RBI issues circular on risk-based internal audit for UCBs, NBFCs

In its ‘Statement on Developmental and Regulatory Policies’ issued as part of the Monetary Policy Statement dated December 4, 2020, RBI had noted that suitable guidelines will be issued to large UCBs and NBFCs for the adoption of Risk-Based Internal Audit (RBIA) to strengthen the Internal Audit Function, which works as a third line of defence.

The RBI’s new guidelines are important in the context of rising instances of financial regularities and governance issues in banks and NBFCs in recent years.

In order to ensure the smooth transition from the existing system of internal audit to RBIA, the concerned NBFCs and UCBs will have to constitute a committee of senior executives with the responsibility of formulating a suitable action plan.

“The committee may address transitional and change management issues and should report progress periodically to the Board and senior management,” the regulator said.

According to the new guidelines, the boards of NBFCs and UCBs are primarily responsible for overseeing their internal audit functions.

“The RBIA policy shall be formulated with the approval of the Board and disseminated widely within the organisation. The policy shall clearly document the purpose, authority, and responsibility of the internal audit activity, with a clear demarcation of the role and expectations from Risk Management Function and Risk Based Internal Audit Function,” RBI said.

Further, the senior management of these firms is responsible for ensuring adherence to the internal audit policy guidelines as approved by the Board and development of an effective internal control function that identifies, measures, monitors and reports all risks faced, the RBI said.

“It shall ensure that appropriate action is taken on the internal audit findings within given timelines and status on the closure of audit reports is placed before the ACB/Board,” RBI said.

Also, the senior management is responsible for establishing a comprehensive and independent internal audit function which should promote accountability and transparency, the RBI said.

The RBI has specifically said the internal audit function should assess and make appropriate recommendations to improve the governance processes on business decision making, risk management and control; promote appropriate ethics and values within the organisation, and ensure effective performance management and staff accountability, etc.

To ensure effectiveness, the internal audit function must have sufficient authority, stature, independence and resources thereby enabling internal auditors to carry out their assignments properly, the RBI said.