
Lecture 1: Introduction
Have you done any Online Shopping recently?
Have you purchased a Flight or Rail or Bus Ticket online?
Have you booked a Hotel room for yourself or your family online?
Till a few years back, we used to stand up in line to pay our Electricity Bills, Telephone or Mobile Bills, etc.
But now I can say, gone are those days!
How come?
Thanks to modern technology – Nowadays we can make online payments using money available in our Bank accounts.
We have facilities available 24x7 from the banking system to support online transactions, payments, transfer of funds, and so on.
If you look deeper into those kinds of transactions, you will realize there are a number of peculiarities like
Transactions are in Huge volumes and with high levels of complexity.
There is a wide geographical spread of banks’ networks.
Large range of products and services offered.
There is Extensive use of technology.
So, not only me but every-one will wonder how such complex transactions are performed sequentially, how they are regulated and monitored?
As we are going to study Audit of Banks, let's put our focus on Regulation and Monitoring of Banks. It’s a very important task in any economy because of the strategic importance associated with the banking sector.
It's because the Banking sector is the backbone of any economy. It's only through the banking sector, a country will be able to achieve sustainable socio-economic growth and financial stability in its economy.
Not only that - the banking sector deals with large amounts of public monies and because of that it is highly sensitive to reputational risk. It is also exposed to various risks in its operations.
So, it is very important that the banking sector stays healthy, safe, and sound.
But how to ensure this?
That’s where the role of Financial Statements is supported by quality bank audits.
Let's talk about them at length in the coming sessions.
Lecture 2: Different types of Bank
Before we move into deeper areas of Bank Audit, let’s get some broader pictures of Different Types of Banks in our country:
No.1 - Commercial banks
Commercial Banks are the most widespread banking institutions in India. They only provide a number of products and services to the general public and other segments of the economy. The main two functions are:-
(a) accepting deposits and
(b) granting advances.
No.2 - is Regional Rural Banks.
Regional Rural Banks in short known as RRBs are banks set up in rural areas in different states of the country. The objective of setting up RRBs are to cater to the basic banking and financial needs of the rural communities.
For Example:
We have Punjab Gramin Bank, Tripura Gramin Bank, Allahabad UP Gramin Bank, Andhra Pradesh Grameen Vikas Bank, etc.
Next, we’ll move to Co-operative Banks:
Co-operative Banks function like Commercial Banks only but they are set up on the basis of Cooperative Principles and generally, they will be registered under the Cooperative Societies Act of the respective state or the Multistate Cooperative Societies Act.
The objective of co-operative banks will be catering to the needs of the agricultural and rural sectors.
To cite Examples, we have
The Gujarat State Co-operative Bank Ltd.,
Chhattisgarh Rajya Sahakari Bank Maryadit , etc.
Next what we have is Payments Banks – These are new types of banks recently introduced by RBI. They are allowed to accept restricted deposits only, but they cannot issue loans and credit cards.
However, customers can open Current & Savings accounts and also avail of facilities like ATM cum Debit cards, Internet-banking & Mobile banking.
To cite a few examples, we have Airtel Payments Bank, India Post Payments Bank, Paytm Payments Bank, etc.
No.5. – We have Development Banks – These Banks were conceptualized to provide funds for infrastructural facilities – so we can say Development Banks play a very role in the economic growth of the country. Some Development Banks are Industrial Finance Corporation of India (IFCI), Industrial Development Bank of India (IDBI), Small Industries Development Bank of India (SIDBI), etc.
Next – we have Small Finance Banks – These Banks have been set up with the approval of RBI. The objective of Small Finance Banks is to provide financial and banking facilities to the unserved and unorganized sectors like small marginal farmers, small & micro business units, etc. Some Examples are- Equitas Small Finance Bank, AU Small Finance Bank, etc.
Lecture 3: RBI - Responsibilities & Functions
In this session, let’s talk about the Reserve Bank of India:
We all know, RBI – Reserve Bank of India is the Central Bank of our country, and the functioning of the banking industry in India is regulated by RBI. In this session, I'll take you through the broad responsibilities of RBI.
No. 1
RBI is responsible for the Development and Supervision of the constituents of the Indian Financial System ( when I say constituents, it comprises both banks and non-banking financial institutions).
No.2
RBI is responsible for determining the Monetary and Credit Policies for the country depending upon the needs and circumstances. Of course, it has to do this in conjunction with the Central Government,
No.3
RBI is responsible for Regulating the activities of Commercial and Other Banks
Next, let me also take you through the Important functions of RBI:-
No.1 – RBI is responsible for Issuance of Currency;
No.2 - RBI is responsible for Regulation of currency issue as well;
No.3 - RBI is the Banker for Central and State Governments;
No.4 - RBI also acts as a Banker for commercial banks, other types of banks, and even term lending institutions.
As already mentioned, RBI also has the responsibility of regulating the activities of commercial and other banks
In India, No bank can commence the banking business or open new branches without obtaining a license from RBI.
As a regulator, RBI also has the power to inspect any bank.
Lecture 4: Bank Audit Reports issued by Central Statutory Auditors
In this session, let’s just touch on Types of Bank Audit Reports generally issued by Statutory Central Auditors (SCAs):
No. 1 – Statutory Central Auditors are expected to Report on whether Internal Controls over Financial Reporting are adequate and whether they are operating effectively or not – this reporting is required when that bank is registered as company u/s 143(3)(i) of the Companies Act, 2013.
This report should be given as an Annexure to the main audit report as per the Guidance Note on Audit of Internal Financial Controls over Financial Reporting issued by the ICAI.
No.2 - is Long Form Audit Report. (LFAR)
No.3 - is Report on compliance with SLR requirements.
No.4 - is a Report on whether the treasury operations of the bank are conducted as per instructions issued by the RBI from time to time.
No.5 - is Report on whether the income recognition, asset classification, and provisioning are made as per the guidelines issued by the RBI from time to time.
No.6 - is a Report on whether any serious irregularity was noticed in the working of the bank which requires immediate attention.
No.7 - is a Report on the status of the compliance by the bank i.e., whether the bank has implemented recommendations of the Ghosh Committee relating to frauds and malpractices and whether the bank has implemented recommendations of the Jilani Committee on internal control and inspection/credit system.
No.8 - is a Report on instances of adverse credit-deposit ratio in rural areas.
Lecture 5 - Glimpse of Banking Accounting System
In this session let's take our first step to understand the glimpse of the Banking Accounting System. Detailed aspects we’ll be going through later.
We can say, there is a sea change in banking because of the use of technology. Actually, there is a continuous evolution and this has enabled banks to reach their customers seamlessly and provide them the much-needed convenience & comfort and anytime-anywhere-banking.
Nowadays, customers can access their information/data on a real-time basis. All data is now stored in a safe & secure environment in the bank's servers.
Many customers are now using the Internet and mobile connectivity for their monetary transactions through E-banking without even visiting their bank branches.
It’s all made possible because of Core banking technology and this has enabled phenomenal and accelerated growth for banks and they are now able to provide a wide range of innovative products and services to their customers.
As an Auditor, you should remember this - Transactions in banks will be voluminous in nature – so banks should have controls in place to ensure there is a system for recording,
there is a system for the transmission and storage of information/ data, the system ensures the integrity of data,
and systems should be free of errors, omissions, irregularities, and frauds.
Towards this, Bank management should have taken all steps to make their internal control systems - robust, safe, secure, convenient, and expeditious for customers.
With the advancement of technology, we can say, almost all banks are more or less fully computerized.
So, the auditor should satisfy himself about the Computerized environment of the bank – whether important norms/parameters as per the latest applicable RBI guidelines are incorporated & built into the system – He should satisfy himself about this.
He should check whether the system generates information/data having bearing on classification/ provisions norms and income recognition norms.
Here, the Auditor should not go by assumption – i.e., he should not think that system-generated information is correct. He should not rely on anything without evidence. Rather, he should use Professional Skepticism and Prudence, and wherever & whenever he feels that something should be checked manually, then he should do that manual checking to verify authenticity and consistency of information. Then he should document the results of activities he performed.
Lecture 6: Bank Audit Approach
In this session, let’s have a look at BANK AUDIT APPROACH – i.e., How to approach Bank Audit
Like any other audit, you have to Draw an Audit Plan First for Bank Audit as well – This audit plan should be prepared based on
the nature and level of operations at the Bank branch level
then, nature of adverse features,
then, the level of compliance observed based on previous audit reports and
It should factor importantly audit risks you are expecting based on inadequacy in internal controls or breach of internal controls and audit risks you are expecting out of familiarization exercises carried out.
The next important element in your Bank Audit Approach is assessing Control Environment at the Bank
Banks basically deal with money & the scope for fraud, misappropriation are all very high. So, Banks should have appropriate controls in place to reduce risks.
It should be pervasive.
For eg: They should have effective segregation of duties (particularly, between front and back offices).
They should have controls for accurate measurement and reporting of positions.
They should have controls for verification and approval of transactions.
They should have controls for the reconciliation of positions and results.
They should have controls for setting up limits.
They should have controls for reporting and approval of exceptions.
They should have controls for physical security and contingency planning.
But how does the Auditor know whether controls are there or not? It’s by carrying out an evaluation of controls
For that, there are certain common questions /steps, which have to be kept in mind.
It's basically a question about
Who
What
When
Where
Why
&
How
Let me explain one by one.
First, is questions about Who?
i.e,
Who performs the control?
Whether that person has the required knowledge and authority to perform that control?
The next question is related to What?
i.e.,
What evidence is available to demonstrate /prove that the control is performed?
Then comes a question related to When?
i.e.,
When and with what frequency control is performed?
Whether the frequency enough to prevent, detect, and correct
Next, is Where?
i.e,
Where is the evidence of the performance of the control retained?
For how long evidence will be retained?
Whether the evidence is accessible/ available for an audit?
Next, is Why?
i.e, Why is that control being performed?
By exercising that control, What type of errors are prevented or detected?
And finally – questions related to How?
i.e,
How is the control performed?
What are the control activities?
Whether those activities be bypassed?
lf bypassed, whether they can be detected?
If there are any exceptions/deviations identified, how are they resolved?
and What is the time frame for resolving the exceptions?
The next element in Bank Audit Approach is Engagement Team Discussions
At first, what is the Engagement Team?
All personnel who are performing an audit engagement, including experts contracted by the firm for that engagement, are known as “Engagement Team”.
Ok.
This engagement team should have a detailed discussion to get a better understanding of the bank, its environment, its internal controls, and also to measure the risk of material misstatements of the financial statements.
These discussions have to be appropriately documented for future reference.
The audit engagement partner and members of the engagement team should discuss in particular, the susceptibility of the bank’s branch financial statements to material misstatements.
All these discussions should be ordinarily done at the planning stage of an audit itself.
I'll list out some of the common discussion matters:
(a) What are the Errors more likely to occur;
(b) What are the Errors identified in prior years;
(c) By what possible methods, fraud might be attempted by bank personnel or others within particular account balances or in disclosures.
(d) Audit responses to Engagement Risk, Pervasive Risks, and Specific Risks;
(e) How they should maintain professional skepticism throughout the audit engagement;
(f) When engagement team members should alert the audit engagement partner –(generally, if members come across some information or other conditions and if that could indicate a possible occurrence of material misstatement in financial statements, then they should alert the audit engagement partner).
So, now we have an idea about what is audit engagement discussion and even some common discussion matters as well.
Conducting Audit Engagement Discussion also throws various advantages – because having a discussion like this enables the engagement team to consider an appropriate response for fraud risks and even those related to engagement risk, pervasive risks, and specific risks. This is possible if engagement team discussions had Specific emphasis on the susceptibility of the bank’s financial statements to material misstatement.
Next, it enables the audit engagement partner to delegate the work to the experienced engagement team members, and to determine what procedures to be followed when fraud is identified!
Not only this – It also helps audit engagement partners to review the need to involve specialists, so that they can address the issues relating to fraud.
Lecture 7: Selection of Auditor for Public Sector Bank
In this session, let’s look at the Norms on eligibility, empanelment, and appointment of Statutory Branch Auditors in Public Sector Banks from the year 2020-21 and onwards :
First, let’s look at the Norms for selection of branches of Public Sector Banks (PSBs) for Statutory Audit – Yes! There are norms because not all the branches are going to be subjected to Statutory Audit.
Ok
RBI has issued guidelines for selection of branches of PSBs for statutory audit from the year 2020- 21 onwards.
It says Statutory branch audit of PSBs should cover 90% of funded & non-funded credit exposures of a bank.
So, from an overall bank point of view – 90% of their funded & non-funded credit exposure should be subjected to audit.
Ok. – This is guideline no. 1
The next guideline says, when the bank selects branches for statutory audit, it should include a representative cross-section of rural/semi-urban/urban and metropolitan branches. The guideline also stresses that it should select branches that are predominantly not subjected to concurrent audit.
Even CPUs/LPUs/and other centralised hubs will be included for branch audit every year, let whatever name they are being called/termed.
The selection of branches for a statutory audit cannot be done by bank management on its own. It should be finalized by each PSB with the consent of the Statutory Central Auditor/s.
And the Branches which are subjected to concurrent audit by chartered accountants and if not selected for branch audit, then their LFARs and other certifications should be done by concurrent auditors and they should be submitted to the Managing Director & CEO of the bank.
Banks should in-turn consolidate & compile all LFARs and other certifications submitted by Concurrent Auditors and submit them to Statutory Central Auditor as an internal document of the bank.
Next – let's look at the Procedure for the appointment of Statutory Branch Auditors:
At first, a List of eligible auditors/audit firms will be prepared by ICAI as per the norms laid down by RBI.
This List prepared by ICAI will be scrutinised by RBI – basically for identifying continuing and rested firms and for excluding audit firms that are denied audit.
After this scrutiny, RBI will forward the final list of eligible auditors/audit firms to PSBs for their selection of branch auditors/audit firms.
Each audit firm can now take up audit assignments (branch audit) in one PSB only.
The audit firm should give its consent in writing for appointment as an auditor in the bank for that particular year and subsequent continuing years.
Once they give Consent, it becomes irrevocable and no request for changing the bank after giving consent will be entertained.
After the selection of branch auditors, PSBs should recommend names of both continuing and selected branch auditors to RBI for their prior approval before the actual appointment.
Ok?
Next, let’s look at the general guidelines applicable to the appointment of Statutory Branch Auditors:
SBAs can be appointed for a maximum tenure of four years in a particular bank.
This appointment will be made on an annual basis – because every year the auditor should fulfill the eligibility norms prescribed by RBI from time to time.
In the earlier years, there used to be Compulsory two years rest for audit firms that are located in the specified centres after completion of four years of continuous branch audit. This practice was followed till FY 2019-20. But now, it is done away with.
Instead, when a firm completes four years of continuous branch audit, it will be subjected to the policy and it will be considered for appointment as SBAs in any other PSB.
It means that firms will not be eligible for re-appointment as SBAs IN the same bank for the next cycle of four years.
Banks are advised to select auditors/audit firms who are in close proximity - offices/branches.
Banks should have a suitable mix of categories of auditors/audit firms – i.e., while selecting the branch auditors, they should keep in view the size of the branches.
Banks should allot branches to audit firms only after considering the audit experience of the firm. Specialized and larger branches should be ideally audited by bigger/experienced audit firms
In the case of a Statutory branch audit carried out by SCAs, banks should allot the top 20 branches strictly in order of their level of outstanding advances and it should cover at least 15% of the total gross advances of the bank. i.e., branches audited by SCAs should cover at least 15% of the total gross advances of the bank.
All PSBs should have a Board approved policy for the appointment of statutory auditors and it should be hosted on the bank’s website.
Banks should ensure that the policy framed by the Board for selection of auditors/audit firms and appointment of auditors are strictly adhered to.
A list of firms that are selected for appointment as statutory branch auditors should be placed before ACB/Board of the bank for concurrence before forwarded to RBI for final approval.
Policy of one audit firm for one PSB will be continued – i.e, an audit firm is eligible to be appointed as a central/branch auditor in only one during a particular year”.
Banks that are making appointments of branch auditors for a continuous period of four years, cannot remove audit firms - during the above period - without prior approval of the Reserve Bank of India. (Of course, subject to the condition that, firm satisfies eligibility norms every year).
If a partner or partners in a Firm, is on the Boards of PSBs, then that firm cannot be appointed as auditor for that particular PSB.
If Audit firms are retiring as Statutory Central Auditors of PSB, then it is not eligible for being appointed as SBAs of the same PSB for the prescribed cooling period for SCAs.
LECTURE 8: Eligibility Norms for empanelment of audit firms as statutory auditors of Public
In this session, let us look into the eligibility norms for empanelment of audit firms for being appointed as statutory branch auditors for public sector banks – these provisions are applicable for the period starting from 2020-21 financial year.
For this purpose, audit firms are divided into 4 categories.
Category No. 1, 2, 3 & 4.
Let's see when a firm will be categorized as the No.1 Category Firm.
At least 5 CAs should be associated with the firm on a full-time basis
of that at least 3 CAs should be partners fulltime and
the firm should have at least 8 staffs and
firms should have 8 years of standing.
Not only this, either the audit firm or at least one partner should have a minimum experience of 8 years in branch audit of nationalized bank or private sector bank.
If all those conditions are satisfied, then that firm is eligible for empanelment under Category 1.
Next
A Firm will be classified as category no.2 firm if,
At Least 3 CAs are associated with the firm on a full-time basis
of that at least 2 CAs are partners fulltime and
the firm has at least 6 staffs and
firms should have 6 years of standing (or at least the partner).
Not only this, either the audit firm or at least one partner should have conducted a branch audit of a nationalized or private sector bank for the last 5 years.
That’s about category 2.
Let's move on to Category 3.
A Firm will be classified as category no.3 firm if,
At Least 2 CAs are associated with the firm on a full-time basis
of that at least 1 CAs is a full-time partner and
the firm has at least 4 staffs and
firms should have 5 years of standing (or at least the partner).
Not only this, either the audit firm or at least one of the CA should have conducted a branch audit of a nationalized or private sector bank for the last 3 years.
OK – That’s about Category No.3
Let’s now move on to the last category – Category No.4
Even Proprietorship concern without bank audit experience are eligible for Bank Audit Empanelment but they come under this Category No.4
Here, the condition is:
Proprietorship firm concern should have at least 2 Professional Staffs of which 1 should be Paid CA and the firm should have 3 years of standing.
Since we are talking about Proprietorship firms without bank audit experience of PSB / Private bank, they will be treated at par with partnership firms after deducting their 3 years of seniority from the date of their establishment.
Lecture 9: Procedure for Appointment of Auditor for Banking Company
In this session, let’s look into the procedures for the Appointment of an Auditor for a Banking Company:
In the case of a Banking company, appointments should be made at the annual general meeting of the Shareholders.
If it is a nationalized bank, then appointments should be made by the bank through its Board of Directors. (Already we have discussed the procedure in-depth in the previous sessions)
Whether is Banking Company or Nationalized Bank - Approval of the Reserve Bank of India is required, before the appointment.
In the case of Auditors of the State Bank of India, an appointment will be made by the Comptroller and Auditor General of India in consultation with the Central Government.
If you take the cases of Regional rural banks, the appointment of Auditors will be made by the bank with the approval of the Central Government.
Lecture 10: How to conduct an audit of bank or its branches - Part 1
How to conduct an audit of a bank or its branches?
We are going to talk at length about the process – so I'll divide this topic into a series of lectures.
This is going to part 1.
In this session, our focus is going to be on Initial Considerations by the Statutory Auditor.
Before being appointed as statutory auditor of a bank or its branches, there are certain initial considerations.
No.1
Before appointing statutory central / branch auditors, banks should obtain a declaration of indebtedness from them, to know how much money they owe to the bank. Because significant borrowing by the auditors in the normal course of business will affect the independence of the auditor in framing his audit opinion.
No. 2
A Firm cannot be appointed as central / branch auditors if they have already undertaken any internal assignments in the bank during the same year like concurrent audits.
Ok – These two are important initial considerations that even disqualify the audit firms.
Now, let's look at the critical aspects.
No.3 is with regard to Planning an Audit:
We have SA 300 “Planning an Audit of Financial Statements”. This standard requires an auditor to undertake certain activities before starting an initial audit – what are they?
Item a:
The auditor should Perform procedures required by SA 220, “Quality Control for Audit Work” is with regard to acceptance of the client relationship and that specific audit engagement; and
Item b:
Auditors should Establish an understanding of terms of engagement as per SA 210, “Agreeing on the Terms of Audit Engagements”.
Let's move onto the next critical aspect under Initial considerations:
No.4 – It is Communication with Previous Auditor:
As per Clause (8) of Part I of the First Schedule to the
Chartered Accountants Act, 1949 insists that a Chartered Accountant in practice cannot accept a position as auditor previously held by another chartered accountant without first communicating with him in writing.
Yes! If you are appointed as an Auditor for an entity, you cannot accept that position without communicating with the previous auditor.
It is not a mere communication.
You should get a NO Objection Certificate (NOC) from the previous auditor through this communication.
Because, only in this process, you will get to know whether the previous auditor has any objections to your appointment, for a valid reason.
Next No.5 It is with regard to Terms of Audit Engagements:
We have SA 210 on “Terms of Audit Engagements” and it requires the auditor should agree on the terms of the audit engagement with the bank before beginning significant portions of fieldwork and it has to be done for
each period to be audited.
These terms of the engagement should be documented
-to prevent any confusion on terms that are agreed between Management and Auditor (at the beginning of assignment with regard to audit)
Ok – Well move on No.6 – It is with regard to Initial Engagements:
We have SA 510 “Initial Audit Engagements-Opening Balances” – Auditor should perform audit procedures as mentioned in this SA.
This standard focuses on Opening Balances.
After performing the procedures prescribed in SA 510, IF auditor comes to a conclusion, that opening balances contain misstatements and if they are going to materially affect the financial statements for the current period and if the effect of the same is not properly accounted and adequately disclosed, then, the auditor should express a qualified opinion or an adverse opinion, as required.
Once again I repeat – As an Auditor, you are performing procedures prescribed in SA 510.
You come to a conclusion that opening balances contains misstatement.
You believe those misstatements are going to materially affect the financial statements for the current period.
But the bank is not making proper accounting for the effects and the bank is also not adequately disclosing them in Financial Statements.
In those cases, as an auditor, you have to express a qualified opinion or an adverse opinion depending on the situation.
No.7 is with regard to the Assessment of Engagement Risk.
This is a critical part of the audit process and it should be done before acceptance of an audit engagement because this will affect the decision of accepting the engagement itself and will also help in planning decisions if the audit is accepted.
No.8 is with regard to Establishing an Engagement Team
We can say, having a Qualified & experienced professional is an important component of managing engagement risk.
The size and composition of the engagement team would actually depend on the size, nature, and complexity of the bank’s operations.
Moving on to the last item – No.9 – It is with regard to Understanding the Bank and its Environment:
We have SA 315 “Identifying and Assessing the Risks of Material Misstatement Through Understanding the Entity and Its Environment”. This SA says, an auditor should get a sufficient understanding of the entity and its environment, including its internal control, so he can identify the risks, assess the risks which can arise on fraud and error and which can cause material misstatement in the financial statements.
With this, the Auditor should be able to design and perform further audit procedures.
Lecture 11: How to conduct an audit of bank or its branches - Part 2
Let’s move on to the second part of our discussion - How to conduct an audit of a bank or its branches?
The next important approach is about Identifying and Assessing the Risks of Material Misstatements
We have SA 315 and it requires the auditor to identify and assess the risks of material misstatement at two levels.
at the financial statement level
at the assertion level
This should be done for
classes of transactions,
account balances and
disclosures
Only by doing this way, the Auditor will get an idea for designing and performing further audit procedures.
The next approach is Understanding the Bank, its Environment and Internal Control:
Only by understanding the bank, its environment, and internal controls, the auditor will be able to
-identify and assess risk;
And only then, Auditor will be able to
-develop an audit plan.
With this, the auditor will be able to determine the operating effectiveness of the controls and he will be in a position to address specific risks.
The next approach is Understanding the Bank’s Accounting Process:
This is the most important process – here the auditor should take all steps and efforts to understand the accounting process adopted by the bank because it only produces financial and operational information for management’s use and it only contributes to the bank’s internal control.
So, understanding the accounting process is a very important part and it will enable the auditor to
-to identify the risks
-to assess the risks
of material misstatement which can arise on account of fraud
and it will also enable the auditor to design and perform further audit procedures.
Lecture 12: How to conduct an audit of bank or its branches - Part 3
Let’s move on to the third part of our discussion on How to conduct an audit of a bank or its branches?
In this session, we are going to discuss exclusively Understanding the Risk Management Process.
i.e., the Auditor should develop an understanding of How the Bank has deployed various processes to manage its risks.
For Risk Management, the Management team will be generally deploying various controls and they will be using various performance indicators – These controls and indicators will be helping them in managing key business risks and financial risks.
Ok,
In order to manage the risks in an effective way, banks will be requiring certain processes and I'll take you through them one by one. So, as an Auditor, you can develop an understanding of the risk management process.
No.1
Oversight and involvement in the control process by those charged with governance:
Yes! People who are charged with governance (Board of Directors/Managing Director) should approve written risk management policies.
When I say, People who are charged with governance, it's basically the Board of Directors / Managing Director – I mean.
And that Risk Management Policy should be consistent, with the bank’s business objectives and strategies.
It should take care of
capital strength of the bank,
The expertise of Management,
Regulatory requirements
Types and amounts of risk that are considered as acceptable.
The second process which banks should adopt to manage risk is
Identification, measurement, and monitoring of risks:
There will be certain risks that could significantly affect the achievement of the bank's goals.
Those risks should be identified, measured, and monitored against pre-approved limits and criteria.
The third way through which banks can manage risk is through Control Activities:
Banks should have appropriate controls in place to mitigate their risks.
It should have effective segregation of duties (especially between front and back offices).
It should have controls for accurate measurement and reporting of positions.
It should have controls for verification and approval of transactions.
It should have controls for
reconciliation of positions and results
setting up limits
reporting and approval of exceptions
physical security
and also for contingency planning.
Let's move onto the next – i.e., 4th process in Risk Management – It is by Monitoring activities:
Banks will be having Risk management models, methodologies, and assumptions. Using these only they will be measuring and mitigating risks. These should be regularly assessed and updated and this function can be done by an independent risk management unit. Generally, banks will be having a Risk Management Department for this purpose.
The next way to Manage Risk is by having a Reliable information system:
Banks would need reliable information systems.
Those Information Systems should provide 3 types of information on a timely and consistent basis.
What are they?
They are financial information, operational information, and compliance information.
All these should be made available on a regular basis and it should be easily understandable.
Only then, people who are charged with governance and management will be able to understand the changing nature of the bank's risk profile and take necessary appropriate actions.
How to conduct an audit of bank or its branches - Part 4
Let’s move on to the 4th part of our discussion on How to conduct an audit of a bank or its branches?
In this session, we are going to discuss several matters.
To start with,
Engagement Team Discussions
Already we touched on this – as to What is Engagement Team & Engagement Team Discussions.
This discussion should happen to get a better picture & understanding of
bank
its environment
its internal control
and also to assess the potential/possibilities for material misstatements in the financial statements.
The next important process is the conduct of Audit is Establishing an Overall Audit Strategy
We have SA 300 “Planning an Audit of Financial Statements’’.
As per this standard, an auditor should plan his audit in such a way, so that audit can be performed in an effective way.
For that, the auditor should establish the overall audit strategy before the commencement of the audit.
While establishing the overall audit strategy,
he has to involve
key engagement team members
and if required, he should also engage appropriate specialists depending on the characteristics of the audit engagement.
Next comes the Development of Audit Plan:
Just now, I stressed SA 300 which deals with the auditor’s responsibility to plan an audit of financial statements in an effective manner.
This standard requires the involvement of all the key members of the engagement team while planning an audit.
Next, we’ll move on to Audit Planning Memorandum:
Having made the Audit Plan, the Auditor should summarize it by preparing an audit planning memorandum.
No. 1
The audit planning memorandum should
Describe what is the expected scope of the audit and to what extent audit procedures should be performed by the auditor.
No. 2
The auditor / Audit team would have identified various issues and risks during their planning & risk assessment activities. They also would have made certain discussions on to what extent they can place reliance on controls.
So, the Audit Planning Memorandum should highlight all those significant issues and risks that are identified during their planning and risk assessment activities, as well as the decisions concerning reliance on controls.
No. 3
Appropriate Planning of Audit Engagement is an important area.
Let’s say, after the audit, some issue has arisen with respect to the audit, and the auditor is called to explain his part.
In such a situation, the auditor should be in a position to provide evidence that they have planned Audit Engagement appropriately and have taken care of different types of risks and matters affecting audit engagement.
So, Audit Planning Memorandum should Provide evidence that they have planned the audit engagement appropriately and have responded to engagement risk, pervasive risks, specific risks, and other matters affecting the audit engagement.
How to conduct an audit of bank or its branches - Part 5
Let’s move on to the 5th part of our discussion on How to conduct an audit of a bank or its branches?
First, our focus is on determining audit materiality
the auditor should see the relationship between audit materiality and audit risk while conducting his audit.
It's because immaterial items may not lead to significant audit risk And material items should not be missed out because they lead to significant audit risk.
so the question is how to quantify the materiality?
it is basically a matter of professional judgment
the auditor should come to this judgment based on his professional expertise based on his assessment of the engagement risk and it should also be based on reporting requirements for the financial statements
meaning - what can be a material item in one situation or for one set of a client may not be material for some other client or some other set of situation
so it's here auditor should make a professional judgment he should use his professional expertise
and already he would have assessed what kind of risk he may come across in this particular audit engagement - he should frame his opinion about materiality by factoring in this element as well
And on various occasions, reporting requirements for financial statements will insist certain items to be disclosed despite being of small value. so that aspect should also be kept in mind
The next auditor should also consider whether the bank will continue as a going concern or not?
For that, the Auditor should see whether there are any events, conditions that are likely to affect the going concern of the bank?
If the answer is yes, he should approach his audit accordingly.
The Next area is the Assessment of the Risk of Fraud including Money Laundering.
With regard to this, we have SA 240 “The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements”.
As per the standard, it is the objective of the auditor to identify and assess the risk of material misstatement in the financial statements which can arise on account of fraud.
so the auditor should keep this element, that is the possibility of fraud and its consequent impact on the financial statements.
and if he comes across an occurrence of fraud, then he should collect sufficient - I can say - sufficient appropriate audit evidence on those matters which are causing misstatement in the financial statement and he should respond appropriately on those issues.
As already mentioned in one of the earlier lectures, the auditor should not take anything for granted - rather he should maintain his professional skepticism throughout the audit - only then he will be able to recognize the possibilities of misstatements that can arise in financial statements because of fraud.
Here, the auditor should not only be guided by SA 240, but he should also take into account various guidelines that are issued by RBI from time to time with regard to money laundering with regard to KYC norms.
actually, there is a guideline called
know your customer guideline - anti-money laundering standards
This guideline requires banks to establish policies, procedures, and controls so that they will Deter money laundering activities.
but in some cases despite all this money laundering will take place right?
so in those cases, their procedures and controls should be able to recognize and report those money laundering activities.
the auditor should go through that as well.
The next part is assessing specific risks.
that is, should identify whether there is any risk of material misstatement at the financial statement level?
if yes he should assess that risk - Because the risk of material misstatement at the financial statement level is a pervasive risk and it will affect financial statements as a whole and it will also potentially affect many assertions made.
Next
the auditor should focus on risk associated with Outsourcing activities
In our initial discussions, we have understood that banking operations involve extensive use of Technology and it requires various levels of expertise.
all this expertise may not be available internally.
so banks may Resort to outsourcing various activities.
when they outsource activities, it comes with various risks - so it is essential for the Bank to effectively manage those risks and the auditor should check what steps are taken by the banks to manage those risks.
The next aspect is auditors response to assessed risk:
for this, we have SA 330 “The Auditor’s Responses to Assessed Risks”
This standard requires the auditor to design and implement overall responses to address the assessed risk of material misstatement at the financial statement level.
That is, when the audit process identifies material misstatement, what kind of response auditor should give or react to those statements - that's what I mean by saying the auditor should design and implement overall responses.
The material misstatement identified by the auditor will help him to design and perform further audit procedures.
what should be the nature of those procedures, how long Audit should be conducted on those items, extent of it everything will be based on the assessed risk of material misstatement at the assertion level.
The next area is stress testing:
it is basically a software testing activity
This will help the auditors to determine the robustness of the software by testing beyond the limits of normal operation.
The Reserve Bank of India has already mandated all commercial banks to have a stress testing framework - that Framework has to be approved by the board and it should be in place for all commercial banks - so we can say this stress testing is basically a part of the risk management system - and the auditor should also go through this.
Next is Reliance/review of other reports:
Generally, banks will be subjected to different types of audits in a year.
they will have a concurrent audit
they will have their own credit audit/inspections/income leakage audits
then Reserve Bank will also be conducting an inspection
so the auditor should take into account adverse comments in all those Audit and inspection reports.
in particular, he should look for adverse comments in
l Previous year’s audit reports.
l Latest internal inspection reports of bank officials.
l Reserve Bank’s latest inspection report.
l Concurrent / Internal audit report.
l Report on verification of security.
l Any other internal reports especially related to particular accounts.
l Manager’s charge-handing-over report when the incumbent is changed.
so all the above reports have to be reviewed in detail by the auditors.
Central auditors, in particular, should review the annual financial Inspection Report of Reserve Bank of India and whatever the variations in provisions reported by Reserve Bank of India should have been properly considered by the bank management and account for - the auditor should check whether it is reflecting correctly in financial statements.
with regard to substantive procedures,
the auditor should audit all large advances without exception
Other advances and small advances can be checked on a sampling basis - but even in other advances if accounts are found to be a problem account, then that should be verified in detail.
Now the question arises how to select the sample accounts
for that answer is auditor's assessment of the efficacy of internal controls
if internal controls are strong auditor can go for a smaller number of units
if internal controls are weak auditor should go for a higher number of units for verification
again another question will arise: how to consider and advance as large an advance?
the answer for this will be linked to the volume of operations of the branch.
If the year-end balance in the advance account is greater than Rs.2 Cr or 5% of aggregate year-end advances of the branch, whichever is less, then that advance can be called a large advance.
ok with this we have come to the end of how to approach Bank audit
what we discussed in the section so far is only the broader layout
will go item by item in depth in the following sessions
Classification of Advances
In the session let's look at the classification of advances
from the bank's point of your advances can be classified on the basis of
Sector
Security
Prudential norms
first, let's look into the sector-wise classification
sectors can be further subdivided into
priority sector
non-priority sector
Reserve Bank of India has issued common guidelines with respect to priority sector lending.
These guidelines have to be followed by all the banks
guidelines are with reference to
rate of interest
service charges
Receipt
Sanction
Rejection
disbursement register
issue of the loan application
acknowledgment et cetera
Reserve Bank has also issued targets for banks for priority sector lending
lending for agriculture, m s m e, education, housing, and all comes under priority sector lending.
Lending to sectors other than the priority sector will be called non-priority sector lending
Let's go to the second category
that is a classification of advances on the basis of security
Here advances can be classified as
secured advance
unsecured advance
if a bank takes security for giving advance, then that will be called a secured advance
if no security is taken then it will be called an unsecured advance
security can be further classified as
primary security
Collateral security
So what is primary security?
It is the security offered by the borrower as principal security for the advance.
that is in the event, It is this security which will be enforced first.
generally, it is the security against which the advance will be given by the bank or it is a security that is created out of the advance.
the next classification of security was Collateral security
security is basically additional security and it can be in any forms like
tangible asset
intangible asset
moveable asset
immovable asset
let me also list out some of the common types of securities that are accepted by the banks:
They are
personal security of guarantor
immovable property
third party guarantee
goods stocks debtors trade receivables
gold ornaments and Bullion
bankers general lien
Life insurance policies
stock exchange securities and other instruments
plantations in case of Agricultural advances
let us move on to the third classification that is based on Prudential norms
here advances can be classified as
standard advance
NPAs
Standard advances are those advances that are not NPAs.
It means, standard advances still generate income for the bank, interest, and principal are either serviced regularly or the delay / overdue has not yet touched 90 days from the due date in case of term loans.
Then a question arises
What is NPA?
An asset will become NPA if it ceases to generate income for the bank.
if you take a term loan for example:
If Interest is not paid for more than 90 days from the due date, then that TL becomes NPA.
Similarly, if the principal is not paid for more than 90 days from the due date, then that TL will become NPA.
if both interest and principal are not paid for more than 90 days from the due date, then also that TL will become NPA.
when a term loan of a particular borrower becomes a non-performing asset, then all other credit facilities availed by that borrower will also become a non-performing asset for the bank.
it means non-performance asset classification is with respect to borrowers and not just confined to a facility.
Let me give you another example
let's take the case of overdraft or cash credit facility
if this overdraft or cash credit facility remains out of order then that account will become a non-performing asset.
This will give rise to a further question: what is out of order?
If the outstanding balance continuously exceeds the sanctioned limit or drawing power for a period of 90 days, then we say the account is out of order.
That means if the outstanding balance in cash credit or overdraft is greater than the sanctioned limit or drawing power for a period greater than 90 days then that account has become out of order and as a result it becomes NPA.
this is one aspect of out-of-order.
In some cases, outstanding balance in cash credit or overdraft may be within the sanctioned limit or drawing power but there would have been no credit continuously for 90 days or more as on the date of the balance sheet- in that case, also the account will be treated as out of order and will be classified as a non-performing asset.
In some cases, there will be credits in the account but those credits would not have been sufficient enough to cover the interest debited during the same period - in those cases also the account will be treated as out of order and eventually classified as a non-performing asset.
let me give you an example:
a company was sanctioned at a cash credit facility of rupees 50 lacs but as per the stock statement furnished for the last quarter, drawing power is only 42 lacs.
in this scenario, this account can be termed as out of order,
if the outstanding balance continuously exceeds Rupees 42 lacs ( in this case 42 lacs is the drawing power) even though the customer is having a sanctioned limit of 50 lacs, he is eligible to draw only 42 lacs and any outstanding beyond 42 lacs will render this account to be irregular and if that irregularity continues for 90 days account will become out of order and get classified as NPA.
let's continue with the same example
Let's say the outstanding balance in this account is rupees 42 lacs only.
That is it is exactly matching with the drawing power.
but for the past 90 days or more, there are no credits into this account as of the date of the balance sheet.
Then for this reason also this account can be termed as out of order and get classified as a non-performing asset.
let's continue with the same example.
it scenario 3
let say Rupees 5 lacs is the interest debited during the period.
but only Rupees 200000 has been credited so far.
So here there are some credits but they are not sufficient enough to cover the interest debited during the same period.
so because of this reason also accounts can be termed as out of order and can get classified as non-performing assets.
What is a Bank audit?
It is a procedure performed by an auditor appointed by RBI and ICAI to verify the financial statements of the banking institutions and to verify whether the bank is complying with the applicable regulatory framework or not.
It is not something which you will regularly undertake all the days of a year. Instead, for most of the auditors and audit firms, it's a one-time exercise in a year and as a result, knowledge level on the critical areas for most of the auditors will be limited.
So, several auditors and audit firms have to update themselves with the latest guidelines and provisions applicable by attending various seminars and by reading various publications.
However, many have felt the need for a one-shot course on Bank Audit and they wanted it to be handy, available in an app or website so they can prepare themselves for the audit upfront and during the course of the audit, they can refer to guidance materials.
All their wishes are going to materialize with this course!
Welcome to your course Bank Audit A Complete Study
In this course, you will get to learn about
1) What is Bank Audit?
2) Who is eligible for Bank Audit?
3) How to Approach a Bank Audit?
4) How Auditors are appointed for Banking Companies?
5) How to conduct an audit of a bank?
6) Advances
7) Fund Based Working Capital Facility (Concepts & Case Studies)
8) Non - Fund Based Working Capital Facilities
9) Term Loan (Concepts & Case Studies)
10) Mode OF Creation Of Security
11) Non-Performing Asset
12) Income Recognition
13) Willful Defaulter
14) Audit of Advances
15) Consortium Advances
16) Audit of Revenue Items
17) Audit of Expenses
18) Verification of Cash Balance
19) Verification of Cash Balance
20) Verification of Investments
21) Verification of Bills Purchased / Discounted
22) Fixed Asset & Other Assets Verification
This course is structured in a self-paced learning style. Requesting you to use your headphones for a better learning experience. Also, keep a notepad & pen alongside to take keynotes.
See you inside the course!
Note: This course is prepared based on audit guidelines applicable to Banks India.