Bank Audit: Key Considerations
Bank Audit: Key Considerations
Legal Framework
Principal enactments governing functioning of bank are:
o Companies Act,2013
o Banking Regulation Act, 1955
o Prevention of Money Laundering Act, 2002
o RBI Act 1934
o SBI Act 1955
o Information Technology Act, 2000 etc..
Conduct of Audit
1. Initial Considerations
o Acceptance & Continuance: Assessing engagement risk prior to acceptance.
o Declaration of Indebtness: Written confirmation that credit facilities obtained by auditors & their
family members have not been declared wilful defaulters by any bank/financial indebtness.
o Internal Assignments in Banks by Statutory Auditors: Not take stat audit assignment if associated
with internal audit assignment
o Terms of Audit Engagements: As per SA 210, agree terms of engg before beginning fieldwork
o Communication with Previous Auditor: As per Clause 8 of Part I of First Schedule of CA Act 1949
o Planning: Documenting NTE of audit procedures & flexible to make changes
o Establish Engagement Team: Qualified & experienced professionals to manage engg. risk
2. Understanding
o Understanding the Bank and Its Environment including Internal Control
o Understand Bank’s Accounting Process
o Understanding Risk Management Process
✓ Oversight by TCWG: They should approve risk mgt policies consistent with bank’s objectives,
strategies, regulatory requirement etc
✓ Identification, Measurement and Monitoring of Risks: Risks should be identified, measured &
monitored against pre-approved limits & criteria
✓ Control Activities: Segregation of duties, verification & approval of transactions, physical security
✓ Monitoring Activities: Conducted by independent risk mgt unit
✓ Reliable information systems: That provide adequate compliance, financial & operational info
3. Risk Assessment
o Identifying and assessing ROMM: As per SA 315, Identifying & assessing ROMM at F.S. level &
assertion level for ABCD
o Assess the risk of fraud including Money Laundering: As per SA 240, assess risk due to fraud
o Assess specific risk: ROMM at F level relating to banking industry & use of IT
o Risk of outsourcing activities: Used for reducing costs as well as making use of services of an expert
not available internally but risk associated with it.
4. Execution: Engagement team discussion, Response to assessed risks, Establishing Audit strategy,
Determining audit materiality, Consider Going concern
Note:
o Overall review of IT environment and computerized a/c system has to be taken at HO level.
o Branch auditors don’t have access to IT policy & processes implemented by bank.
o Based upon guidance and info received from SCAs, branch auditors need to ensure that data review
and analysis through CBS is carried out & TOCs & substantive checking of sample transactions is
carried out at branch level & results are shared with SCAs.
Key control aspects that auditor needs to address while undertaking audit in a Computerised bank.
o Ensure authorised , accurate and complete data available for processing
o Ensure in case of power failure → system restarts without affecting completion of entries/records
o Verify access controls of staff working match with responsibilities as per manual.
o Verify segregation of duties ensured while granting system access to users
o Ensure system prevents unauthorised amendments to programme
Data → power failure → access controls → SOD → Prevent unauth. amend + Changes authenticated
Risk-based Internal audit is conducted based upon risk assessment of business & control risks of
branches.
Risk assessment process includes: -
o Identification of inherent business risks in various activities undertaken by branches (Business risk)
o Assessment of effectiveness of control systems for monitoring inherent risks of business activities
of branch (Control risk)
o Making an assessment of level and direction of various risk areas and assess level and direction of
overall business risk and control risk
o Drawing up of risk matrix taking into account factors viz. Risk of branch
Internal Controls
General:
o Staff of bank shifted from one position to another frequently & without prior notice.
o Work of one person should always be checked by another person (Internal check)
o Arithmetical accuracy of books should be proved independently every day.
o All bank forms (e.g. Cheque books, demand draft/pay order books, travelers’ cheques, etc.) should be
kept in possession of an officer & another officer should verify issuance & stock of such stationery.
o Mail should be opened by responsible officer. Signatures on all letters & advices received from other
branches of bank or its correspondence should be checked by officer with signature book.
o Signature & telegraphic code book kept with resp. officers & access allowed only to authorised officers.
o Bank should take insurance policies against loss due to all risks such as fire, natural calamities, theft &
employees’ infidelity.
o Surprise inspection of HO & Branches by Internal Audit Dept
Cash:
o Cash should be kept in joint custody of 2 responsible officers.
o Test-checked daily & counted in full occasionally by a responsible officer other than one handling cash.
o Cashier should have no access to customer’s ledger accounts and Day Book.
o Payments made only after vouchers (e.g. cheques, demand drafts etc) have been passed for payment
o High value cash receipts & payments should be verified by a higher officer/ branch manager
Clearings
• Cheque Truncation System (CTS) implemented by RBI, electronic image of cheque is transmitted to
paying branch through clearing house, along with relevant info. like data on MICR band, date of
presentation, presenting bank, etc. This eliminates associated cost of movement of physical cheques,
reduces time reqd for their collection.
• As per RBI guidelines, branch is required to either call customer or email him for any cheque recd for
amt of 5L & above in respect of inward clearings. Auditor may verify compliance on test check basis.
• Auditor is to check whether sign of drawer of cheque is being verified by staff or not as else there will
be liability of paying bank under all circumstances.
• Unpaid cheques received in outward clearing should be either sent to customers at their recorded
address or customers be informed to collect the same from bank branch.
Bills Purchased
o All documents of title should be assigned to bank
o Sufficient margin → cover decline in value of security
o Unable to collect bill on due date → immediate steps to recover amt.
o Irregular a/c report to H.O.
o Bill purchased o/s at year end → discount is apportioned between 2 years
Demand Drafts
o Check signature with signature book
o DD sold/ issued confirmed by advice to paying branch
o Paying branch not receive confirmation or credit in account → steps to ascertain reasons
Credit Card Operations
o There should be effective screening of applications with reasonably good credit assessments.
o There should be strict control over storage and issue of cards.
o There should be prompt reporting by merchants of all settlements accepted through credit cards.
o Reimbursement to merchants made only after verification of validity of merchant’s acceptance of cards.
o All reimbursement (gross of commission) should be immediately charged to customer’s account.
o There should be a system to ensure that statements are sent regularly and promptly to customer.
o There should be a system to monitor and follow-up customers’ payments.
SLR/CRR Requirements
Cash Reserve Ratio: min. fraction of deposits in cash/ deposits with RBI. Check master circular of RBI
to check compliance.
Statutory Liquidity Ratio: Required to maintain gold/cash/govt approved securities/other liquid assets.
Report submitted to top mgt & RBI.
Note: There should be half yearly reviews of Investment portfolios (30th Sept & 31st Mar)
Advances
Audit Approach: Auditor is concerned with obtaining evidence about following:-
o Amounts included in B.S. in respect of advances are o/s at date of B.S.
o Advances represent amounts due to bank
o Amounts due to the bank are appropriately supported by loan documents
o There are no unrecorded advances
o Stated basis of valuation of advances is appropriate and properly applied and recoverability of
advances is recognized in their valuation.
o Appropriate provisions towards advances are made as per RBI norms, a/c standards and GAAP
Substantive Audit Procedures
o Verify correctness of master data of loan a/cs updated in CBS. Check parameters like instalments,
EMI, rate of intt, tenure of loans etc.
o Verify that each customer of bank is tagged under single customer id in respect of all it’s a/cs including
those in which cr. facilities are granted.
o Examine a/cs identified to be problem a/cs but which have not yet slipped into NPA category. This can
be done by obtaining list of SMA1 and SMA2 borrowers from bank and same can be considered for
selection of problematic accounts.
o Examine those a/cs → adversely commented upon by concurrent auditors/bank’s internal
inspection/RBI inspection team.
o Examine list of restructured a/cs to ensure that restructure is as per RBI guidelines. Remember
restructured a/c portfolio requires additional provisioning.
o Examine quick/early mortality accounts. Any advance slippage to NPA within 12 months of its sanction
is called as quick/early mortality case.
o Examine all large advances & others on sample basis
o Completeness & accuracy of interest charged
Recoverability of advances
➢ Review periodic statements submitted by borrower indicating extent of compliance with T&Cs
➢ Latest financial statements of borrower
➢ Reports on inspection of security
➢ Review audit report → borrowers having cr. facilities beyond cut-off limit fixed by BOD of bank.
Provisioning of NPA
Classification & Provision
o Verify whether bank has a system of ongoing identification and classification of advances through CBS
without manual intervention & its accuracy in crystallising date of NPA.
o Examine classification appropriate → particularly those advances with threat to recovery
o Examine secured & unsecured portion segregated correctly & calculation of provision
o Review & compare date of NPA of loan a/cs mentioned in CY statements with PY. Reasons for any change
should be ascertained.
Extant guidelines >> Proper reporting [Crs & stocks] >> Construction >> Stock audit
Agricultural Advance
As per norms, Agri. advances are of 2 types:
a. Long Duration Crops (crop season > 1 year)
b. Short Duration Crops (crop season <= 1 year)
NPA Provisions:
LDC → Principal or intt overdue for 1 crop season
SDC → Principal or intt overdue for 2 crop seasons
o NPA norms applied as per crop season determined by State Level Bankers’ Committee in each State.
o Also ensure that these norms are made applicable to all direct agricultural advances listed in Master
Circular on lending to priority sector.
o In respect of agricultural loans, other than those specified in circular, ensure that identification of
NPAs has been done on the same basis as non-agricultural advances.
Restructured Advance
o Restructuring is an act in which lender for economic or legal reasons relating to borrower’s financial
difficulty, grants concessions to borrower.
o It may involve modification of terms of advances including alteration of amt of instalments/alteration
of repayment period/rate of intt/sanction of additional cr. facilities etc. to help in curing of default.
o Auditor should verify compliance with requirements of circular issued in this regard.
o Banks may restructure a/cs classified under std, substandard or doubtful categories. Banks can’t
restructure a/cs with retrospective effect.
o Once bank receives an application in respect of an a/c for restructuring, it implies that account is
intrinsically weak. During the time a/c remains pending for restructuring, auditors need to take a view
whether provision needs to be made in respect of such a/cs, pending approval for restructuring.
o On restructuring, a/c will be downgraded from Std to sub-std. NPAs remain in same category.
Upgradation of Account
o Examine all accounts upgraded from NPA to std. category during year, to ensure that upgrading of
each account is strictly as per RBI guidelines.
o There can be a possibility of incorrect upgradation of a/c on basis of partial recoveries made in the
a/c & overdue portion might not have wiped out completely.
o There can also be a possibility of recoveries being made in account after cut-off date and a/c being
upgraded as on date of B.S.
Verification of capital:
• Capital Risk Adequacy Ratio = (Eligible total capital funds/Risk weighted assets & off balance
sheet items ) * 100
• RBI requires banks to maintain minimum 9% CRAR.
Stress Testing: These are designed to understand whether bank has enough capital to survive plausible
adverse economic conditions and to maintain enough buffer to stay afloat under extreme scenarios.
BASEL III framework :Basel III norms relate to Capital Adequacy requirement compliance which
Bank has to achieve as contained in BASEL III accord.
Basel capital adequacy norms are meant for protection of depositors and shareholders by prescriptive
rules for measuring capital adequacy, thereby evolving methods of determining regulatory capital and
ensuring efficient use of capital.
Aim:
a) improving the banking sector's ability to absorb shocks arising from financial and economic stress
b) improving risk management and governance practices
c) strengthening banks' transparency and disclosure standards.
Opened >> balances >> interest >> confirmation >> dr. balance >> Inoperative a/c
Case Study: During audit you notice that large no. of cash credit a/c in branch are only partially
utilized during substantial part of year. However, in month of March, accounts are fully utilized.
On further scrutiny, it is observed that these a/c holders made FDs from these utilized amounts at
end of year. These deposits have been liquidated in first week of April of next financial year.
Comment upon how this situation would be dealt by you as a statutory branch auditor?
Many of cash credit a/c are only partially utilized during substantial part of year. However, in month
of March, accounts are fully utilized. Further, its observed that these a/c holders have made FDs
from these utilized amounts at end of year. These deposits have been liquidated in first week of
April of next financial year.
This is eg. of window dressing. Branch is resorting to window dressing by artificially boosting its
advances and deposits. To inflate its advances as well as deposits artificially.
Relevant regulatory guidelines also prohibit such type of practices & these might involve penal action
in terms of Banking Regulation Act, 1949.
Same needs to be suitably reported in audit report and commented in LFAR also.
In appropriate cases, making a suitable qualification in the main audit report has also to be
considered.
Borrowings
• Obtain & verify confirmation certificates & other docs
• SA 505, “External Confirmation” –audit evidence to respond to significant risks
• Examine- clear distinction b/w rediscount and refinance, as rediscount doesn’t appear in this head
• Examine borrowing at call & short notice-authorised
Bills payable
• Evaluate the existence, effectiveness and continuity of internal controls over bills payable.
Controls should usually include the following-
➢ Drafts, mail transfers,etc. made out in std printed forms.
➢ Unused forms of drafts, traveller’s cheques, etc. kept under custody of responsible officer.
➢ Bank should have a reliable private code known only to responsible officers of branches, coding
and decoding of telegrams should be done only by such officers.
➢ The signatures on demand draft, checked by officer with specimen signature book.
➢ All TTs and DDs issued by a branch should be immediately confirmed by advices to the branches
concerned. On payment, paying branch should send a debit advice to originating branch
• Examine sample of outstanding items comprised in bills payable accounts with relevant registers.
Reasons for old outstanding debits in respect of drafts or other similar instruments paid without
advice should be ascertained.
• Correspondence with other branches after year-end should be examined specially for large value
items outstanding on balance sheet date.
Contingent Liabilities
Management Representation:
Auditor should obtain representation from mgt that:-
i) all off-balance sheet transactions have been accounted in books of a/cs as and when such transaction
has taken place
ii) all off balance sheet transactions have been entered into after following due procedure laid down
iii) all off balance sheet transactions are supported by the underlying documents
iv) all year end contingent liabilities have been disclosed
v) disclosed contingent liabilities don’t include any crystallised liabilities which are of nature of loss/
expense and which require creation of a provision/adjustment in F.S.
vi) estimated amounts of financial effect of contingent liabilities are based on best estimates in terms
of AS 29, including consideration of possibility of any reimbursement
Audit procedures:
Contingent Liability (CL)
• Adequte Internal Controls ensure transactions executed by persons authorised
• Verify in case of LCs for import of goods, payments made in terms of LC
• Test completeness of recorded obligations
• Review reasonableness of year end CL in light of previous experience & current year activities
• Review whether comfort letters issued included in CL
Auditor’s Reports
In case of nationalized bank, report is issued to Central Govt. stating following:
• Whether, in auditor’s opinion, balance sheet is full and fair balance sheet containing all necessary
particulars and is properly drawn up to exhibit true and fair view of affairs of bank.
• In case auditor had called for any explanation or information, whether it has been given and whether
it is satisfactory.
• Whether or not transactions of bank, which have come to auditor’s notice, have been within powers
of bank.
• Whether or not returns recd. from offices & branches found adequate for purpose of audit.
• Whether P&L a/c shows true balance of profit or loss for period covered by such a/c.
• Any other matter which auditor considers should be brought to notice of Central Government.
Consolidation is done at HO level and LFAR for bank is submitted by SCAs to mgt. LFAR, on the bank,
after due examination, should be placed before ACB of bank indicating action taken/proposed to be
taken for rectification of irregularities, if any, mentioned therein; & a copy of LFAR and relative
agenda note, together with Board's views or directions, is submitted to RBI within 60 days of
submission of LFAR by statutory auditors.
Concurrent Audit
Scope of Concurrent Audit in Banks
Cash + Deposits + Advances + Investments + Foreign Exchange + House Keeping + Other Items
Investments
• Purchase/sale of securities should as per:
➢ HO instructions
➢ Rates beneficial to bank
• Securities in books → should be physically held by it
• Compliance with RBI/HO guidelines
Advances
• Ensure proper sanction of advances
• Securities properly recd and regd in name of bank.
• Proper post disbursement supervision & follow-up
• LC issued within delegated power
• BG issued, properly worded & recorded in register
• Classification as per RBI guidelines
• Claims to ECGC & DICGC submitted in time
Foreign Exchange
• Check foreign bills negotiated under letters of credit.
• Examine extension and cancellation of forward contracts for purchase and sale of foreign currency.
Ensure that they are duly authorised and necessary charges have been recovered.
• Ensure that balances in Nostro accounts in different foreign currencies are within prescribed limit.
• Ensure verification/reconciliation of Nostro and Vostro a/c transactions/balances.
• Check FCNR and other non-resident a/c whether debits and credits are permissible under rules.
• Check whether inward/outward remittance have been properly accounted for.
• Ensure adherence to guidelines issued by RBI/HO of bank about dealing room operations.