Bank Audit & Inspection
(Who Checks the Bank’s Homework? — The Multiple Layers of Audit!)
A bank handles CRORES of public money every day. Who makes sure it’s all correct, legal, and safe? AUDITORS! But not just one type — banks face MULTIPLE audits: concurrent, internal, statutory, IS audit, forensic, management, and tax audit. Each has a different purpose, different people, different frequency. This chapter covers them all.
Banky Meets the Auditors! 🕵️
Banky noticed different people coming to the branch with files and laptops. Monday: concurrent auditor. Wednesday: internal audit team. Friday: statutory auditor. He’s confused — “Why so many auditors?! Are we doing something wrong?” His manager laughs: “No Banky, this is NORMAL. Banks get audited by MULTIPLE teams at DIFFERENT levels. It’s how we stay safe!”
Why is This Important?
Exam
3–5 questions! Types of audit, who conducts, RBIA, LFAR, CAATs, concurrent vs statutory, HIA reporting line. Very scoring!
Daily Work
Concurrent auditors visit DAILY. Internal audit happens periodically. You need to keep records ready and answer queries.
Career
If you become a branch manager, you’re responsible for ALL audit compliances. Understanding audit = better manager!
The Full Chapter — All Audit Types Explained Simply
🔍 Part 1 — What is Audit? (The Basics)
Audit = A systematic examination of the books of account and records of a business to confirm that: (a) financial statements are TRUE and FAIR, (b) accounting has been done properly, (c) regulatory rules have been followed, and (d) no frauds or errors exist.
Key points from the textbook: The main objective has shifted from just checking ARITHMETICAL accuracy to confirming that statements show a “true and fair view” of the financial position. Audit is now done “THROUGH the computer” (not just “around” it). CAATs (Computer Aided Audit Techniques) are standard. The auditor can only express an OPINION — they can’t check every single transaction. Non-monetary facts (like employee morale) can’t be audited.
Companies Act, 2013 — Chapter X: Covers appointment of auditors, eligibility, qualifications, disqualification, removal, resignation, remuneration, powers, and duties.
Banking Regulation Act, 1949 — Section 30(1): Mandates that the Balance Sheet and P&L of every banking company must be audited.
📋 Part 2 — RBIA: Risk-Based Internal Audit
RBI introduced RBIA vide circular dated December 27, 2002 (supplemented January 07, 2021) for all Scheduled Commercial Banks. It’s a MAJOR shift from the old way of auditing.
Old way: Check every transaction, test accuracy of every record — “transaction testing.” New way (RBIA): Focus on RISKS. Which areas are risky? Are controls adequate? Is risk management effective? Prioritise audit resources based on risk level. It’s not about auditing risks — it’s about auditing the MANAGEMENT of risk.
RBI’s key requirements for Internal Audit:
(a) Authority & Independence: Head of Internal Audit (HIA) must be a senior executive with independent judgment. Must have access to ALL records and ANY staff member.
(b) Competence: Internal auditors need skills in banking operations, accounting, IT, data analytics, forensic investigation.
(c) Staff Rotation: Board prescribes minimum period of service in audit function.
(d) HIA Tenure: Minimum 3 years (preferably).
(e) Reporting Line: HIA reports to Audit Committee of the Board (ACB) or MD & CEO. Must NOT have any reporting relationship with business verticals. Must NOT be given business targets. In foreign banks operating as branches, HIA reports to controlling office/head office.
Standards: Banks encouraged to adopt International Internal Audit Standards by Basel Committee on Banking Supervision (BCBS) and Institute of Internal Auditors (IIA).
🏦 Part 3 — Types of Bank Audits (The Big 7!)
1️⃣ CONCURRENT AUDIT: The “early warning system.” Aims to shorten the gap between a transaction and its examination. Conducted DAILY or very frequently. Like having a teacher check your homework EVERY day! RBI revised guidelines vide circular dated September 18, 2019. Covers: coverage, appointment, accountability, tenure, remuneration, reporting, effectiveness review.
2️⃣ INTERNAL AUDIT / IS AUDIT: Conducted by bank’s OWN staff and CA firms. Ensures accuracy and correctness of books. Focuses on fraud detection, errors, omissions, irregularities. Information Systems (IS) Audit = auditing the TECHNOLOGY — CBS, internet banking, cybersecurity. Uses CAATs. CISA-qualified professionals form separate IS Audit teams. IS audit = essential part of internal audit in the CBS era. Branch managers submit monthly compliance of IS audit DO’s and DON’Ts. Standard on Internal Audit (SA) 14 by ICAI covers IT environment procedures.
3️⃣ STATUTORY AUDIT: Conducted by a Statutory Auditor (external CA firm). MANDATORY under Banking Regulation Act Section 30(1). Not just checking transactions (that’s concurrent/internal audit’s job). Statutory audit looks at: loans, advances, NPA classification, PSL compliance, CRR, SLR, CRAR, and all statutory norms. Issues: (a) Statutory Audit Report (SA 700/705/706 by ICAI), (b) Long Form Audit Report (LFAR) — as per RBI guidelines (format revised September 05, 2020), (c) Tax Audit Report (Income Tax Act, 1961). 17 stages of statutory audit including materiality assessment, going concern evaluation, fraud risk (including money laundering), Basel III conformity, NPA classification (borrower-wise, not facility-wise).
4️⃣ REVENUE AUDIT: Specifically checks if the bank has correctly earned all income and properly accounted for all expenses. Stock and receivables audit — usually only LARGE borrower accounts. Ensures no revenue leakage.
5️⃣ FORENSIC AUDIT: Examination of financial information for use as EVIDENCE IN COURT. Determines whether fraud actually occurred, names the persons involved, checks if business value has been manipulated in the financial statements. Forensic = for LEGAL proceedings.
6️⃣ MANAGEMENT AUDIT: Assesses the MANAGEMENT itself — their methods, policies, strategic planning, use of resources, employee development. Checks if management objectives are being met. Evaluates management EFFICIENCY, not just financial accuracy.
7️⃣ TAX AUDIT (incl. GST): Analyses tax returns to check if income tax payment is correct. Statutory auditors of banks usually handle taxation and GST provisions.
Exam-Ready Points
🎯 Must Remember!
- Audit = Instrument of financial control. Ensures “true and fair view.” Not just arithmetical accuracy.
- Companies Act 2013, Chapter X: Appointment, eligibility, powers, duties of auditors.
- Banking Regulation Act, Section 30(1): BS and P&L of banks MUST be audited.
- RBIA: Risk-Based Internal Audit. RBI circular Dec 27, 2002 (supplemented Jan 07, 2021). Focus on risk MANAGEMENT, not just transactions.
- HIA (Head of Internal Audit): Senior executive. Reports to ACB or MD/CEO. NO business targets. Minimum tenure = 3 years preferably.
- HIA must NOT: Have reporting relationship with business verticals. Be given business targets.
- In foreign banks: HIA reports to controlling office/head office.
- Concurrent Audit: Early warning system. DAILY/frequent. RBI guidelines Sept 18, 2019. Shortens gap between transaction and examination.
- Internal Audit: By bank’s OWN staff (and CAs). Ensures accuracy. Fraud detection focus.
- IS Audit: Technology audit. CISA-qualified. CAATs used. SA-14 by ICAI. Part of internal audit post-CBS.
- CAATs = Computer Aided Audit Techniques. Used in critical areas: revenue leakage, treasury, AML, control weaknesses, penetration testing.
- Statutory Audit: By external STATUTORY AUDITOR (CA firm). Mandatory under B.R. Act. Issues LFAR (Long Form Audit Report). Covers PSL, CRR, SLR, CRAR, NPA classification.
- LFAR = Long Form Audit Report. Issued by STATUTORY auditor (not concurrent!). Format revised by RBI Sept 05, 2020.
- 3 Reports by Statutory Auditor: (1) Statutory Audit Report (SA 700/705/706), (2) LFAR, (3) Tax Audit Report.
- NPA classification in statutory audit: Should be BORROWER-wise, NOT facility-wise.
- Revenue Audit: Checks income and expenses. Stock & receivables audit — large borrower accounts only.
- Forensic Audit: For COURT evidence. Determines if fraud occurred. Names persons. Checks manipulated values.
- Management Audit: Assesses management efficiency, policies, strategic planning. NOT always conducted by management itself!
- “Management audit is ALWAYS conducted by the management of the bank” = INCORRECT (exam trap!)
- Primary objective of financial audit = Ensure TRUE and FAIR view of financial statements
- Auditor limitations: Can only express opinion. Depends on explanations from others. Can’t audit non-monetary facts. Can’t check every transaction (uses sampling).
📝 Past Exam Questions
Memory Tricks
🧠 Trick 1 — 7 Types of Audit
C = Concurrent (daily check) 📋
I = Internal (own staff) 👥
S = Statutory (external CA) 📝
R = Revenue (income check) 💰
F = Forensic (court evidence) 🕵️
M = Management (efficiency) 📊
T = Tax/GST (returns) 🧾
🧠 Trick 2 — LFAR
L = Long
F = Form
A = Audit
R = Report
Issued by STATUTORY auditor only!
🧠 Trick 3 — RBIA
Old: Check EVERY answer
New: Check WHERE cheating is likely!
Focus on RISK MANAGEMENT,
not just transactions!”
🧠 Trick 4 — HIA Rules
Reports to: ACB or MD/CEO 📊
NO business targets! 🚫
NO business reporting line! 🚫
Tenure: 3 years minimum ⏰”
🧠 Trick 5 — Concurrent vs Statutory
(checks transactions as they happen)
Statutory = ANNUAL board exam 📋
(checks overall compliance, PSL, CRR, NPA)
Both are different! Don’t confuse!
🧠 Trick 6 — Forensic Audit
Did fraud happen? YES/NO
WHO did it? Names!
HOW MUCH was stolen? Amount!
Like CSI for banks!” 🔍
🧠 Trick 7 — CAATs
Recalculate interest
Test controls
Extract samples
Penetration testing
Revenue leakage detection!”
🧠 Trick 8 — Exam Traps!
= ❌ WRONG! (Can be external!)
“LFAR by concurrent auditor”
= ❌ WRONG! (By STATUTORY!)
“Primary objective = error detection”
= ❌ WRONG! (= True & Fair view!)
The Whole Chapter in One Picture
Last-Minute Flash Cards
⚡ Chapter 11 Done! 🎉 MODULE A COMPLETE!
- Audit: Systematic examination for “true and fair view.” Now done “through” computers using CAATs.
- 7 Audits (CISFR-MT): Concurrent (daily), Internal (own staff), Statutory (external CA), Revenue, Forensic, Management, Tax.
- RBIA: Risk-Based Internal Audit. Audit the management of risk, not just transactions. RBI mandate since 2002.
- HIA: Reports to ACB/MD. Independent. No business targets. Min 3 years tenure.
- Statutory Audit: Mandatory (B.R. Act S.30). Issues LFAR + Audit Report + Tax Report. NPA = borrower-wise.
- Forensic Audit: Court evidence. Fraud investigation. Names culprits. Like CSI for banks!
- Exam Traps: LFAR = statutory only. Primary objective = true & fair (not error detection). Management audit ≠ always by management.
CONGRATULATIONS! MODULE A — ALL 11 CHAPTERS COMPLETE!
From “What is Accounting?” all the way to “Bank Audit & Inspection” — you’ve mastered the ENTIRE accounting foundation. Banky is now a certified accounting pro! 🌟
Banky says: “7 audits = 7 doctors for my bank! CISFR-MT! LFAR = Statutory only! RBIA = Smart audit! MODULE A DONE — I’m ready for the exam!” 🎉🏆📚
You’ve completed ALL 11 chapters of AFM Module A — Accounting Principles. Time to move to Module B! 💪