PNB scam of Rs 11,400 cr raises questions on systemic risks and audit processes in the country

In a formal complaint, PNB disclosed that group companies of diamond importer Nirav Modi and his uncle Mehul Chokshi’s Gitanjali Gems in collusion with two of their officials from its Brady house, Mumbai branch, was fraudulently receiving LoUs since 2011. Foreign branches of a few Indian banks gave credit against these LoUs to Modi’s companies to repay its overseas suppliers.

However, all of this went undetected as the LoUs were issued bypassing PNB’s core banking solutions (CBS) through an international system called SWIFT technologies. A senior official from one of the top audit firms said, “SWIFT transactions are used by banks for cross-border transactions for faster messaging across locations. It is a system lapse or inefficiency if the CBS was not linked to SWIFT. Also, such frauds can spread across other banks who have not linked their core banking solutions.”

A senior executive of another bank said, “I don’t know how it gets undetected. Hundreds of millions of dollars come through Nostro account, the treasury at least should know where is the money coming from. If other banks have given money to PNB, how can that go undetected. That branch's profits also were not booked, the treasury missed it and the auditors also missing a huge amount accumulated like is something unbelievable.”

Apart from linking of processes to core banking solutions, banks usually have multiple audits on a regular basis, including those by internal auditors, concurrent auditors and one by the Reserve Bank of India.

Concurrent audit means doing the examination of the financial transactions at the time of happening or parallel with the transaction. It helps as an early warning system to ensure timely detection of irregularities and lapses in firms and fraudulent transactions at their branches.

As per RBI’s definition, the scope of concurrent audit is an examination which is contemporaneous with the occurrence of transactions or is carried out as near thereto as possible. It attempts to shorten the interval between a transaction and its examination by an independent person. There is an emphasis in favour of substantive checking in key areas rather than test checking. This audit is essentially a management process integral to the establishment of sound internal accounting functions and effective controls and setting the tone for a vigilant internal audit to preclude the incidence of serious errors and fraudulent manipulations.”

In July 2015, RBI had also asked banks to revise the concurrent audit norms, in which it said that such audits at branches should cover at least 50 percent of the advances and 50 percent of deposits of a bank. Audit should focus on whether transaction or decisions are within the policy parameters and regulatory norms and cover branches based on the risk profiles and specialisation.

“A concurrent auditor may not sit in judgement over the decisions taken by a branch manager or an authorised official. Also, an external audit must be appointed for a year, whose term can be extended later by up to three years. Post this tenure, the auditors’ mandate must necessarily by shifted to other branches subject to satisfactory performance,” RBI said.

The LOUs in PNB’s cases were getting rolled over as soon as they expired, but came to light only when the officer issuing the LoUs had retired and a new officer in-charge took note of the unauthorized transactions as Modi’s companies sought additional funds.

Auditors of PNB named in their annual report as on May 2017 are Chhajed & Doshi, R Devendra Kumar & Associates, Hem Sandeep & Co, Suri & Co and SPMG & Co. In 2011-12, the auditors were V K Verma & Co Mookherjee Biswas & Pathak Amit Ray & Co Sarda & Pareek Borkar & Muzumdar G S and Madhava Rao & Co.

Even as most banks conduct the standard audit practices, it is often just a formality based on what the bank presents, the RBI official quoted above said.

R Gandhi, former RBI Deputy Governor, said, “I would not jump to a conclusion that there is a systemic issue but if a systemic lacunae is proven in the investigation, then yes, the standard procedures need to change…PNB has to check how the audits missed this.”