The Reserve Bank of India (RBI) on Friday extended the Risk-Based Internal Audit (RBIA) rules to all deposit taking HFCs and non-deposit taking HFCs with assets over Rs 5,000 crore with effect from June 30, 2022. Earlier, on February 3, the central bank had made these rules applicable to other entities. 

While announcing the rules on risk-based internal audit for Non-banking finance companies (NBFCs) and Urban Cooperative Banks (UCBs) on risk-based internal audit in February, the RBI had said that the circular is applicable to NBFCs with asset size of Rs 5,000 crore and above and all Primary Urban Cooperative Banks (UCBs) with asset size of Rs 500 crore and above.

“The circular intends, inter alia, to provide the essential requirements for a robust internal audit function, which include sufficient authority, stature, independence, resources and professional competence, so as to align these requirements in larger NBFCs/UCBs with those stipulated for Scheduled Commercial Banks,” RBI said in the circular.

The banking regulator expects the adoption of RBIA by such entities to enhance the quality and effectiveness of their internal audit systems. In its ‘Statement on Developmental and Regulatory Policies’ issued as part of the Monetary Policy Statement dated December 4, 2020, RBI had noted that suitable guidelines will be issued to large UCBs and NBFCs for the adoption of Risk-Based Internal Audit (RBIA) to strengthen the Internal Audit Function, which works as a third line of defence.

What are the new audit rules?

As per RBI, in order to ensure the smooth transition from the existing system of internal audit to RBIA, the concerned NBFCs and UCBs will have to constitute a committee of senior executives with the responsibility of formulating a suitable action plan.

“The committee may address transitional and change management issues and should report progress periodically to the Board and senior management,” the regulator said. The boards of NBFCs and UCBs are primarily responsible for overseeing their internal audit functions.

“The RBIA policy shall be formulated with the approval of the Board and disseminated widely within the organisation. The policy shall clearly document the purpose, authority, and responsibility of the internal audit activity, with a clear demarcation of the role and expectations from Risk Management Function and Risk Based Internal Audit Function,” RBI said.

Further, the senior management of these firms is responsible for ensuring adherence to the internal audit policy guidelines as approved by the Board and development of an effective internal control function that identifies, measures, monitors and reports all risks faced, the RBI said.

“It shall ensure that appropriate action is taken on the internal audit findings within given timelines and status on the closure of audit reports is placed before the ACB/Board,” RBI said.

Also, the senior management is responsible for establishing a comprehensive and independent internal audit function which should promote accountability and transparency, the RBI said.

The RBI has also specifically said the internal audit function should assess and make appropriate recommendations to improve the governance processes on business decision making, risk management and control; promote appropriate ethics and values within the organisation, and ensure effective performance management and staff accountability, etc.

To ensure effectiveness, the internal audit function must have sufficient authority, stature, independence and resources thereby enabling internal auditors to carry out their assignments properly, the RBI added in its guidelines.