What it means
ICFR is a narrower idea than internal control generally. General internal control also covers operational efficiency and legal compliance, whereas ICFR is concerned solely with whether the numbers reported to investors, lenders and regulators are accurate and complete.
That focus is what makes it possible to test and report on formally. The usual approach works backwards from the financial statements.
You identify the accounts that are material, work out what could go wrong in each of them, then identify the controls that would prevent or detect that error. Testing then confirms that those controls actually operated throughout the period rather than only at the year end.
Findings are graded by severity, and the language is precise. A control deficiency is a weakness; a significant deficiency is serious enough to merit the audit committee's attention; and a material weakness means there is a reasonable possibility that a material misstatement would not be prevented or detected in time.
The last of these must normally be disclosed publicly. Certain areas attract particular attention because they carry the most judgement or the most opportunity for override.
Revenue recognition, stock valuation, estimates and provisions, the journal entry process and access rights in the accounting system come up repeatedly. Controls over how and by whom manual journals are posted are among the most valuable, since a manual journal is the simplest way to move a number without anyone noticing.
Spreadsheets deserve a special mention, because most finance functions still depend on them somewhere in the close. A workbook that calculates a provision or consolidates a group is part of the reporting process and needs version control, restricted access and a review of the formulas, not just of the answer it produces.
Undocumented spreadsheets are one of the most common sources of reporting error found in practice. Even for private companies with no legal obligation, thinking in ICFR terms pays off.
Lenders, acquirers and investors all look for evidence that reported figures are produced by a repeatable process rather than assembled heroically each period. Companies preparing for a sale or an initial public offering usually find that closing ICFR gaps early is far cheaper than doing it under diligence pressure.
In practice
Real-world examples.
Example
A listed manufacturer documents its revenue process end to end, tests the control requiring dispatch confirmation before revenue is recognised, and finds it failed on eleven occasions. The exception is logged as a control deficiency, remediated and retested before the year end assessment.
Example
A software company restricts the ability to post manual journals to three named people and requires a second reviewer for any entry above $25,000. The control directly addresses the risk that a manual adjustment quietly changes reported profit.
Example
A group preparing for sale discovers that several staff who changed roles still hold system access to both raise and approve purchase orders. Access rights are reviewed and cleaned up before the buyer's diligence team asks the question.
Think of it
“ICFR is controls specifically for financial reporting accuracy-ensuring statements are right.
Case study
Seen in the real world.
Wren Analytics is an entirely fictional software company used here for illustrative purposes. Ahead of a planned listing, its advisers asked how it could demonstrate that its reported revenue was reliable, and the honest answer was that the monthly close depended on one experienced accountant and a large spreadsheet.
Over two quarters, Wren documented its close process, defined the specific controls around revenue cut-off and manual journals, and set a rule that no journal above $25,000 could be posted without independent review. Testing in the first quarter found several exceptions, including journals posted by a leaver whose access had never been withdrawn.
By the second quarter the exceptions had cleared and the close had shortened from fourteen days to eight. In this invented example, management concluded that the discipline of ICFR had improved the speed of reporting as much as the reliability of it.
Watch out
Common mistakes.
- Treating ICFR as an audit exercise that belongs to the finance team alone, when many of the controls sit in sales, operations and IT.
- Documenting controls once and never updating them, so the description no longer matches how the process actually works after a system change.
- Testing controls only at the year end, which says nothing about whether they operated during the other eleven months of the period.
Questions
People also ask.
How is ICFR different from internal control generally?
ICFR covers only the controls relevant to producing reliable financial statements, while internal control also covers operations and compliance.
What is a material weakness?
It is a deficiency, or combination of deficiencies, severe enough that a material misstatement of the accounts could reasonably fail to be prevented or detected on a timely basis.
Does a private company need ICFR?
There is usually no legal requirement, but lenders, investors and buyers expect reliable reporting, so many private companies adopt the same discipline voluntarily.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%