Policy ID: PCI/POL/12/2026-27 • Version 1.0 Owner: Head of Internal Audit • Approver: Board of Directors Sources: AUD • Review: Annual / regulatory change
Purpose and application
Mandatory for all deposit-taking NBFCs and non-deposit-taking NBFCs with assets of ₹5,000 crore or more; adopted proportionately below threshold.
1. Audit universe:- Maintain the complete universe of activities, branches, systems and vendors. Audit shall independently assess inherent risk and control risk annually, considering losses, regulatory findings, business change, complexity and prior results.
2. Scoring and frequency:- Use a Board-approved scoring method. Under the approved Company audit frequencies, audit high- risk units annually, medium-risk units within 24 months and low-risk units within 36 months. Reassess sooner on an incident; Board shall approve a maximum audit cycle.
3. Risk-focused testing:- Link each engagement to material risks and expected controls. Combine analytical review, system testing and selective transaction testing. Assess governance and effectiveness, rather than merely checking vouchers. Risk management remains a separate second-line function.
4. Authority and resources:- Board/Audit Committee shall approve the risk-based plan, staffing and budget. Head of Audit shall be independent, sufficiently senior and appointed with appropriate tenure. The covered internal audit function shall not be outsourced; paragraph 39 permits controlled specialist hiring with internal report ownership.
5. Continuous improvement:- Update risk ratings using findings and emerging risk. Maintain action tracking and validate remediation independently. The Audit Committee shall review coverage, overdue issues and quality at least quarterly as Company practice; annual policy/ quality review is required.
Source codes are linked to the Reference Register. Read with the common implementation controls and relevant annexes. Applicable law and RBI Directions prevail.