Section 143(3)(i) of the Companies Act requires the statutory auditor to opine on the adequacy and operating effectiveness of Internal Financial Controls over Financial Reporting for every company covered — not just listed. The exemptions are narrow.
The value, though, is not the audit opinion. It's the accidental discipline: documented approval matrices, segregation of duties, exception logs, and quarterly control-testing convert a 'trust the CFO' business into an institutional one — which is exactly what buyers and investors reward.
Design a minimum viable IFC in 4 domains: revenue-to-cash, procure-to-pay, hire-to-retire, and record-to-report. 20–25 key controls covering these four flows is enough for a ₹25–500 Cr business. More is theatre.
Test annually, not once. A control that worked last audit and hasn't been re-tested since is, in effect, an unaudited control.