The real cost of ICFR is in the sharing – and in the risk you can't price.
Two things sit under every ICFR programme. One is quantifiable – the days your team burns sharing evidence with external and internal auditors for each control. The other is not – the SEBI, audit, and reputational risk every undetected lapse carries. We model the first and name the second.
Your control universe
Count each control once, under the frequency it operates at.
Day rate assumption
Blended cost for one finance / audit day spent purely on sharing evidence – filing, emailing, chasing sign-offs, pulling samples.
This is only the time your team spends sharing evidence with external and internal auditors. Accease automates the mapping, so these days drop out of the year.
| Frequency | Controls | Days / control / yr | Total days | Cost |
|---|---|---|---|---|
| Daily controls | 5 | 2 | 10 days | ₹30,000 |
| Weekly controls | 10 | 1.5 | 15 days | ₹45,000 |
| Monthly controls | 40 | 1 | 40 days | ₹1.20 L |
| Quarterly controls | 20 | 1 | 20 days | ₹60,000 |
| Annual controls | 10 | 0.25 | 2.5 days | ₹7,500 |
| Total | 87.5 days | ₹2.63 L | ||
Day rate used: ₹3,000 / day. Days per control account for multiple audits touching the same control in a year – statutory, internal, tax, and group consolidation.
The risk you can't price on a spreadsheet.
The saving above covers only sharing time. It ignores the bigger story CFOs actually worry about: a control that lapses in February and is only discovered in December. Real-time monitoring is what makes that conversation disappear.
SEBI LODR / Companies Act exposure
Penalties up to ₹1 Cr per violation for financial misstatement, with personal liability for CEO and CFO under Sec. 134 / 143. A single late-detected control lapse can trigger disclosure obligations you never wanted to write.
Qualified audit opinion
One material weakness on ICFR is enough to qualify the audit report. That qualification sits on public filings, hits market cap, and blocks debt covenants and fresh fundraising.
Real-time lapse detection
Accease flags a failed control the day it lapses, not at year-end. Remediation cost on day one is a fraction of remediation cost after 11 months of compounded errors flowing into the financials.
Audit-sample surprises
Samples pulled for statutory, internal, and group audits stop becoming fire-drills. Control owners are not chased at quarter-end; auditors self-serve from a clean evidence trail.
Restatement & reputation risk
A restatement triggers re-audit fees, analyst downgrades, and class-action exposure in listed groups. The expected-value cost of avoiding even one such event outweighs a decade of platform spend.
Management certification risk
The CFO signs off that ICFR is effective. Without real-time monitoring, that signature is based on hope. With Accease, it is based on a live control status.
You see lapses when remediation still costs hours, not when they have already flowed into quarterly financials, board decks, and regulator filings.
How the sharing days are modelled.
The base unit is 1 audit cycle = 1 day external + 1 day internal for a high-frequency control. Numbers scale up because the same control is typically touched by multiple audits in a year – statutory, internal, tax, and group consolidation – each pulling its own samples and evidence.
- Daily: 2 days / control / year.
- Weekly: 1.5 days / control / year.
- Monthly: 1 day / control / year.
- Quarterly: 1 day / control / year.
- Annual: 0.25 days / control / year (~2 hours).
| Frequency | Runs / yr | Days / control | Cost / control* |
|---|---|---|---|
| Daily controls | 250 | 2 | ₹6,000 |
| Weekly controls | 52 | 1.5 | ₹4,500 |
| Monthly controls | 12 | 1 | ₹3,000 |
| Quarterly controls | 4 | 1 | ₹3,000 |
| Annual controls | 1 | 0.25 | ₹750 |
*At the current day rate of ₹3,000 / day.
Want us to sanity-check these numbers for your org?
Share the output with your controller or audit partner. We'll rebuild it against your actual RCM in a 30-minute walkthrough – no pitch deck, just your numbers.