INSPECTION & AUDIT DIVISION (RBIA)

Corporate Office, Plot No-5, Sector-32,

Institutional Area, Gurugram. e-mail: [email protected]

Date: 26.04.2021

In Supersession of IAD Circular

No. 10/2020 dated 26.03.2020

TO All OFFICES

CIRCULAR NO. : 12 /2021

Reg : Risk Based Internal Audit (RBIA) Policy

:10
**************************************************

Risk Based Internal Audit Policy for the year 2020-21 was circulated vide IAD Circular

20
No. 10/2020 dt. 26.03.2020.
/20 342
The RBIA Policy is required to be reviewed annually. Based on the feedback received
from the field and the experience gained in implementing the policy, the same has been
21
reviewed with certain modifications.
/08 26

The revised RBIA Policy has been approved by the Board vide Resolution No. A-90 in
its meeting held on 30.03.2021.
3

The changes approved in the RBIA Policy have been placed at Annexure ‘A’.

The revised RBIA Policy has been placed at Annexure ‘B’

All concerned are advised to ensure strict compliance.

29

(P. P. SINGH)
GENERAL MANAGER

Encl: Annexure ‘A’ & ‘B’.

Inspection & Audit Division
Corporate Office, Gurugram.

Annexure- A
Additions
Clause / Para Clause of existing RBIA Policy Addition Proposed in
Heading RBIA Policy
(Nature of
Item)

:10
Chapter 8 Para (v) Added
Miscellaneous
Provisions NIL (iv) Significant audit findings of Regular Audit mentioned

20
/20 342
Page No.- 18 hereunder shall be placed before Audit Committee of Board
on quarterly basis.

1. Insurance not available, valid policy not held on record.

21
2. KYC norms not adhered to / spot verification of

/08 326
borrower‟s / guarantor‟s place of business/ residence not
done/
3. Working Capital limits not renewed/ reviewed within due
date.
4. Genuineness/non encumbrance of title deeds of the IPs
to be mortgaged not ensured.
5. Equitable mortgage created has not been registered with
central Registry within stipulated time.
6. CIBIL/ Credit Information Companies (CICs) records not
verified.
29

7. Bank‟s charge not Registered with the Registrar of

Companies within stipulated time.
8. Branch does not tally / reconcile Clearing Imprest/office
accounts/ internal accounts as prescribed.

Page 1 of 13
Inspection & Audit Division
Corporate Office, Gurugram.

Supervision shall be a continuing process, Supervision shall be a continuing process, beginning with
Chapter 9 beginning with planning and ending with the planning and ending with the conclusion of the audit assignment.
Change conclusion of the audit assignment.
Management - The Head of Internal Audit shall directly report to either the Audit
9.1 Vertical Head The Vertical Head (IAD :HO) - Committee of the Board (ACB) / MD & CEO or Whole Time
of Internal Audit a) Shall be responsible for allocation of all Director (WTD). Should the Board of Directors decide to allow
Page No.- 19 internal audit assignments. the MD & CEO or a WTD to be the 'reporting authority' of the
b) Shall inform ACE/ACB the migration of HIA, then the 'reviewing authority' shall be with the ACB and the

:10
the ratings of branches on Annual 'accepting authority' shall be with the Board in matters of
basis. performance appraisal of the Head of Internal Audit. Further, in
c) Shall be responsible for providing such cases, the ACB shall meet the Head of Internal Audit at
appropriate audit supervision which least once in a quarter, without the presence of the Senior

20
/20 342
shall include:- Management, including the MD & CEO/ WTD. The Head of
(i) Providing suitable instructions to Internal Audit shall not have any reporting relationship with the
subordinates at the outset of the business verticals of the bank and shall not be given any
audit; business targets.

21
(ii) Ensuring that the approved audit

/08 326
program is carried out unless The Vertical Head (IAD :HO) -
deviations are justified and a) Shall be responsible for allocation of all internal audit
authorized; assignments.
(iii) Determining that audit working b) Shall inform ACE/ACB the migration of the ratings of
papers adequately support the audit branches on Annual basis.
findings, conclusions and reports c) Shall be responsible for providing appropriate audit
and audit objectives are met. supervision which shall include:-
(i) Providing suitable instructions to subordinates at the
outset of the audit;
(ii) Ensuring that the approved audit program is carried
29

out unless deviations are justified and authorized;

(iii) Determining that audit working papers adequately
support the audit findings, conclusions and reports
and audit objectives are met.

Page 2 of 13
Inspection & Audit Division
Corporate Office, Gurugram.

Clause / Para Clause of existing RBIA Policy Addition Proposed in

Heading RBIA Policy
(Nature of
Item)
Chapter 3 3.2 (B) Segment Audit (New Added)
Direction of Risk NIL Zonal Audit Office, at the instance of Head Office Divisions,

:10
Zonal Manager, Circle Head and on receipt of any alarming
information, may take a view on conducting of specific segment
audit on the basis of risk perception in that particular segment,
wherever deemed necessary. For example, high concentration /

20
/20 342
sudden spurt in housing loans in a branch may call for an audit of
housing loan portfolio of the branch or delinquencies in car loans
in a particular geographical area may call for an audit of car loan
portfolio in all the branches of that particular geographical area.

21
A regular audit report shall be treated as closed, on
Chapter 7

/08 326
7.3 Closure of NIL 100% dropping/ rectification of irregularities in FSI
Audit Reports (Fraud Sensitive Index), ZTL ( Zero Tolerance
Level), KRI (Key Risk Indicator) items and
Page No.- 17
Significant Audit Findings (as defined in the policy)
Continued from and at least 75% rectification/ dropping of other
previous page irregularities reported in the audit report.
Para (iv) Added
Chapter 8
Miscellaneous (iv) Position of Regular Audits conducted and status of closure
Provisions NIL
29

of reports shall invariably be placed to ZACE as a regular

Page No.- 18 agenda item.

Page 3 of 13
Inspection & Audit Division
Corporate Office, Gurugram.

Chapter 9 Any emergent amendments in this policy / operational guidelines

9.5 NIL be approved by ACE and same shall be subsequently placed to
Page No.- 20 next ACB for ratification. Further, such modifications /
amendments made in the policy during the year be informed to
the Board along with annual review of this Policy.

:10
Modifications
Clause / Clause of existing RBIA Policy Modification Proposed in

20
/20 342
Para RBIA Policy
Heading
(Nature of

21
Item)

/08 326
Chapter 1 (x) In case the RBIA is outsourced, it would be (x) The internal audit function shall not be outsourced.
1.2 RBI / ensured that the RBIA continues to function However, where required, experts, including former
Govt. effectively and that the outsourcing vendor employees, could be hired, with the approval of the
has necessary expertise to undertake the Board of the Bank, on contractual basis subject to the
Guidelines
contracted work. ACB being assured that such expertise does not exist
within the audit function of the bank. Any conflict of
Page No.- 3 interest in such matters shall be recognised and
effectively addressed. Ownership of audit reports in all
cases shall rest with regular functionaries of the internal
audit function.
29

Page 4 of 13
Inspection & Audit Division
Corporate Office, Gurugram.

Clause / Para Existing Policy Proposed Policy

Heading Clause / Para Heading (Nature of Item) Clause / Para Heading (Nature of Item)
(Nature of
Item)
Chapter 1 The Policy covers : The Policy covers :
1.3 Coverage
of units under 1. All the branches of the Bank including 1. All the branches of the Bank including

:10
Exceptionally Large Branches (ELBs), Very Exceptionally Large Branches (ELBs), Very
RBIA
Large Branches (VLBs), Large, Medium and Large Branches (VLBs), Large, Medium and
Small branches located in all the areas viz. Small branches located in all the areas viz.
Page No.- 3 Metropolitan, Urban, Semi-urban and Rural, Metropolitan, Urban, Semi-urban and Rural,

20
/20 342
Large Corporate Branches (LCBs), Mid Large/Extra Large Corporate Branches (ELCBs
Corporate Branches (MCBs), International and LCBs), Mid Corporate Centres (MCCs),
Banking Branches (IBBs), Retail Asset PNB Loan Points (RAM/iRAM), International
Processing Centers (RAPCs), Centralised Banking Branches (IBBs), Back Offices

21
Loan Processing Centers (CLPCs), Back {including Regional Collection Centers (RCCs),

/08 326
Offices {including Regional Collection Centralised Draft Payable Centers
Centers (RCCs), Centralised Draft Payable (CDPCs)},CASA back offices, Asset Recovery &
Centers (CDPCs)}, Asset Recovery & Management Branches/Asset Recovery Cells
Management Branches/Asset Recovery (ARMBs/ARCs).
Cells (ARMBs/ARCs). 2. Trade Finance Centers (TFC).
3. Overseas Branches including their Back offices.
2. Trade Finance Centers (TFC). 4. International Service Branch (ISB).
3. Overseas Branches including their Back 5. Currency Chests
offices.
4. Specialized Branches viz. MSME, The Policy related to audit of Currency chests is issued by
International Service Branch (ISB). the owner Division. Management Audit of Administrative
29

5. Currency Chests Offices and Subsidiaries is being conducted as per Risk

Based Management Audit (RBMA) Policy of HO: MARD.
The Policy related to audit of Currency chests is ACB (through ACE) shall have the authority to decide for
issued by the owner Division. Management Audit of Risk Based Internal Audit of any unit other than mentioned
Administrative Offices and Subsidiaries is being above.
conducted as per Risk Based Management Audit
(RBMA) Policy of HO: MARD.
ACB (through ACE) shall have the authority to decide
for Risk Based Internal Audit of any unit other than
mentioned above.
Page 5 of 13
Inspection & Audit Division
Corporate Office, Gurugram.

Chapter 2
To suit the requirement of Specialised Branches / To suit the requirement of Specialised Branches / Offices
2.5 Specialised Offices or Units like LCBs / MCBs, IBBs, International or Units like ELCBs/LCBs / MCCs/ PLPs/ IBBs,
Branches/ Service Branch (ISB), ARMBs/ARCs, Back Offices, International Service Branch (ISB), ARMBs/ARCs, Back
Offices MICR Centers, their formats have been developed Offices, MICR Centers, their formats have been developed
individually. In case of Branches viz. LCBs, MCBs &

:10
Page No.- 7 individually. In case of Branches viz. LCBs, MCCs, PLPs &
IBBs etc. the risk assessment shall be done on the IBBs etc. the risk assessment shall be done on the basis
basis of both – Business and Control Risk as per the of both – Business Risk and Control Risk as per the risk
risk methodology referred in the policy. However, in methodology referred in the policy. However, in case of
case of other Offices / Units functioning as Service

20
other Offices / Units functioning as Service Branches /

/20 342
Branches / Offices viz. ARMBs, Back Offices etc, the Offices viz. ARMBs, Back Offices including CASA back
risk assessment shall be done only on the basis of offices etc, the risk assessment shall be done only on the
Control Risk. Further, in case of these specialized basis of Control Risk. Further, in case of these specialized
branches/offices, the weightage range for the various branches/offices, the weightage range for the various

21
Business & Control Risk components may be suitably Business & Control Risk components may be suitably

/08 326
modified to match with their specific functions, with modified to match with their specific functions, with
minimization of subjectivity minimization of subjectivity.
29

Page 6 of 13
Inspection & Audit Division
Corporate Office, Gurugram.

lause / Para Existing Policy Proposed Policy

Heading Clause / Para Heading (Nature of Item) Clause / Para Heading (Nature of Item)
(Nature of
Item)
Chapter 2
Risk Assessment process is solely for the purpose of Concurrent / Regular Audit of branches is being conducted
Introductory formulating risk-based audit plan. The Risk Assessment through audit templates devised by IAD: HO in consultation

:10
para is to be done on the basis of business risk of an with the owner divisions. These templates are being
Page No.- 5 activity/location and control risk i.e. effectiveness of modified from time to time as and when there is a change
control systems for monitoring the inherent business in guidelines issued by bank/ regulator and on the instance
risks. of the owner divisions/ other Head Office Divisions. Head

20
/20 342
of Internal Audit i.e CGM, IAD, shall have the authority to
approve modification in audit templates.

Risk Assessment process is solely for the purpose of

21
formulating risk-based audit plan. The Risk Assessment is

/08 326
to be done on the basis of business risk of an
activity/location and control risk i.e. effectiveness of control
systems for monitoring the inherent business risks.
Chapter 2 (a) In case, Quick Mortality cases reported in a (a) In case, Quick Mortality cases reported in a
Branch are either above Rs. 5 Crore or 20% of Branch are either above Rs. 5 Crore or 20% of the total
2.4 (a) the total number of loans and advances number of loans and advances sanctioned between the
Exception to sanctioned between the last two regular audits, last two regular audits, the Branch shall be
Overall Risk the Branch shall be straightaway categorized as straightaway categorized as Minimum “High Risk”, with
“High Risk”, with direction of risk as “Stable‟, direction of risk as “Stable‟, irrespective of the Overall
Page No.- 7 irrespective of the Overall risk calculated as per risk calculated as per 3x3 matrix.
3x3 matrix.
29

(b) Any Branch reporting incident of Fraud, originating

(b) Any Branch reporting incident of Fraud, from Branch/involving staff posted at Branch during the
originating from Branch/involving staff posted at review period shall be categorized as Minimum “High
Branch during the review period shall be Risk” with direction of risk as “Stable” irrespective of the
categorized as “High Risk” with direction of risk Overall risk calculated as per 3x3 matrix
as “Stable” irrespective of the Overall risk
calculated as per 3x3 matrix

Page 7 of 13
Inspection & Audit Division
Corporate Office, Gurugram.

Chapter 3 (i) On-site snap audit will be conducted in the 3.2 (A) On-Site Snap Audit
3.2 On-Site following circumstances:-
Snap Audit (i) Head of Zonal Audit Office may take a view on conducting of
a) Two consecutive off-site audits show the on-site Snap Audit in the following circumstances:-
direction of risk as increasing: or
Page No.- 8 b) An off-site audit shows the risk direction a) Two consecutive off-site audits show the direction of
increasing by two notches compared to risk as increasing: or

:10
the previous risk assessment: or b) An off-site audit shows the risk direction increasing
c) Any major deviation/incident as reported by two notches compared to the previous risk
in special report which could seriously assessment: or
affect the working of the branch: or c) Any major deviation/incident as reported in special

20
/20 342
d) On receipt of any alarming report which could seriously affect the working of the
information/report: or branch: or
e) Occurrence of frauds/suspicious d) On receipt of any alarming information/report: or
transactions e) Occurrence of frauds/suspicious transactions

21
f) On directives of Head Office Divisions
(ii) Snap Audit shall invariably be conducted in the following

/08 326
on the basis of irregularities brought to
cases :
their notice.
a) On directives of Head Office Divisions on the basis
g) At the behest of Circle Head, where an of irregularities brought to their notice.
official posted in a branch, exercising
loan sanctioning powers, tenders b) At the behest of Circle Head, where an official
resignation/ opt for VRS. The Snap audit posted in a branch, exercising loan sanctioning
shall cover entire tenure of such official powers, tenders resignation/ opt for VRS. The Snap
after the last regular audit of the branch. audit shall cover entire tenure of such official after
In case the next regular audit of the the last regular audit of the branch. In case the next
regular audit of the branch is falling due in the next
29

branch is falling due in the next three

months from the date of tendering three months from the date of tendering resignation
resignation of the official, the competent of the official, the competent authority may take a
authority may take a decision to decision to prepone the regular audit of the branch
prepone the regular audit of the branch instead of conducting snap audit.
instead of conducting snap audit.

(ii) Duration of on-site snap audit shall be 1 to 3

days depending upon the size of (iii) Duration of on-site snap audit shall be 1 to 3 days
the branch, category of risk and the direction depending upon the size of the branch, category of risk,
of the risk. direction of risk and areas to be covered in snap audit.
Page 8 of 13
Inspection & Audit Division
Corporate Office, Gurugram.

(iii) Only those areas shall be covered in snap (iv) Only those areas shall be covered in snap
audit which show direction towards audit which show direction towards high
high risk in off-site audit. risk in off-site audit.

Chapter 5 1. At least 10% of Non-Concurrent Audit 1. At least 10% of Non-Concurrent Audit Branches,
Branches shall be identified by respective ZAOs where Regular Audit has been conducted during

:10
5.3
every year for conducting compliance audit to the previous financial year, shall be identified by
Compliance ascertain the actual status of compliance. respective ZAOs every year for conducting
Audit 2. The branches shall be identified from all the compliance audit to ascertain the actual status of
risk categories viz. Low, Medium, High, Very High compliance.

20
Page No.- 13

/20 342
and Extremely High 2. The branches shall be identified from all the risk
categories viz. Low, Medium, High, Very High and
Extremely High.
3. Procedure to be followed to identify branches, from

21
all the risk categories viz. Low, Medium, High, Very

/08 326
High and Extremely High, for conducting compliance
audit, is explained hereunder :

(i) Out of total number of branches identified for

conducting compliance audit. Compliance audit shall
be conducted in all the branches rated as „High
Risk‟, „Very High Risk‟ and „Extremely High Risk‟
during the previous financial year.
29

(ii) 80% of the remaining branches {after (i) above}

should identified from branches rated as „Medium
Risk‟ during the previous financial year.

(iii) Remaining branches {after (ii) above} should be

identified from branches rated as „Low Risk‟ during
the previous financial year.

Page 9 of 13
Inspection & Audit Division
Corporate Office, Gurugram.

Chapter 7 (iii) In case, irregularities in FSI/ ZTL items are not (iv) In case, irregularities in FSI/ ZTL items, as defined in audit
rectified within prescribed time for closure of templates (eRBIA and eTHIC), are not rectified within
7.2 inspection report of a branch, the Circle Head prescribed time for closure of inspection report of a branch,
Rectification shall seek an explanation from the concerned the Circle Head shall seek an explanation from the
branch. If the explanation submitted by the concerned branch. If the explanation submitted by the
of
concerned branch is found to be satisfactory, concerned branch is found to be satisfactory, Circle Office
Irregularitie
Circle Office may recommend for dropping of may recommend for dropping of the FSI/ZTL item to Zonal

:10
s
the FSI/ZTL item to Zonal Audit Office. Audit Office. However, if the Circle Head feels that the
However, if the Circle Head feels that the irregularities cannot be rectified due to ab initio mistakes,
Page No.- 17 irregularities cannot be rectified due to ab initio violating terms and conditions of sanction and could
mistakes, violating terms and conditions of jeopardize bank‟s interest, he may consider initiating

20
/20 342
sanction and could jeopardize bank‟s interest, appropriate staff side action (including administrative action)
he may consider initiating appropriate staff side against the erring official and complete the same in a time
action (including administrative action) against bound manner. Zonal Office to also monitor the same. In
the erring official and complete the same in a case of offices, directly reporting to Zonal Office/ Head

21
time bound manner. Zonal Office to also monitor Office, explanation from the branch will be sought by the

/08 326
the same. In case of offices, directly reporting to Zonal Office or the respective Head Office Division and
Zonal Office/ Head Office, explanation from the further action will be taken accordingly.
branch will be sought by the Zonal Office or the
respective Head Office Division and further
action will be taken accordingly.
29

Page 10 of 13
Inspection & Audit Division
Corporate Office, Gurugram.

Chapter 7
7.3 Closure of
Clause of existing RBIA Policy
Audit Reports Competent authority and prescribed time period for closure of audit reports is as under:

S.No. Audit Report Prescribed Period for Competent Authority for Closure of Audit Reports
Page No.- 17 Closure of Audit Reports

:10
a) Regular Audit Reports of Within one & half month from Zonal Audit Office
Small and Medium the date of finalization of the
branches & Currency report. i) Closure of Audit Reports of all LCBs/ELBs / VLBs /
Chest. MCBs by Incumbents of ZAO.

20
b) Regular Audit Reports of Within 2 months from the

/20 342
Large branches and other date of finalization of the ii) Branches below the category of VLBs by Second Man
Specialized Offices e.g. report. i.e. AGM.
RCCs, CDPCs, ZTCs,

21
ARMBs, Back Offices etc.
iii) Regular audit reports of Currency Chest shall be
c) Regular Audit Reports of Within 3 months from the

/08 326
closed only after getting recommendation for closure
LCBs/ VLBs/ ELBs / MCBs date of finalization of the
including IBBs report. from Govt. Business Division, Head Office.

(This Clause is proposed to be deleted in the policy

for 2021-22)
d) Regular Audit Reports of, Within 3 months from the Inspection & Audit Division Head Office
Foreign Branches, Back date of finalization of the
Office of Foreign Branches, report.
Trade Finance Centers
(TFCs)
29

Page 11 of 13
Inspection & Audit Division
Corporate Office, Gurugram.

Modification Approved in RBIA Policy

Chapter 7
7.3 Closure of
Audit Reports S.No. Audit Report Prescribed Period for Competent Authority for Closure of Audit
Closure of Audit Reports Reports
a) Regular Audit Reports of Small and Within one & half month from Zonal Audit Office
Page No.- 17 Medium branches. the date of finalization of the
Continued from report. i) Closure of Audit Reports of all ELCBs/

:10
previous page b) Regular Audit Reports of Large Within 2 months from the LCBs/ MCCs/ iRAM/ RAM/ ELBs / VLBs / by
branches and other Specialized date of finalization of the Incumbents of ZAO.
Offices e.g. RCCs, CDPCs, ZTCs, report.
ARMBs, Back Offices etc. ii) Branches below the category of VLBs by

20
Regular Audit Reports of

/20 342
Second Man i.e. AGM.
c) ELCBs/LCBs/MCCs/ Within 3 months from the
iRAM/RAM/VLBs/ ELBs/ including date of finalization of the
IBBs report.

21
d) Regular Audit Reports of, Foreign Within 3 months from the Inspection & Audit Division Head Office
Branches, Back Office of Foreign date of finalization of the

/08 326
Branches, Trade Finance Centers report.
(TFCs)
e) Currency Chest Within one & half month from Circle Head under whose jurisdiction the
the date of finalization of the currency chest is functioning, shall be the
report. competent authority to take a view on
dropping of irregularities and closure of
inspection reports of currency chest.
29

Page 12 of 13
Inspection & Audit Division
Corporate Office, Gurugram.

Deletions
Clause / Clause of existing RBIA Policy Deletion Proposed in
Para RBIA Policy
Heading
(Nature of
Item)

:10
NIL

20
/20 342
*************

21
/08 326
29

Page 13 of 13
 Annexure –B of IAD Circular No. 12/2021 dated 26.04.2021

Risk Based Internal Audit policy

(RBIA)

:10
20
/20 342
21
/08 26
3

Division : Inspection & Audit Division

Version : 2021_IAD_1.0
29
 Confidential – For Internal Circulation Only

Policy Custodian

Division Inspection & Audit Division

Officer in-charge Divisional Head
Policy Contact [email protected]
Approved by Board
Renewal Basis Annual
Last reviewed on 14.02.2020
Supersedes ------

:10
20
/20 342
Policy Version Control
21
/08 26

S. No. Version Version Summary of Page

Number Date changes Number
3

1 2021_IAD_1.0 01 Apr 2021 - 21

29

Risk Based Internal Audit Policy

Version: 2021_IAD_1.0
 Confidential – For Internal Circulation Only

Contents
CHAPTER CONTENTS PAGE NO.
NO.
1 INTRODUCTION

1.1 OBJECTIVE 1
1.2 RBI / GOVT. GUIDELINES 2-3
1.3 COVERAGE OF UNITS UNDER RBIA 3
1.4 SCOPE OF RISK BASED INTERNAL AUDIT 3-4

:10
1.5 FLOW CHART OF THE RBIA PLAN 4

2 RISK ASSESSMENT METHODOLOGY

20
2.1 BUSINESS RISK 5-6
/20 342
2.2 CONTROL RISK 6
2.3 OVERALL RISK 6-7
2.4 EXCEPTION TO OVERALL RISK 7
21
2.5 SPECIALIZED BRANCHES/OFFICES 7
/08 26

2.6 CHANGE/ MODIFY RISK WEIGHTAGE RANGE 7

3 DIRECTION OF RISK
3

3.1 OFF-SITE AUDIT 8

3.2 (A) ON-SITE SNAP AUDIT 8-9
(B) SEGMENT AUDIT 9
3.3 DETERMINATION OF TREND/DIRECTION OF RISK 9-10
3.4 RISK ASSESSMENT RATINGS 10
29

4 ANNUAL AUDIT PLAN

4.1- 4.5 VARIOUS CRITERIA 11

4.6 AUDIT SCHEDULE 11
4.7 ANNUAL AUDIT PLAN 11

5 AUDIT METHODOLOGY

5.1 PRIORITIZATION OF AUDIT AREAS 12-13

5.2 LEVEL OF TRANSACTION TESTING 13
5.3 COMPLIANCE AUDIT 13-14

Risk Based Internal Audit Policy

Version: 2021_IAD_1.0
 Confidential – For Internal Circulation Only

6 NUMBER OF DAYS ALLOWED FOR CONDUCTING

REGULAR AUDIT

6.1 BRANCHES OTHER THAN CONCURRENT AUDIT 15

6.2 CONCURRENT AUDIT BRANCHES 15

7 SUBMISSION & CLOSURE OF AUDIT REPORTS

7.1 SUBMISSION OF AUDIT REPORTS 16

7.2 RECTIFICATION OF IRREGULARITIES 16-17
7.3 CLOSURE OF AUDIT REPORTS 17-18

8 MISCELLANEOUS PROVISIONS 19

:10
9 CHANGE MANAGEMENT

9.1 VERTICAL HEAD OF INTERNAL AUDIT 20

20
9.2 MANPOWER PLANNING/AUDIT RESOURCES 20
/20 342
9.3 TRAINING 20-21
9.4 ROLES & RESPONSIBILITIES 21
9.5 REVIEW AND REVISIONS 21
21
/08 26
3
29

Risk Based Internal Audit Policy

Version: 2021_IAD_1.0
 Confidential – For Internal Circulation Only

Chapter 1
Introduction
Inspection and Audit of Branches and other offices of the Bank have been long
recognized as one of the important management tools for appraisal of its internal
control system and business performance. For ensuring the qualitative and effective
inspection, it is essential to have wide coverage & quality reporting.
The Risk Based Internal Audit (RBIA) is an off-shoot of Pillar-II “Supervisory Review
Process” of Basel-II Accord released by the Basel Committee on Banking
Supervision (BCBS). The Reserve Bank of India had adopted the Risk Based
Supervision (RBS) on the basis of the guidance notes issued by the BCBS and had
issued guidelines to the banks in August, 2001 for moving towards the RBS. The
Risk Based Internal Audit (RBIA) is an important component of the RBS. The
detailed guidelines for the RBIA were issued by the RBI in Dec‟2002, directing the
banks to initiate the RBIA and formulate their own policy on the outlines given by the
RBI.

0
The system shall be analysed continuously on the directions of RBI, Ministry of
Finance, GOI and Board of the Bank,.

:1
1.1 Objective of Risk Based Internal Audit
20
/20 342

RBIA essentially entails the allocation of audit resources and monitoring according to
risk profile to minimize the impact of crisis situations. It involves review and report
21

on control environment as a whole, the process by which the risks are identified,
/08 26

analyzed and managed, the line of control over key processes, reliability of branch
management function, safeguarding of assets and compliance with rules and
regulations.
3

The Policy has been framed for moving towards achieving the following objectives:-
(i) An independent assurance to the management about the efficiency and
efficacy of risk control measures to mitigate the inherent risks in business
activities.
29

(ii) Evaluation of risk management systems and control procedures.

(iii) Identification of potential risks and suggesting measures for mitigation of
risks.
(iv) An independent risk assessment for prioritizing the audit areas and allocation
of audit resources.
(v) Facilitate drawing up of the annual audit plan.
(vi) Creating risk sensitivity amongst field staff.

(vii) The Risk Based Internal Auditors will be independent and will carry out their
work freely and objectively. Independence permits the auditor to render
impartial and unbiased judgment essential to the proper conduct of audit.

1
 Confidential – For Internal Circulation Only

1.2 RBI / Govt. Guidelines

The policy has been framed on the basis of the guidelines issued by the Reserve Bank
of India in December 2002 and Ministry of Finance, Govt. of India vide their
communication No. F. No. 7/112/2011-BOA dated 28.06.2012, the salient features of
which are:

(i) The scope of internal audit system which had earlier been concentrating on
transaction testing, testing of accuracy and reliability of accounting records, financial
reports, control reports, adherence to legal and regulatory requirements etc., would
be widened to cover the evaluation of adequacy and effectiveness of risk
management procedures and internal control systems in the bank. The RBIA would
not only offer suggestions for mitigating control risks but also anticipate areas of
potential risks and play an important role in protecting the bank from various risks.

(ii) The RBIA will undertake an independent risk assessment solely for the purpose

0
of formulating the risk based audit plan keeping in view the inherent business risks
and effectiveness of control systems for monitoring the inherent risks of business

:1
activities.
20
/20 342
(iii) Under RBIA, focus will shift from full scale transaction testing to risk
identification, prioritization of audit areas and allocation of audit resources in
accordance with the risk assessment. The policy should include risk assessment
21

methodology for identifying the risk areas based on which the audit plan would be
/08 26

formulated. The policy should lay down the maximum time period beyond which
even the low risk business activities/ locations would not remain unaudited.
3

(iv) The overall risk profile would be arrived at by drawing a risk matrix for taking
into account inherent business risks and control risks. The overall risk shall be
treated as extremely high where business risks and control risks both are high.

(v) The risk assessment shall make use of both quantitative and qualitative
approaches. While the business risks can largely be determined by quantitative
29

assessment, the qualitative approach shall be adopted for assessing the quality of
control in business activities.

(vi) The risk assessment would invariably be undertaken on a yearly basis.

(vii) The annual audit plan would include the schedule and rationale for audit work
planned. It would also include all risk areas and their prioritization based on the level
and direction of risk.

(viii) Transaction testing would continue to remain an essential aspect of RBIA. The
extent of transaction testing will have to be determined based on the risk
assessment. The banks would undertake 100% transaction testing in the high risk
areas.

2
 Confidential – For Internal Circulation Only

(ix) A risk audit matrix shall be prepared on the basis of frequency of risk and
magnitude of risk and the audit plan will prioritize audit work to give proportionate
attention to the areas according to magnitude and frequency of the risks.

(x) The internal audit function shall not be outsourced. However, where required,
experts, including former employees, could be hired, with the approval of the Board
of the Bank, on contractual basis subject to the ACB being assured that such
expertise does not exist within the audit function of the bank. Any conflict of interest
in such matters shall be recognised and effectively addressed. Ownership of audit
reports in all cases shall rest with regular functionaries of the internal audit function.

(xi) Measures for Improvement as per guidelines of Ministry of Finance, Govt. of

India, and corrective action plan will be undertaken for revamping, arresting
deterioration, strengthening, fine-tuning and sustaining the different rating categories
of branches.

1.3 Coverage of units under RBIA

0
The Policy covers :

:1
1. All the branches of the Bank including Exceptionally Large Branches
20
/20 342
(ELBs), Very Large Branches (VLBs), Large, Medium and Small branches
located in all the areas viz. Metropolitan, Urban, Semi-urban and Rural,
Large/Extra Large Corporate Branches (ELCBs and LCBs), Mid Corporate
21

Centres (MCCs), PNB Loan Points (RAM/iRAM), International Banking

/08 26

Branches (IBBs), Back Offices {including Regional Collection Centers

(RCCs), Centralised Draft Payable Centers (CDPCs)}, CASA back offices,
Asset Recovery & Management Branches/Asset Recovery Cells
3

(ARMBs/ARCs).

2. Trade Finance Centers (TFC).

3. Overseas Branches including their Back offices.

29

4. International Service Branch (ISB).

5. Currency Chests

The Policy related to audit of Currency chests is issued by the owner Division.
Management Audit of Administrative Offices and Subsidiaries is being conducted as
per Risk Based Management Audit (RBMA) Policy of HO: MARD.
ACB (through ACE) shall have the authority to decide for Risk Based Internal Audit of
any unit other than mentioned above.

1.4 Scope of Risk Based Internal Audit

1 The scope of the RBIA is to identify inherent Business Risk and Control Risk
along with the potential risks in these areas. The primary focus of Risk Based
Internal Audit is to provide reasonable assurance to the Board and Top
Management about the adequacy and effectiveness of the Risk Management and

3
 Confidential – For Internal Circulation Only

Control framework in the Bank‟s operations. While examining the effectiveness

of control framework, the Risk Based Internal Audit report shall also provide
comments on proper recording and reporting of major exceptions and excesses.

2 For any change in Scope of Audit, the CGM/ GM :IAD shall be the competent
authority

1.5 Flow Chart of the RBIA Plan :

Risk Assessment

Business Risk Control Risk

Credit Risk Credit Functions

Non Credit Functions

0
Operational Risk Computer Functions

:1
Earning Risk
20 Compliance
/20 342

Branch Management
General & Security
21
/08 26

On-site
Direction of Risk On-site / Off-site Audit
(Snap Audit for Select Branch)
3

ANNUAL PLAN Frequency of Audit

Prioritzation of Audit Area

Level of Transaction Testing

29

4
 Confidential – For Internal Circulation Only

Chapter 2

Risk Assessment Methodology

Concurrent / Regular Audit of branches is being conducted through audit templates
devised by IAD: HO in consultation with the owner divisions. These templates are
being modified from time to time as and when there is a change in guidelines issued
by bank/ regulator and on the instance of the owner divisions/ other Head Office
Divisions. Head of Internal Audit i.e. CGM, IAD, shall have the authority to approve
modification in audit templates.

Risk Assessment process is solely for the purpose of formulating risk-based audit
plan. The Risk Assessment is to be done on the basis of business risk of an
activity/location and control risk i.e. effectiveness of control systems for monitoring
the inherent business risks.

2.1 Business Risk

0
The Business Risk has been segmented into three components with respective

:1
weightage within the prescribed range as under -
20
/20 342
Weightage Range

Type of Branch Credit Operational Earning

21

Risk Risk Risk

/08 26

Non Specialised Branches 45% - 55% 20% - 30% 20% - 30%

LCB/ MCB/(MSME/RAG)/ 55% - 70% 15% - 30% 15% - 30%
Systemic Important Branch(SIB)/
3

International Banking Branch(IBB)/

AD Branches.

The actual weightage to different components shall be so distributed that the

aggregate of their %ages taken together, does not exceed „100‟. Splitting up of
29

the parameters within the prescribed range and methodology shall form part of
procedural guidelines. Method for allocating marks shall be well defined so as to
minimize element of subjectivity.

At present, Audit templates for Non specialised Branches and LCB/MCB/SIB/AD

Branches Templates have the following Risk Weights under Business Risk.

Business Risk Non specialised Branches LCB/MCB/SIB /AD

Credit Risk 520 670
Operational Risk 280 180
Earning Risk 200 150
TOTAL 1000 1000

5
 Confidential – For Internal Circulation Only

Business Risk Category: The risk category for each parameter/sub-parameter as

well as entire Business Risk shall be arrived at on the basis of percentage marks as
below:-

Low Risk Medium Risk High Risk

Upto 30% >30% to 60% >60%

2.2 Control Risk

The Control Risk comprising of three main segments shall be bifurcated into five
components with respective weightage within the prescribed range as under :–

Range Weightage
Credit Functions 25% - 35%
Operations Management
50% -65% Non Credit Functions 15% - 25%
IT Functions 10% - 15%

0
Compliance 20% - 30% - -

:1
General 8% - 10%
Branch Management 15% - 20%
20 Security 7% - 10%
/20 342

The actual weightage to different components shall be so distributed that

the aggregate of their %ages taken together, does not exceed „100‟. Further
21
/08 26

splitting of the parameters within the prescribed range and methodology shall
form part of procedural guidelines. Method for allocating marks shall be well
defined so as to minimize element of subjectivity.
3

Control Risk Category: The risk category for each parameter/sub-parameter as

well as entire Control Risk shall be arrived at on the basis of percentage marks
as below:
29

Low Risk Medium Risk High Risk

Upto 30% >30% to 50% >50%

2.3 Overall Risk

Overall Risk shall be arrived at as combination of Business Risk and control Risk
by way of risk matrix as given below:

High High Very High Extremely High

BUSINESS

Medium Medium High Very High

RISK

Low Low Medium High

Low Medium High
CONTROL RISK

6
 Confidential – For Internal Circulation Only

Thus, there shall be 5 categories of Overall Risk as under

S.No. Business Risk Control Risk Overall Risk

1. Low + Low = Low
Low + Medium =
2. Medium
Medium + Low =
Low + High =
3. Medium + Medium = High
High + Low =
Medium + High =
4. Very High
High + Medium =
5. High + High = Extremely High

2.4 Exceptions to Overall Risk

0
a) In case, Quick Mortality cases reported in a Branch are either above

:1
Rs. 5 Crore or 20% of the total number of loans and advances sanctioned
between the last two regular audits, the Branch shall be straightaway
20
/20 342
categorized as Minimum “High Risk”, with direction of risk as “Stable‟,
irrespective of the Overall risk calculated as per 3x3 matrix.
21

b) Any Branch reporting incident of Fraud, originating from Branch/involving staff

/08 26

posted at Branch during the review period shall be categorized as Minimum

“High Risk” with direction of risk as “Stable” irrespective of the Overall risk
calculated as per 3x3 matrix.
3

2.5 Specialised Branches / Offices

To suit the requirement of Specialised Branches / Offices or Units like ELCBs/LCBs /
MCCs/ PLPs/ IBBs, International Service Branch (ISB), ARMBs/ARCs, Back Offices,
MICR Centers, their formats have been developed individually. In case of Branches
29

viz. LCBs, MCCs, PLPs & IBBs etc. the risk assessment shall be done on the basis
of both – Business Risk and Control Risk as per the risk methodology referred in the
policy. However, in case of other Offices / Units functioning as Service Branches /
Offices viz. ARMBs, Back Offices including CASA back offices, etc., the risk
assessment shall be done only on the basis of Control Risk. Further, in case of these
specialized branches/offices, the weightage range for the various Business & Control
Risk components may be suitably modified to match with their specific functions, with
minimization of subjectivity.

2.6 Change/ Modify Risk Weightage Range

Risk weightage range of any type of risk in any of the RBIA templates, shall strictly
be in accordance with the provisions of RBIA Policy. The authority to change/ modify
risk weightage range in any of the RBIA template shall rest with Inspection & Audit
Division, Head Office

7
 Confidential – For Internal Circulation Only

Chapter 3

Direction of Risk
The direction of the risk is ascertainable by comparing the risk assessment results of
a branch at various intervals. For onsite audit, direction of risk would be known
through quarterly/regular audit reports in case of concurrent audit branches and by
comparing two off site audits or first offsite audit with regular audit in respect of non-
concurrent audit branches.

3.1 Off-Site Audit

The Off-site audit shall be done in case of Non-Concurrent audit branches only
since in case of Concurrent Audit branches, On-site audit is conducted continuously.
The Off-site audit will be conducted at the following periodicity based on the “Branch
Details & Data‟ and “Self -Assessment Parameters(SAP)” contained in “Off-site Audit
Format” and submitted by Branches to their Circle Offices (COs) and then after

0
verification by COs to respective Zonal Audit Offices(s) (ZAOs) .

:1
1. Extremely High, Very High and High Risk branches
20 Quarterly
/20 342
Low/Medium Risk branches with credit portfolio of
2. Quarterly
Rs. 25 Crore & above
3. Other Low/ Medium Risk branches Half Yearly
21
/08 26

Parameters for Off-site audit shall be suitably selected. Business Risk parameters of
off-site audit shall be same as taken in On-site Audit (except parameters which may
not be relevant for quarterly/half-yearly off-site audit) since these parameters are
3

based on statistical data of the branch. However, Off-site Control Risk parameters
shall contain only those crucial parameters which are necessary for off-site
assessment of Risk and can be assessed on the basis of “Self-Assessment
Parameters(SAP)” submitted by Branch and verified / certified by Circle Offices
(COs) as well as additional information available with COs and ZAOs. The Overall
29

Risk shall be determined on the basis of Business Risk and Control Risk by way of
matrix in same manner as described in policy.

3.2 (A) On-site Snap Audit

(i) Head of Zonal Audit Office may take a view on conducting of on-site Snap Audit
in the following circumstances :-

a) Two consecutive off-site audits show the direction of risk as increasing: or

b) An off-site audit shows the risk direction increasing by two notches
compared to the previous risk assessment: or
c) Any major deviation/incident as reported in special report which could
seriously affect the working of the branch: or
d) On receipt of any alarming information/report: or
e) Occurrence of frauds/suspicious transactions

8
 Confidential – For Internal Circulation Only

(ii) Snap Audit shall invariably be conducted in the following cases :

a) On directives of Head Office Divisions on the basis of irregularities brought

to their notice.

b) At the behest of Circle Head, where an official posted in a branch,

exercising loan sanctioning powers, tenders resignation/ opt for VRS. The
Snap audit shall cover entire tenure of such official after the last regular
audit of the branch. In case the next regular audit of the branch is falling
due in the next three months from the date of tendering resignation of the
official, the competent authority may take a decision to prepone the regular
audit of the branch instead of conducting snap audit.

(iii) Duration of on-site snap audit shall be 1 to 3 days depending upon the size of
the branch, category of risk, direction of the risk and areas to be
covered in snap audit.

0
(iv) Only those areas shall be covered in snap audit which show direction towards
high risk in off-site audit.

:1
3.2 (B) Segment Audit 20
/20 342

Zonal Audit Office, at the instance of Head Office Divisions, Zonal Manager, Circle
Head and on receipt of any alarming information, may take a view on conducting of
21

specific segment audit on the basis of risk perception in that particular segment,
/08 26

wherever deemed necessary. For example, high concentration / sudden spurt in

housing loans in a branch may call for an audit of housing loan portfolio of the
branch or delinquencies in car loans in a particular geographical area may call for an
3

audit of car loan portfolio in all the branches of that particular geographical area.

3.3 Determination of trend/direction of risk for both Inherent Business risk

and Control risk :
29

On-site Audit
The direction of risk would be determined by comparison of risk profile of a branch at
various intervals. In case of Concurrent Audit Branches, direction of risk would be
known through Quarterly/Regular audit reports.

Off-site Audit
In case of Non-Concurrent Branches, direction of risk would be known by
comparing two off-site audits and in case of first off-site audit regular audit would be
compared. The Off-site audits shall solely be used for determining the direction of
the risks. For all other purposes (like risk rating of the branch, follow up and removal
of irregularities etc.) the last annual risk assessment shall be used.

The inherent business risks and control risks should be analysed with a view to
assess whether these are showing a stable, increasing or declining trend. This can
be done when the risk assessment has been done for two or more periods. The
trend in matrix, as shown below will be used to identify the trend/direction separately

9
 Confidential – For Internal Circulation Only

for inherent business risks and control risks. The same matrix will then be used to
plot the trend/direction for Overall Risk of the branch.

OVERALL RISK

Increasing Increasing Increasing Increasing

INHEREN

BUSINES

RISKS
S Stable Stable Stable Increasing
T

Decreasing Decreasing Stable Increasing

Decreasing Stable Increasing
CONTROL RISKS

Variation of percentage marks in the same level up to +3% or –3% will be considered
as STABLE. Variation of marks in the same level more than +3% or –3% will be
considered as INCREASING/DECREASING as the case may be.

:1 0
3.4 Risk Assessment Ratings
Based on the level and direction of risk, the Risk assessment ratings could be any of
20
/20 342
the fifteen as shown below:

Overall Risk Direction

21

Extremely High Risk Decreasing/Stable/Increasing

/08 26

Very High Risk: Decreasing/Stable/Increasing

High Risk: Decreasing/Stable/Increasing
3

Medium Risk: Decreasing/Stable/Increasing

Low Risk: Decreasing/Stable/Increasing
29

10
 Confidential – For Internal Circulation Only

Chapter 4
Annual Audit Plan
The Annual Audit Plan shall be based on the overall risk profile of the
Branches/Offices and not merely on the volume of the business.

4.1 Audit of a Branch/Office shall be decided on the basis of previous Annual risk
rating and the direction of the risk as determined by last off-site audit of the
branch, wherever applicable.

4.2 Emphasis on various areas/activities/processes/products/business lines during

the next audit shall be given in proportion to the risk level of that area as
suggested by previous audit and Off-site audit.

4.3 Duration of the audit shall be determined by Inspection & Audit Division based
upon the risk level & direction of the Branch/Office.

0
4.4 Compliance Audit shall be conducted in at least 10% of non-concurrent audit
Branch/Office every year.

:1
4.5 Frequency of audit shall be determined as per schedule given below:
20
/20 342

4.6 Audit Schedule

21

Frequency of
Overall Risk Category Direction
/08 26

Audits (Months)
„Extremely High‟ / „Very
Any direction 6
High‟
3

„High‟ Any direction 6-9

„Medium‟ Increasing 9 -12
„Medium‟ Stable/Decreasing 12-15
„Low „ Increasing 12-15
„Low‟ Stable/Decreasing 15-18
29

4.7 Annual Audit Plan

(i) The annual audit plan shall be prepared based on above guidelines.
(ii) Specific segment audit may also be undertaken on the basis of risk category
of that particular area. For example, high concentration/ sudden spurt in
housing loans in a branch may call for audit of housing loan portfolio of the
branch.
(iii) Likewise, geographical area wise audit may be conducted, wherever deemed
necessary.
(iv) The annual plan shall be dynamic as it has to be reviewed on quarterly basis
in the light of the level & direction of the risk determined by offsite audits.
(v) The annual audit plan shall be submitted to ACE and ACB at the beginning of
the financial year for approval.

11
 Confidential – For Internal Circulation Only

Chapter 5

Audit Methodology

The frequency of audit and allocation of audit resources are to be determined on the
basis of Risk Profile of the Branch /Office. Further, the following aspects of the audit
methodology shall also be based on the risk level of various areas :

a) Prioritization of audit areas

b) Level of transaction testing,
c) Level of compliance testing, etc.

The methodology of audit shall include the following:

(i) Identification of high risk areas and suggestions for mitigating risks in these
areas.
(ii) Identification of potential risk areas and suggestions for pro-active preventive

0
measures.

:1
(iii) Reasons for upward increase in direction of risk in various areas.
(iv) An action plan for mitigation of identified risks.
20
(v) Comments on sample testing methodology adopted by the auditor wherever
/20 342

there is a waiver of 100% transaction testing.

(vi) SWOT Analysis & Risk Awareness on Potential Risk Areas & suggestions for
Pro-Active Preventive Measures.
21
/08 26

5.1 Prioritization of Audit Areas

The Bank shall decide the priority of audit on the basis of degree of risk involved in
3

various areas. The degree of risk in a particular area shall be determined on the
basis of frequency as well as magnitude of default by way of following matrix.

HIGH High Magnitude High Magnitude High Magnitude

29

Low Frequency Medium Frequency High Frequency

MAGNITUDE

MEDIUM Medium Magnitude Medium Magnitude Medium Magnitude

Low Frequency Medium Frequency High Frequency

LOW Low Magnitude Low Magnitude Low Magnitude

Low Frequency Medium Frequency High Frequency

LOW MEDIUM HIGH

FREQUENCY

12
 Confidential – For Internal Circulation Only

The Audit Plan will prioritize audit work to give greater attention to the areas of :

(i) High magnitude & high frequency

(ii) High magnitude & medium frequency
(iii) Medium magnitude & high frequency
(iv) High magnitude & low frequency
(v) Medium magnitude & medium frequency

5.2 Level of transaction testing

In Risk Based Internal Audit System, minimum sample testing shall be done in
Medium/low risk areas as detailed below. In High risk areas or in case sample
testing reveals unsatisfactory features, 100% transaction testing is to be done. The
direction of risk is also to be taken into account while deciding the level of transaction
testing.
Minimum level of transaction testing will be as follows:

:1 0
Overall Risk Category Direction Minimum Level of
20 transaction testing
Extremely High / Very High Increasing/Stable/Decreasing 100%
/20 342

High Increasing/Stable 80%

High Decreasing 70%
Medium Increasing/ Stable/ Decreasing 50%/40%/30%
21

Low Increasing/ Stable/ Decreasing 40%/30%/20%

/08 26

High risk areas are to be covered by 100% transaction testing irrespective of level or
3

direction of risk. The business activities shall, therefore, be divided into different
categories as per risk exposure.

The above stipulations shall allow relaxation in 100% transaction testing to a limited
extent only. Based on the results of above relaxation, the Bank shall review the
system annually and modify the level of transaction testing, if necessary.
29

5.3 Compliance Audit

1. At least 10% of Non-Concurrent Audit Branches shall be identified by
respective ZAOs every year for conducting compliance audit to ascertain the
actual status of compliance.
2. The branches shall be identified from all the risk categories viz. Low, Medium,
High, Very High and Extremely High.
3. Procedure to be followed to identify branches, from all the risk categories viz.
Low, Medium, High, Very High and Extremely High, for conducting
compliance audit, is explained hereunder:

(i) Out of total number of branches identified for conducting compliance audit.
Compliance audit shall be conducted in all the branches rated as „High
Risk‟, „Very High Risk‟ and „Extremely High Risk‟ during the previous
financial year.

13
 Confidential – For Internal Circulation Only

(ii) 80% of the remaining branches {after (i) above} should identified from
branches rated as „Medium Risk‟ during the previous financial year.

(iii) Remaining branches {after (ii) above} should be identified from branches
rated as „Low Risk‟ during the previous financial year.

The duration of compliance audit shall be as under:-

Low Risk Branches 1 day

Medium Risk Branches 1 day
High Risk Branches 2 days
Very High & Extremely High Risk Branches 3 days

Non compliance of audit findings/irregularities will be discussed / deliberated upon in

Circle Level Audit Committee (CLAC)/ Zonal Audit Committee of Executives (ZACE)

0
meetings and will be escalated to the GM :IAD for placing significant audit findings
before Audit Committee of Executives (ACE) / Audit Committee of Board (ACB).

:1
Outstanding non-complied items, if any, in previous Audit Report should be carried
20
over in the current audit report awarding high risk by the auditor and a certificate to
/20 342

this effect should be submitted along with the report.

Findings of compliance audit shall be placed before the Audit Committee of the
21

Executive / Audit Committee of the Board, along with the action taken, in respect of
/08 26

those branches where false reporting of compliance has been observed.

29 3

14
 Confidential – For Internal Circulation Only

Chapter 6

Number of Days Allowed for conducting Regular Audit

6.1 Branches other than Concurrent Audit branches

Category of Average Aggregate Business Figures No of working days

Branch
Business Upto Rs. 10 cr 6
Small
Business Above Rs.10 cr. 8
Advances Upto 10 cr. 10
Medium
Advances above Rs 10 cr. 12
Advances Upto 10 cr. 14
Advances more than Rs 10 cr.and upto 25 cr 16
Large Advances more than Rs 25 cr.and upto 40 cr 20
Advances more than Rs 40 cr.and upto 50 cr 22

0
Advances more than Rs 50 cr. 25

6.2 Concurrent Audit Branches

:1
20
/20 342

Category of Branch No of working days

Large 12
21

VLB 15
/08 26

ELB 20
29 3

15
 Confidential – For Internal Circulation Only

Chapter 7

Submission & Closure of Audit Reports

7.1 Submission of Audit Reports

The Inspecting Official /Auditor will submit various Audit Reports to different offices /
authorities as under :

Reports to be submitted Authority/ Office to which reports to be submitted

Regular Audit Reports Zonal Audit Office under copy to Branch Office &
Circle Office/ Zonal office

Regular Audit Reports of HO: IAD under copy to Branch Office & Circle
Foreign Branches, Back Office/Zonal Office
Office of Foreign

0
Branches, Trade Finance

:1
Centers (TFCs)
20
Note : In case of International Service Branch (ISB), Overseas Branches, Back
/20 342
Office of Foreign Branches and TFCs a copy of Report will also be made
available to International banking Division (IBD), Head Office. In case of
currency chests a copy of report will also be made available to Govt. Business
21

Division: HO.
/08 26

7.2 Rectification of Irregularities

3

(i) Irregularities pointed out in Audit Reports be rectified expeditiously by

the branches and compliance thereof should be submitted to
concerned ZAO / Inspection & Audit Division, Head Office for closure of
the Audit Reports within stipulated time period.
(ii) It should be the endeavor of the Circle Head/Zonal Head and the
29

officer in charge of the Inspection and Audit vertical at Circle

Office/Zonal Office, as the case may be, to get the inspection reports
closed within prescribed time. However, if, despite their best efforts,
irregularities could not be rectified, the reasons for non-rectification
should be analysed and all the outstanding irregularities of the previous
audit reports, should invariably be incorporated in the latest Regular
Audit Report. Further, in case, an unrectified irregularity of an audit
report gets carried over beyond two inspection reports, the information
regarding the same shall be placed before Audit Committee of
Executives.
(iii) Compliance of the irregularities contained in the Quarterly/Regular
Audit Reports of the branches under concurrent audit shall be vetted by
the concurrent auditor for taking a final view by the competent authority
for Mark Off/ Dropping/ Closure of Audit Reports, etc.

16
 Confidential – For Internal Circulation Only

(iv) In case, irregularities in FSI/ ZTL items, as defined in audit templates

(eRBIA and eTHIC) are not rectified within prescribed time for closure
of inspection report of a branch, the Circle Head shall seek an
explanation from the concerned branch. If the explanation submitted by
the concerned branch is found to be satisfactory, Circle Office may
recommend for dropping of the FSI/ZTL item to Zonal Audit Office.
However, if the Circle Head feels that the irregularities cannot be
rectified due to ab initio mistakes, violating terms and conditions of
sanction and could jeopardize bank‟s interest, he may consider
initiating appropriate staff side action (including administrative action)
against the erring official and complete the same in a time bound
manner. Zonal Office to also monitor the same. In case of offices,
directly reporting to Zonal Office/ Head Office, explanation from the
branch will be sought by the Zonal Office or the respective Head Office
Division and further action will be taken accordingly.

7.3 Closure of Audit Reports

0
Competent authority and prescribed time period for closure of audit reports is as

:1
under:
S.No. Audit Report Prescribed
20 Competent Authority for
/20 342
Period for Closure of Audit Reports
Closure of
Audit Reports
21

a) Regular Audit Within one & half Zonal Audit Office

/08 26

Reports of Small and month from the

Medium branches. date of i) Closure of Audit Reports of
finalization of the all ELCBs/ LCBs / MCCs /
3

report. iRAM / RAM / ELBs / VLBs / by

b) Regular Audit Within 2 months Incumbents of ZAO.
Reports of Large from the date of
branches and other finalization of the ii) Branches below the
Specialized Offices report. category of VLBs by Second
e.g. RCCs, CDPCs, Man i.e. AGM.
29

ZTCs, ARMBs, Back

Offices etc.
c) Regular Audit Within 3 months
Reports of ELCBs from the date of
/LCBs /MCCs / iRAM finalization of the
/RAM /VLBs / ELBs / report.
including IBBs
d) Regular Audit Within 3 months Inspection & Audit Division
Reports of, Foreign from the date of Head Office
Branches, Back finalization of the
Office of Foreign report.
Branches, Trade
Finance Centers
(TFCs)

17
 Confidential – For Internal Circulation Only

e) Currency Chest Within one & half Circle Head under whose
month from the jurisdiction the currency chest
date of is functioning, shall be the
finalization of the competent authority to take a
report. view on dropping of
irregularities and closure of
inspection reports of currency
chest.

Important : A regular audit report shall be treated as closed, on 100%

dropping/ rectification of irregularities in FSI (Fraud Sensitive
Index), ZTL (Zero Tolerance Level), KRI (Key Risk Indicator) items
and Significant Audit Findings (as defined in the policy) and at
least 75% rectification/ dropping of other irregularities reported in
the audit report.

:1 0
20
/20 342
21
/08 26
3
29

18
 Confidential – For Internal Circulation Only

Chapter 8

Miscellaneous Provisions
(i) Position of Legal Audit shall invariably be discussed in CLAC and
ZACE. No report, whether Concurrent Audit Report or Regular audit
Report shall be closed without rectification of irregularities reported in
Legal Audit Report.

(ii) Zonal Audit Office shall submit significant audit findings of regular audit
report of every branch to the concerned Circle Head and Zonal Head,
within 10 days of receipt of the report.

(iii) Significant audit findings of all Authorised Dealer (AD) branches and
Trade Finance Centers (TFCs) shall be submitted by ZAO to HO:IAD
for further submission to GM: Treasury Division and GM: International
Banking Division, within 10 days of receipt of the report.

0
(iv) Position of Regular Audits conducted and status of closure of reports

:1
shall invariably be placed to ZACE as a regular agenda item.
20
/20 342
(v) Significant audit findings of Regular Audit mentioned hereunder shall
be placed before Audit Committee of Board on quarterly basis.
21

1. Insurance not available, valid policy not held on record.

/08 26

2. KYC norms not adhered to / spot verification of borrower‟s /

guarantor‟s place of business/ residence not done/
3. Working Capital limits not renewed/ reviewed within due date.
3

4. Genuineness/non encumbrance of title deeds of the IPs to be

mortgaged not ensured.
5. Equitable mortgage created has not been registered with Central
Registry within stipulated time.
6. CIBIL/ Credit Information Companies (CICs) records not verified.
7. Bank‟s charge not registered with the Registrar of Companies within
29

stipulated time.
8. Branch does not tally / reconcile Clearing Imprest/office accounts/
internal accounts as prescribed.

19
 Confidential – For Internal Circulation Only

Chapter 9

Change Management

9.1 Vertical Head of Internal Audit

Supervision shall be a continuing process, beginning with planning and ending with
the conclusion of the audit assignment.

The Head of Internal Audit shall directly report to either the Audit Committee of the
Board (ACB) / MD & CEO or Whole Time Director (WTD). Should the Board of
Directors decide to allow the MD & CEO or a WTD to be the 'reporting authority' of
the HIA, then the 'reviewing authority' shall be with the ACB and the 'accepting
authority' shall be with the Board in matters of performance appraisal of the Head of
Internal Audit. Further, in such cases, the ACB shall meet the Head of Internal Audit
at least once in a quarter, without the presence of the Senior Management, including

0
the MD & CEO/ WTD. The Head of Internal Audit shall not have any reporting
relationship with the business verticals of the bank and shall not be given any

:1
business targets.
20
/20 342
The Vertical Head (IAD :HO) –

a) Shall be responsible for allocation of all internal audit assignments.

21

b) Shall inform ACE/ACB the migration of the ratings of branches on Annual

/08 26

basis.
c) Shall be responsible for providing appropriate audit supervision which shall
include:-
3

(i) Providing suitable instructions to subordinates at the outset of the audit;

(ii) Ensuring that the approved audit program is carried out unless deviations
are justified and authorized;
(iii) Determining that audit working papers adequately support the audit
findings, conclusions and reports and audit objectives are met.
29

9.2 Manpower Planning / Audit Resources

The Inspection & Audit Division shall be equipped with adequate qualified/skilled
and experienced staff to undertake Risk Based Internal Audit, processing the audit
reports, analyse and put up requisite MIS to the Top Management and Audit
Committee of the Board. The Audit Resources shall be deployed as per the nature
and operations of the respective branch vis-a-vis adequate qualification/skill and
experience of the auditor.

9.3 Training

a) The Inspection officials including and concerned officials at Head Office shall
be imparted training for improving inspection skills and other inspection
related subjects at Staff Training Colleges or other outside specialized training
institutes.

20
 Confidential – For Internal Circulation Only

b) The HO (IAD) shall formulate a plan for ongoing training to the auditors to
update them on the RBIA/eRBIA as well as Risk Management concepts, thus
enabling them to carry out audit efficiently.

c) The HO (IAD) in consultation with Staff Training Colleges shall prepare

training models for the purpose.

d) Besides the Inspecting Officials, training to the field functionaries shall also be
provided on on-going basis.

9.4 Roles and Responsibilities

 The role of auditors shall continue to be identification of potential risks and

suggesting measures for mitigation thereof.

 Though the primary responsibility of compliance and rectification shall lie with
the Branch Incumbent, the Controlling Offices shall also be responsible for

0
persistent high risk rating of the branches under their jurisdiction.

:1
 The performance of the auditing officials shall be adjudged on the basis of
quality of the audit report and achievement of objectives of the audit.
20
/20 342

 The risk ratings of the branches shall also be taken into account while
finalizing the risk rating of the concerned controlling office.
21
/08 26

9.5 Review and Revisions

 This Policy shall be reviewed annually.

3

 Any emergent amendments in this policy / operational guidelines be approved

by ACE and same shall be subsequently placed to next ACB for ratification.
Further, such modifications / amendments made in the policy during the year
be informed to the Board along with annual review of this Policy.
29

The Policy conforms to extant regulatory and statutory guidelines.

***********

21