorded transactions were correctly reported for a past period. They do not show whether controls will prevent errors, fraud or unauthorised transactions in the future. A company can have clean accounts while relying on one key person, unreviewed reconciliations, stale access rights and retrospective approvals. Internal audit tests these controls directly, because financial reporting shows what happened, while controls determine what could happen next.
Why accurate accounts do not mean strong controls
A statutory audit opinion says whether the financial statements give a true and fair view. To reach that opinion, auditors can rely on substantive testing of balances and transactions, and may do so even where controls are weak. Correct numbers can therefore be produced by a weak process, often through heavy effort at year end by a few capable people.
Internal controls answer a different question: can the organisation rely on its systems, processes and people to produce correct numbers, protect assets and prevent unauthorised transactions consistently, including when key people are absent and when someone is tempted to misuse their access?
Under the Companies Act, 2013, internal financial controls cover the orderly and efficient conduct of business, safeguarding of assets, prevention and detection of frauds and errors, accuracy and completeness of records, and timely preparation of reliable financial information. The statutory auditor reports on internal financial controls over financial reporting under section 143(3)(i), but private companies with turnover below ₹50 crore and borrowings below ₹25 crore are exempt from that reporting. For many growing companies, nobody independent is looking at controls unless internal audit does.
Where hidden control weaknesses usually sit
None of these produce an error in the accounts by themselves. Each one increases the chance that a future error, fraud or unauthorised transaction will go undetected.
What weak controls expose a business to
When governance is weak, the organisation becomes vulnerable to:
- Fraud and misappropriation, because concentrated access and unreviewed reconciliations remove the chance of detection.
- Operational disruption when the key person leaves, falls ill or is unavailable at month end.
- Regulatory non-compliance, as filings and statutory payments depend on one person's calendar.
- Unauthorised transactions through access that should have been removed.
- Poor decisions based on information that has not been independently checked.
These weaknesses also matter in transactions. Investors and lenders increasingly look beyond the audit report at control and governance signals, as discussed in our article on due diligence beyond the report.
Illustrative example: no error, but a fragile control environment
A company with annual revenue of ₹85 crore has a senior accountant who has been with it for twelve years. She creates vendors, uploads payment files to the bank portal, holds one of the two bank authorisation tokens and prepares the bank reconciliation. Her reconciliations are always on time and always agree.
An internal audit review finds that she released about 60% of payment value during the year, that 4 of the 14 active ERP users are staff who have left, and that no reviewer has signed the bank reconciliation for 18 months. Twenty-three vendor bank detail changes were made with no call-back confirmation.
Testing finds no fraud and no misstatement. The finding is still serious: if any one of these controls were exploited, the same person who could make an improper payment would also be the person reconciling it.
The remedy was not to remove trust in a capable employee. It was to redesign the process so that trust is not the only control: split vendor creation from payment, require a second person for bank detail changes, remove dormant users and introduce documented reconciliation review.
Internal controls to test even when the accounts are clean
| Control area | What good looks like | Test |
|---|---|---|
| Segregation of duties | No single user can create a vendor, post an invoice and release payment | Run a conflict analysis of user roles in the ERP and bank portal |
| Access management | Access granted on approval, reviewed at least half-yearly, removed on exit | Match active user lists to the HR leavers list; check last review evidence |
| Vendor master | Independent verification of new vendors and bank detail changes | Sample changes and trace to verification evidence and call-back records |
| Reconciliations | Prepared on time, reviewed and signed, old items investigated | Inspect reviewer sign-off and ageing of reconciling items |
| Approvals | Approval before commitment, by an authorised person | Compare approval dates with PO, contract and payment dates |
| Business continuity | Documented procedures and a trained backup for critical roles | Ask the backup to perform a key step; review procedure documents |
For how these tests fit within a risk-based internal audit plan and Audit Committee reporting, see our internal audit and corporate governance guide.
Red flags that the control environment is fragile
- One person is 'the only one who knows' how a critical process works.
- Month-end close is delayed whenever a particular employee is on leave.
- Reconciliations exist but carry no reviewer signature or date.
- The active user list in the ERP is longer than the finance team.
- Approvals are stamped or signed in batches after payments are made.
- Vendor bank details change frequently, often just before payment runs.
- Process manuals are outdated or do not exist.
Small exceptions in these areas tend to grow over time. Our article on how fraud starts small explains how tolerated exceptions become losses.
How to strengthen controls without slowing the business
- Map critical processes. Identify the five to eight processes where errors or fraud would hurt most: payments, payroll, sales and receivables, purchases, inventory, treasury.
- Identify single points of failure. For each, list who can initiate, approve, record and reconcile, and where one person holds more than one of these.
- Use system controls first. Configure ERP and bank workflows so that segregation is enforced automatically rather than by policy.
- Add compensating reviews where staff are few. In small teams, a monthly owner or CFO review of payment listings and vendor changes can offset limited segregation.
- Document and cross-train. Write short process notes and ensure a backup can perform each critical step.
- Review periodically. Make access review, reconciliation review and exception reporting part of the monthly or quarterly calendar.
Checklist: can you rely on the controls behind your numbers?
- Is any critical process dependent on a single individual without a trained backup?
- Can any user create a vendor and also release a payment to it?
- Were system access rights reviewed in the last six months, and were leavers removed promptly?
- Are vendor bank detail changes independently verified?
- Are reconciliations reviewed, signed and dated by someone other than the preparer?
- Are approvals obtained before commitment rather than after payment?
- Are key processes documented and up to date?
- Does the board or Audit Committee receive a report on control weaknesses, not only on financial results?
Frequently asked questions
Can a company have accurate financial statements but weak internal controls?
Yes. Accurate statements can result from year-end checking and adjustments even when day-to-day controls are weak. The weakness shows up later as fraud, errors, disruption or non-compliance.
Does a clean statutory audit report mean internal controls are strong?
Not necessarily. The audit opinion addresses whether the financial statements are true and fair. Reporting on internal financial controls under section 143(3)(i) is separate, and certain private companies are exempt from it.
What is key-person dependency risk?
It is the risk that critical processes rely on one individual's knowledge, access or judgement. If that person leaves, is absent or misuses their position, the organisation cannot detect or continue the process reliably.
How often should user access rights be reviewed?
At least half-yearly for finance, banking and payroll systems, and immediately when an employee leaves or changes role. Many organisations review high-risk access quarterly.
What is the difference between preparing and reviewing a reconciliation?
Preparing a reconciliation identifies differences. Reviewing it means an independent person examines the reconciling items, especially old or unusual ones, and confirms they are genuine and followed up. Without review, a reconciliation can hide problems.
Which private companies are exempt from IFC reporting by auditors?
Private companies with turnover below ₹50 crore as per the latest audited financial statements and aggregate borrowings from banks, financial institutions or bodies corporate below ₹25 crore at any time during the year are exempt, along with one person companies and small companies. Their controls still matter for governance.
Conclusion
Strong governance is not only about avoiding mistakes in the accounts. It is about building a business that remains dependable, transparent and resilient as it grows. That depends on controls that do not rely on one person, access that is reviewed, reconciliations that are examined and approvals that come before commitments.
Accurate numbers build confidence. Effective controls preserve it. Internal audit's role is to test whether the systems, controls and people behind the numbers can be relied on, not only whether last year's figures were right.
Need a fresh look at your internal controls?
H K Davra & Co. supports companies with risk-based internal audit, internal financial controls testing and Audit Committee reporting.
Talk to usThis article is for general information only and does not constitute professional advice or solicitation. Examples are illustrative and do not refer to any specific company. Provisions are summarised as of October 2026. Please refer to the relevant provisions and seek advice on your specific facts.