Internal and Forensic Audit · Special Points relating to Internal Audit in various Entities

Internal Audit in Banking Companies: RBIA and Concurrent Audit

Updated 11 October 2026 · Fact-checked

Internal audit in a bank is an independent review of its branches, departments and processes to test risk management, controls and governance. Banks follow a risk-based internal audit (RBIA) approach, with concurrent audit covering high-risk areas close to real time. To answer, state the scope, the approach, then the audit steps for the area asked.

Understand Internal Audit in Banking Companies

A bank handles public deposits and lends them out. So its risks are larger and more varied than those of a normal company: credit risk, market risk, liquidity risk, operational risk, fraud and compliance risk. Internal audit gives the board and management an independent view on whether these risks are controlled.

The RBI expects banks to run a strong internal audit function that reports to the Audit Committee of the Board. The function should be independent of the business lines it audits. It covers the whole bank: branches, central processing units, treasury, IT systems, head office departments and outsourced activities.

Risk-based internal audit (RBIA) replaces the old transaction-testing approach. Instead of checking every area equally, the auditor assesses the inherent risk of each unit or process and the quality of its controls. Audit frequency and depth then follow the risk level. High-risk units are audited more often and in more detail. The audit plan is approved by the Audit Committee.

Concurrent audit is an audit done during or very soon after the transactions, usually by an outside firm of chartered accountants or by the bank's own staff. It is meant for areas where early detection matters, such as large advances, treasury operations, high-value branches and sensitive transactions. The bank decides the coverage based on its own policy and RBI guidance. Concurrent auditors report to the bank's management and the Audit Committee, and their findings must be followed up and closed.

Key areas you must know are advances, treasury, KYC and anti-money laundering compliance, NPA identification and provisioning, deposits, cash and remittances, and IT and cyber controls. In each area you test whether policy exists, whether it is followed, and whether the records are accurate.

Key rules to remember

Risk-based audit logic: Audit priority = Inherent risk × Control weakness; This is a way to remember the idea, not a prescribed formula. Higher risk with weaker controls means more frequent and deeper audit.
NPA classification (general rule): Loan is NPA when interest or principal stays overdue for more than 90 days; This is the general RBI rule for term loans. Special norms apply to some facilities, such as agricultural advances and out-of-order cash credit or overdraft accounts. Check the current RBI norms when answering.
Asset categories: Standard → Sub-standard → Doubtful → Loss; Asset classification moves down based on how long the asset stays non-performing and on its recoverability. Provisioning rates rise with each category.
Three lines of defence: Business unit (1st) → Risk and compliance (2nd) → Internal audit (3rd); Internal audit is the independent third line and must not take business decisions.

How to solve Internal Audit in Banking Companies questions

Use this method for any question on internal audit in banks, whether it asks for scope, approach or a specific area.

1Identify what the question asks: scope, approach (RBIA or concurrent) or a named area such as advances, KYC or NPAs.
2State the context in one or two lines: bank risks, independence, and reporting to the Audit Committee.
3Give the relevant approach. For RBIA, mention risk assessment, risk-based plan, frequency and depth. For concurrent audit, mention timing, coverage and reporting.
4List the audit checks for the area in a logical order: policy, authorisation, documentation, monitoring, accounting and reporting.
5Apply the facts of the case. Name the control gap, its risk and the likely impact on the bank.
6Give a clear conclusion and recommendations, and mention follow-up with the Audit Committee.

Quickest way: Policy, process, proof, reporting

When to use it: Use this when time is short and the question asks what an internal auditor should check in a bank area.

Policy: is there a board-approved policy and are limits set?
Process: was it followed, with proper sanction and authority?
Proof: are documents, security, KYC and accounting entries complete and correct?
Monitoring: is the account or activity reviewed, and are early warning signs acted on?
Reporting: are findings reported to the Audit Committee and followed up?

Common mistakes in Internal Audit in Banking Companies

Treating bank internal audit like a company's internal audit, with equal coverage everywhere.
Students rely on general internal audit notes.
Fix: Stress the risk-based approach: assess risk first, then decide frequency and depth of audit.
Confusing concurrent audit with statutory audit.
Both are done by outside chartered accountants in many cases.
Fix: Concurrent audit is a management control tool done close to the transaction. Statutory audit gives an opinion on the annual financial statements.
Stating the 90-day NPA rule as universal.
It is the most remembered rule.
Fix: Say it is the general rule and mention that special norms exist for some facilities.
Listing advances checks without sanction, security and end-use steps.
Students focus only on NPAs.
Fix: Cover the full life cycle: appraisal, sanction, documentation, disbursement, end-use, monitoring and recovery.
Ignoring who the auditor reports to.
Students focus on checks and forget governance.
Fix: Always mention independence and reporting to the Audit Committee of the Board.

Worked examples

Example 1

Explain how an internal auditor would audit the advances portfolio of a bank branch.

Show the solution

Context: advances carry the highest credit risk in a bank, so they are a high-risk area for RBIA.
Policy check: confirm that lending follows the board-approved credit policy, delegated powers and exposure limits.
Appraisal and sanction: test a sample of loans for proper credit appraisal, sanction by the competent authority and compliance with sanction terms.
Documentation and security: check that loan documents are executed, charges are created and registered, valuation and insurance of security are current.
Disbursement and end-use: confirm disbursement followed conditions and that funds were used for the stated purpose.
Monitoring: review stock statements, renewal of limits, drawing power, and early warning signals such as irregular accounts.
Classification: verify that asset classification and provisioning follow RBI norms and that income is not booked on NPAs.
Report gaps with risk ratings and recommendations to the Audit Committee, and track closure.

Answer: The auditor tests advances across the whole life cycle: policy, sanction, documentation, disbursement, end-use, monitoring and NPA classification, then reports gaps to the Audit Committee with follow-up.

Example 2

A concurrent auditor of a bank finds that several large cash withdrawals were approved at a branch without proper KYC refresh and without alerts being reviewed. What should the auditor do?

Show the solution

Provision: the bank must follow KYC and anti-money laundering requirements, including customer due diligence and monitoring of transactions.
Analysis: the facts show weak customer due diligence and unreviewed alerts, which raise money-laundering and fraud risk.
Verify the extent: test more transactions, check the alert logs, and find who approved the withdrawals and under what authority.
Assess impact: possible regulatory breach, reporting gaps for suspicious transactions and reputational risk.
Report: record the finding in the concurrent audit report to branch and head office, with a risk rating, and escalate to the Audit Committee if it is significant.
Recommend: complete the KYC updates, review alert handling, train staff and track closure in the next audit.

Answer: The auditor should confirm the extent of the lapse, assess the regulatory and fraud risk, report it promptly with a risk rating, recommend corrective action and follow up until closure.

Exam tips

Open every answer with the bank context: public money, high risk, Audit Committee reporting.
For scope questions, use short bullets by area: advances, treasury, KYC, NPAs, deposits, IT.
For case questions, follow provision, analysis, conclusion, and add one drafting or compliance point.
Say that risk drives frequency and depth under RBIA. Examiners look for this idea.
Check the latest RBI norms before relying on any rule or limit, and use cautious wording where norms vary.

Practice questions from Special Points relating to Internal Audit in various Entities

Internal Audit in Banking Companies in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit in Banking Companies: frequently asked questions

What is risk-based internal audit in banks?

It is an approach where the audit plan, frequency and depth depend on the assessed risk of each unit or process. High-risk areas are audited more often and in more detail. The plan is approved by the Audit Committee.

What is concurrent audit in a bank?

It is an audit done during or soon after transactions to detect errors and fraud early. It usually covers high-risk areas such as large advances, treasury and high-value branches. Findings go to management and the Audit Committee.

How is concurrent audit different from statutory audit?

Concurrent audit is a continuous management control tool focused on current transactions. Statutory audit is a yearly audit that ends in an opinion on the financial statements.

What should an internal auditor check in a bank's advances?

Check sanction authority, appraisal, documentation, security, end-use, monitoring and asset classification. Also test provisioning and income recognition against RBI norms.