Glossary · SOC and attestation
ICFR is why a client's auditor cares about your systems at all.
The processes and controls a company uses to give reasonable assurance that its financial reporting is reliable and its financial statements are prepared properly.
Back to the glossary01 · In plain words
In plain words
The processes and controls a company uses to give reasonable assurance that its financial reporting is reliable and its financial statements are prepared properly.
Every company that publishes accounts needs to trust the numbers going into them. Internal control over financial reporting, or ICFR, is the set of checks that makes the numbers trustworthy: approvals, reconciliations, access limits on finance systems. When part of that work is outsourced, the provider's controls become part of the client's ICFR.
Spelled out: Internal control over financial reporting.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
For US-listed companies, the Sarbanes-Oxley Act section 404 requires management to assess ICFR, and many must also have their external auditor report on it. India has a parallel expectation for internal financial controls in company audits. When a listed company outsources payroll, billing or claims processing, its auditor still has to be satisfied that those outsourced controls work. A SOC 1 report is the standard way a service provider answers that once, for every client, instead of hosting each client's auditor separately.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- SOX section 404 assessments
- Management's annual evaluation of ICFR in a US-listed company and, for many, the auditor's report on it.
- A client's request for a SOC 1
- The first sign your service has become part of someone else's ICFR.
- Audit committee papers
- Where control deficiencies, including those at service providers, are reported.
- Statutory audit reports in India
- Where the auditor comments on internal financial controls over financial reporting.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: a listed manufacturer outsourcing invoice processing
A manufacturer listed in the US sends supplier invoice processing to a business process outsourcing firm in Chennai. The manufacturer's auditor identifies accounts payable as a significant process. The BPO firm's controls over invoice capture, three-way match and payment file release now sit inside the manufacturer's ICFR. The auditor asks for a SOC 1 Type 2 covering the manufacturer's fiscal year and checks the complementary controls the manufacturer must run, such as approving payment batches.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Information security controls
- Security controls protect systems and data in general. ICFR covers only what affects the reliability of financial reporting. Some security controls, such as access to the ledger, sit in both.
- SOX compliance
- SOX is a US law with many sections. ICFR is the concept its section 404 asks companies to assess and report on.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Ask clients whether your service is in scope for their ICFR; the answer decides whether you need a SOC 1.
- Map your processes to the client account balances they affect, such as payroll expense or revenue.
- Separate controls that matter for financial reporting from purely operational ones before scoping.
- GuideICFR and SOC 1 controlsWhich controls matter to a client's financial reporting.
- GuideSOC 1 and Sarbanes-OxleyHow a service provider's report feeds a client's SOX work.
- GuideWho needs a SOC 1 report?A test for service providers whose work touches clients' financial statements.
Sources: Sarbanes-Oxley Act of 2002, section 404; SEC rules 13a-15 and 15d-15; PCAOB AS 2201; AT-C section 320; Companies Act, 2013 (India), section 143.
Questions about ICFR
Does ICFR apply to companies that are not listed in the US?
The idea does; the SOX rules do not.
The SOX section 404 requirements apply to US-listed issuers. In India, the Companies Act, 2013 asks statutory auditors of many companies to report on internal financial controls with reference to financial statements, which covers similar ground. Your counsel or auditor should confirm what applies to you.
Is a SOC 2 enough for a client's ICFR needs?
Usually not.
A SOC 2 addresses security and related criteria. A client's financial auditor needs controls tied to financial reporting objectives, which is what a SOC 1 under AT-C 320 provides.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.