Policy ID: PCI/POL/11/2026-27 • Version 1.0 Owner: Head of Internal Audit / Audit Committee • Approver: Board of Directors Sources: AUD, COM • Review: Annual / regulatory change
Purpose and application
All functions; RBI’s mandatory RBIA framework applies to specified NBFCs.
1. Independence:- The Head of Internal Audit shall report functionally to the Board/Audit Committee with unrestricted access to records, systems and staff. Auditors shall not own the processes they audit or approve business transactions.
2. Planning and scope:- Prepare an annual risk-informed audit plan covering branches, KYC, origination, collection, accounts, IT, complaints and outsourcing. Include compliance/risk functions and follow-up audits. Obtain Board/Audit Committee approval and adequate staffing.
3. Execution:- Use documented objectives, sampling rationale, workpapers and evidence. Verify borrower files, ledger reconciliations, approvals and control design/operation. Discuss factual findings with owners without allowing them to suppress conclusions.
4. Findings and closure:- Rate findings critical/high/medium/low with root cause, owner and deadline. Escalate serious fraud/regulatory breaches immediately. Close issues only after independent evidence testing; repeated or overdue high risks shall go to the Audit Committee.
5. Quality and reporting:- Maintain secure workpapers under the retention schedule and legal holds. Issue quarterly completion/issue reports. Conduct annual quality assessment and preserve auditor competence. For covered NBFCs, the internal audit function shall not be outsourced; specialist expertise may be hired only under paragraph 39 safeguards, with report ownership retained internally.
Source codes are linked to the Reference Register. Read with the common implementation controls and relevant annexes. Applicable law and RBI Directions prevail.