The Reserve Bank of India today released a circulation, making it mandatory for select non-banking financial companies (NBFCs) and Urban Co-operative Banks to adopt a risk-based internal audit (RBIA) system, in line with banks.

Share Market Live

NSE

RBI had first announced that it would issue such directions in its December 2020 monetary policy. This is done with a view to strengthening the Internal Audit Function, “which works as a third line of defence,” the regulator said.

“While NBFCs (Non-Banking Financial Companies) and Primary (Urban) Cooperative Banks (UCBs) have grown in size and become systemically important, the prevalence of different audit system/approaches in such entities has created certain inconsistencies, risks and gaps. As SCBs, NBFCs and UCBs face similar risks by virtue of being engaged in similar financial intermediation activities, their internal audit systems also need to broadly align while keeping in mind the principle of proportionality,” RBI said in a notification on Wednesday morning.

The circular is applicable to all deposit-taking Non-Banking Finance Companies (NBFCs), all non-deposit taking NBFCs (including Core Investment Companies) with asset size of Rs 5,000 crore and above, and all Primary (Urban) Co-operative Banks (UCBs) with asset size of Rs 500 crore and above.

The guidelines intend to provide the essential requirements for a robust internal audit function, which include sufficient authority, stature, independence, resources and professional competence, so as to align these requirements in larger NBFCs/UCBs with those stipulated for Scheduled Commercial Banks.

“It is expected that the adoption of RBIA by such entities would help to enhance the quality and effectiveness of their internal audit system,” RBI said.

The internal audit function should broadly assess and contribute to the overall improvement of the organization’s governance, risk management, and control processes using a systematic and disciplined approach.

“While the Risk Management Function should focus on identification, measurement, monitoring, and management of risks, development of risk policies and procedures, use of risk management models, etc, RBIA should undertake an independent risk assessment for the purpose of formulating a risk-based audit plan which considers the inherent business risks emanating from an activity/location and the effectiveness of the control systems for monitoring such inherent risks,” the notification read.

The internal audit function should broadly assess and contribute to the overall improvement of the organization's governance, risk management, and control processes, the regulator said. It should also promote appropriate ethics and values within the organization; ensure effective performance of the management, staff accountability, etc.

“The internal audit function shall not be outsourced. However, where required, experts including former employees can be hired on a contractual basis,” RBI clarified.

The concerned NBFCs and UCBs are expected to constitute a committee of senior executives to formulate a suitable action plan, RBI said. The RBIA would undertake an independent risk assessment, and formulate a risk-based audit plan.

The bard-approved risk-based auto plan would also have to be reviewed periodically by the organisations. All the rend concerned entities are expected to implement a framework for the audit by March 31, 2022.

First Published:Feb 3, 2021 10:30 AM IST