The Implementation of Internal Control Over Financial Reporting (ICFR): FAQs

The implementation of Internal Control Over Financial Reporting (ICFR) is a critical aspect of ensuring the accuracy and reliability of financial statements. With the evolving regulatory landscape and the increasing emphasis on corporate governance, many organisations have questions about how to effectively implement and maintain ICFR.

This document aims to address some of the most frequently asked questions regarding ICFR, providing clarity on regulatory and reporting requirements, implementation strategies, handling control deficiencies, the role of internal audit, and other pertinent issues. Whether you are a public interest entity (PIE) or a public company, understanding these aspects is essential for compliance and for fostering stakeholder confidence in your financial reporting processes.

Regulation and Reporting Requirements

• Which companies are affected by the requirement to report on internal control over financial reporting?
• When is the effective date for implementation and reporting?
• How is this requirement different from previous reporting requirements?
• Is it a statutory/regulatory requirement for auditors to issue two opinions (on the FS and ICFR)?
• What entities are PIE based on the Financial Reporting Council of Nigeria (Amendment) Act, 2023?
• Can you provide examples of companies that qualify as government licensees according to the FRC definition?

ICFR Implementation

• What are the key factors to make ICFR a success for the whole organisation?
• Who has the responsibility to implement and evaluate ICFR?
• How do you address the situation when leadership views control implementation, including ICFR, as a cost-consuming activity?
• When discussing business controls, the emphasis is often on Finance. How can an organisation ensure that all business segments recognize that control is a collective responsibility crucial for the company’s survival and the effective implementation of ICFR? What practical steps can be taken to instill and integrate the necessary changes required by ICFR within the non-finance departments of the organisation?

Control Deficiencies & Remediation

• To what extent do audit adjustments reveal the material weaknesses and significant deficiencies?
• How do we determine what is a material weakness or a significant deficiency?
• Some controls have an annual frequency.
• How will a failed annual control have the chance to be remediated by the financial year end?

Internal Audit Function

• Does the ICFR program involve a review of the Internal Audit and Risk Management activities/function or just Internal Control?
• Can a startup with no Internal Audit Unit still implement ICFR?
• As an internal control personnel, how do we ensure continuous monitoring of the ICFR within the organisation, especially around post implementation?

Other Questions

• What risk-based controls can be adopted in a National Microfinance Bank?
• Are there any best practice internal control templates that can be adopted by entities for every control area (e.g. inventory, treasury, fixed assets) as a benchmark against existing internal control practices to determine the extent of additional work and resources that are required to close the gap?
• Can PwC assist participants with a typical ICFR program, especially in the first year of implementation, by working closely with clients to ensure proper control design, documentation, and evaluation for effective compliance? Additionally, what steps can organisations take to address gaps in control, and does PwC support these efforts through training programs?