Executive Summary:
This circular from the Reserve Bank of India (RBI), dated January 7, 2021, addresses the strengthening of governance arrangements within banks' Risk-Based Internal Audit (RBIA) frameworks. It aims to bring uniformity and align internal audit functions with best practices. The instructions outlined in this circular take immediate effect from the date of issue and supplement previous RBI guidelines on RBIA.
Key Points / Main Content:
Authority, Stature, and Independence:
* The internal audit function must possess sufficient authority, stature, independence, and resources.
* The Head of Internal Audit (HIA) must be a senior executive with the ability to exercise independent judgement.
* The HIA and internal audit function must have the authority to communicate with staff and access necessary records.
Competence:
* Internal auditors must possess requisite professional competence, knowledge, and experience in areas like banking operations, accounting, IT, data analytics, and forensic investigation.
* The internal audit function must have the skills to audit all areas of the bank.
Staff Rotation:
* Except for specialized internal audit functions managed by career internal auditors, the Board should prescribe a minimum service period for staff in the internal audit function.
* The Board may consider requiring staff with specialized knowledge in other departments to serve a stint in internal audit.
Tenor for HIA Appointment:
* Except for specialized internal audit functions managed by career internal auditors, the HIA should be appointed for a reasonably long period, preferably a minimum of three years.
Reporting Line:
* The HIA shall report directly to either the Audit Committee of the Board (ACB), MD & CEO, or Whole Time Director (WTD).
* If the HIA reports to the MD & CEO or a WTD, the ACB will review performance appraisals, and the Board will accept them.
* In such cases, the ACB must meet with the HIA quarterly without senior management present.
* The HIA must not have a reporting relationship with business verticals and shall not be given business targets.
* In foreign banks operating as branches, the HIA shall report to the internal audit function in the controlling office (head office).
Remuneration:
* Remuneration policies should be structured to avoid conflicts of interest and maintain audit independence and objectivity.
Outsourcing:
* The internal audit function shall not be outsourced.
* Experts, including former employees, may be hired on a contractual basis if the ACB is assured the expertise does not exist within the bank.
* Any conflict of interest must be recognized and addressed.
* Ownership of audit reports rests with regular functionaries of the internal audit function.
Risk-Based Internal Audit Framework:
* Banks must ensure and document that their RBIA framework captures all significant criteria and principles suited for their structure, business model, and risks.
Impact Analysis:
Scheduled Commercial Banks (excluding RRBs), Local Area Banks, Small Finance Banks, and Payments Banks:
Impact: These banks are required to reorient their internal audit approach in line with the guidelines and best practices outlined in the circular. They are also required to align their internal audit functions with the expectations outlined in the circular.
Action Required: Banks must review and update their RBIA framework, policies, and procedures to comply with the instructions in the circular, ensuring proper documentation. They must also implement the changes to reporting lines, remuneration, and other aspects of the internal audit function as detailed in the circular.
Boards of Directors and Audit Committees:
Impact: The Boards and Audit Committees will be responsible for overseeing the implementation of the revised RBIA framework and ensuring compliance with the new requirements. They will also have increased oversight responsibilities related to the HIA's reporting line and performance appraisal.
Action Required: Boards and Audit Committees need to review and approve changes to the RBIA framework, establish minimum service periods for staff in internal audit, and determine the HIA's reporting line. The Audit Committee must also meet with the HIA quarterly if the HIA reports to the MD & CEO or a WTD.
Head of Internal Audit (HIA):
Impact: The HIA's role is reinforced as a senior executive with sufficient authority and independence. The circular also specifies the HIA's reporting line and the required frequency of meetings with the Audit Committee.
Action Required: The HIA must ensure that the internal audit function operates with the required authority, stature, and independence. The HIA must also establish direct reporting lines as specified in the circular and meet with the Audit Committee as required.
Key Entities Referenced
Reserve Bank of India: The central bank of India, which issued the circular.
Scheduled Commercial Banks: Banks that are listed in the Second Schedule to the Reserve Bank of India Act, 1934.
Risk Based Internal Audit: An audit methodology that focuses on identifying and assessing risks within an organization and tailoring audit activities to address those risks.
Basel Committee on Banking Supervision: The primary global standard setter for the prudential regulation of banks and provides a forum for regular cooperation on banking supervisory matters.
Audit Committee of the Board: A committee of the board of directors responsible for overseeing the financial reporting process, audit process, and internal controls.
International Internal Audit standards: A set of professional standards and guidelines for internal auditors to follow in their work.
Ajay Kumar Choudhary: Chief General Manager-In-Charge at Reserve Bank of India, signatory of the circular.
Mumbai, Maharashtra: City in India where the Department of Supervision, Central Office of RBI is located.
RBI/2020-21/83
Ref.No.DoS.CO.PPG./SEC.04/11.01.005/2020-21 January 07, 2021
The Chairman / Managing Director / Chief Executive Officer
All Scheduled Commercial Banks (Excluding RRBs)
All Local Area Banks
All Small Finance Banks and
All Payments Banks
Madam / Dear Sir,
Risk Based Internal Audit (RBIA) Framework – Strengthening Governance
arrangements
In terms of the Guidance Note on Risk-Based Internal Audit issued by RBI vide circular
DBS.CO.PP.BC.10/11.01.005/2002-03 dated December 27, 2002, banks, inter alia, are
required to put in place a risk based internal audit (RBIA) system as part of their internal control
framework that relies on a well-defined policy for internal audit, functional independence with
sufficient standing and authority within the bank, effective channels of communication,
adequate audit resources with sufficient professional competence, among others.
2. While the aforesaid Guidance Note lays out the basic approach for risk based internal
audit functions, banks are expected to re-orient their approach, in line with the evolving best
practices, as a part of their overall Governance and Internal Control framework. Banks are
encouraged to adopt the International Internal Audit standards, like those issued by the Basel
Committee on Banking Supervision (BCBS) and the Institute of Internal Auditors (IIA).
3. To bring uniformity in approach followed by the banks, as also to align the expectations
on Internal Audit Function with the best practices, banks are advised as under:
a) Authority, Stature and Independence - The internal audit function must have sufficient
authority, stature, independence and resources within the bank, thereby enabling internal
auditors to carry out their assignments with objectivity. Accordingly, the Head of Internal
Audit (HIA) shall be a senior executive of the bank who shall have the ability to exercise
independent judgement. The HIA as well as the internal audit function shall have the
पय�वे�ण िवभाग, के�ीय काया�लय, व�� ट�ेड स�टर, स�टर , कफ परेड, कोलाबा, मुंबई
टेलीफोन: 022- 2218 8482 फै�: 022-2218 0157 ईमेल - cgmicdosco@rbi.org.in
-1 – 400005
Department of Supervision, Central Office, World Trade Centre, Centre I, Cuffe Parade, Colaba, Mumbai - 400 005
-
Tel: 022-2218 8482 Fax: 022-2218 0157 e-mail: cgmicdosco@rbi.org.in
ब�क िहन्दी म� प�ाचार का स्वागत करता ह।ैauthority to communicate with any staff member and have access to all records or files that
are necessary to carry out the entrusted responsibilities.
b) Competence - Requisite professional competence, knowledge and experience of each
internal auditor is essential for the effectiveness of the bank's internal audit function. The
desired areas of knowledge and experience may include banking operations, accounting,
information technology, data analytics and forensic investigation, among others. Banks
should ensure that internal audit function has the requisite skills to audit all areas of the
bank.
c) Staff Rotation - Except for the entities where the internal audit function is a specialised
function and managed by career internal auditors, the Board should prescribe a minimum
period of service for staff in the Internal Audit function. The Board may also examine the
feasibility of prescribing at least one stint of service in the internal audit function for those
staff possessing specialized knowledge useful for the audit function, but who are posted in
other departments, so as to have adequate skills for the staff in the Internal Audit function.
d) Tenor for appointment of Head of Internal Audit - Except for the entities where the internal
audit function is a specialised function and managed by career internal auditors, the HIA
shall be appointed for a reasonably long period, preferably for a minimum of three years.
e) Reporting Line - The HIA shall directly report to either the Audit Committee of the Board
(ACB) / MD & CEO or Whole Time Director (WTD). Should the Board of Directors decide
to allow the MD & CEO or a WTD to be the ‘reporting authority’ of the HIA, then the
‘reviewing authority’ shall be with the ACB and the ‘accepting authority’ shall be with the
Board in matters of performance appraisal of the HIA. Further, in such cases, the ACB shall
meet the HIA at least once in a quarter, without the presence of the senior management,
including the MD & CEO/WTD. The HIA shall not have any reporting relationship with
the business verticals of the bank and shall not be given any business targets. In foreign
banks operating in India as branches, the HIA shall report to the internal audit function in
the controlling office / head office.
f) Remuneration - The independence and objectivity of the internal audit function could be
undermined if the remuneration of internal audit staff is linked to the financial performance
of the business lines for which they exercise audit responsibilities. Thus, the remuneration
policies should be structured in a way that it avoids creating conflict of interest and
compromising audit’s independence and objectivity.
24. The internal audit function shall not be outsourced. However, where required, experts,
including former employees, could be hired on contractual basis subject to the ACB being
assured that such expertise does not exist within the audit function of the bank. Any conflict of
interest in such matters shall be recognised and effectively addressed. Ownership of audit
reports in all cases shall rest with regular functionaries of the internal audit function.
5. Banks must ensure and demonstrate through proper documentation that their risk-based
internal audit framework captures all the significant criteria / principles suited for their
organisational structure, the business model and the risks.
6. The instructions contained in this circular shall come into effect immediately from the
date of this circular.
7. This circular supplement the guidelines issued by Reserve Bank of India on December
27, 2002 on Risk-based internal audit along with other circulars/instruction on the subject
issued from time-to time and for any common areas of guidance, the prescription of this circular
shall be followed.
Yours faithfully,
(Ajay Kumar Choudhary)
Chief General Manager-In-Charge
3