Skip to content

Internal and Forensic Audit · Special Points relating to Internal Audit in various Entities

Internal Audit in Non-Banking Financial Companies (NBFCs)

Updated 11 October 2026 · Fact-checked

Internal audit in an NBFC is an independent check of its lending, credit appraisal, asset classification, provisioning and regulatory compliance against RBI directions and board policy. You solve questions by naming the risk, the control, the test, the likely finding and the report to the Audit Committee.

Understand Internal Audit in Non-Banking Financial Companies

A Non-Banking Financial Company (NBFC) lends and invests like a bank but does not hold a banking licence. It cannot accept demand deposits and is not part of the payment and settlement system as a bank is. It is regulated by the Reserve Bank of India (RBI) under the RBI Act, 1934, and, if it is a company, also by the Companies Act, 2013.

Because its business is credit, an NBFC's biggest risks are credit risk, liquidity risk, fraud and non-compliance. Internal audit exists to tell the board and the Audit Committee whether controls over these risks work. It is not a once-a-year check of the books. It is an ongoing, risk-based review of how loans are sourced, appraised, sanctioned, disbursed, monitored and recovered.

RBI expects NBFCs to have a board-approved internal audit framework. The internal audit function should be independent of the business, report to the Audit Committee or the board, and be staffed with competent people. RBI's scale-based regulation places NBFCs in layers. Larger and more complex NBFCs face stricter governance, risk management and compliance expectations. Always check the layer of the NBFC in the question before you state what applies. Do not quote a requirement as universal if it depends on size or type.

The audit focus areas are these:

  • Lending and credit appraisal: KYC, borrower assessment, repayment capacity, security, sanction within delegated authority, documentation and end-use checks.
  • Asset classification and provisioning: correct identification of stressed accounts, classification as per RBI norms and adequacy of provision.
  • Compliance: returns to RBI, fair practices code, interest rate policy, KYC and anti-money laundering rules, and prudential norms.
  • Governance and IT: Audit Committee oversight, outsourcing controls, system access and data integrity.

A bank is audited under a heavier RBI framework, such as risk-based internal audit and concurrent audit of branches. An NBFC has no branch-level banking operations like deposits and clearing. Its audit centres on credit, funding, asset quality and regulatory returns.

Key rules to remember

Audit flow for any NBFC question
Risk → Control → Test → Finding → Recommendation → Report to Audit Committee
Use this chain to structure every written answer.
Credit cycle to audit
Sourcing → KYC → Appraisal → Sanction → Documentation → Disbursement → Monitoring → Recovery
Each stage has its own control points and tests.
Gross NPA ratio
Gross NPA ratio = Gross NPAs ÷ Gross advances × 100
Useful to show asset quality trend to the Audit Committee.
Provision coverage
Provision coverage ratio = Provisions held ÷ Gross NPAs × 100
Shows how much of the bad loans is covered by provisions. Required provision rates come from RBI norms; do not guess them.
Independence rule
Internal audit reports to Audit Committee or board, not to the business head
Independence is the first thing an examiner looks for.

How to solve Internal Audit in Non-Banking Financial Companies questions

Use the same method for a case, a checklist question or an explain-the-role question. It keeps your answer structured and gives the examiner the provision, analysis and conclusion.

  1. 1Identify the entity: deposit-taking or not, its layer under RBI scale-based regulation, and its business such as gold loans, vehicle finance or microfinance.
  2. 2Name the area under audit: credit appraisal, asset classification, compliance, IT or governance.
  3. 3State the relevant RBI expectation or board policy in plain words. Do not cite a circular number unless you are sure of it.
  4. 4List the key risks in that area, such as weak KYC, sanction beyond authority, ageing of overdue accounts not tracked, or late returns.
  5. 5Describe the audit tests: sample files, recompute overdue days, check approvals, reconcile system data to the ledger, review returns filed.
  6. 6Report the likely findings from the facts given and rate their severity.
  7. 7Recommend corrective action, owner and timeline, and say the report goes to the Audit Committee with follow-up.
  8. 8Conclude in one line on whether controls are adequate.

Quickest way: Credit cycle checklist method

When to use it: Use it when time is short or the question says 'prepare a checklist' or 'state audit points'.

  1. Write the credit cycle stages as headings in one line.
  2. Under each stage, give one control and one test in a short bullet.
  3. Add three extra headings: asset classification, regulatory compliance, governance.
  4. Close with the reporting line to the Audit Committee and follow-up of open points.

Common mistakes in Internal Audit in Non-Banking Financial Companies

  • Treating NBFC internal audit as identical to bank audit.

    Both are RBI regulated and both lend.

    Fix: State the difference: an NBFC has no deposit and clearing operations as a bank does, so the focus is credit, funding, asset quality and returns.

  • Writing only generic internal audit theory.

    Students recall the chapter on the internal audit process and stop there.

    Fix: Tie every point to NBFC facts such as loan files, overdue ageing, KYC and RBI returns.

  • Quoting exact RBI circular numbers, dates or provision percentages from memory.

    Students want to look precise.

    Fix: Describe the rule in words and say 'as per RBI norms'. A wrong figure costs more than a general statement.

  • Ignoring the type and size of the NBFC.

    The question seems to apply to all NBFCs.

    Fix: Open with a line on the NBFC's layer and whether it takes deposits, then apply requirements accordingly.

  • Stopping at findings without recommendations or reporting.

    Time pressure.

    Fix: Always add action, owner, timeline and the Audit Committee follow-up.

  • Letting the auditor approve loans or fix classification.

    Confusion between assurance and management roles.

    Fix: The auditor tests and reports. Management classifies and provides.

Worked examples

Example 1

Sunrise Finance Ltd, a non-deposit-taking NBFC, gives vehicle loans. The internal auditor samples 40 files and finds 6 where the borrower's income proof is missing and 3 where the sanction was beyond the branch manager's authority. Explain the findings and recommendations.

Show the solution
  1. Identify the area: credit appraisal and sanction, the core control in an NBFC.
  2. Compute the exceptions: 6 of 40 is 15% for missing income proof, and 3 of 40 is 7.5% for sanction beyond authority.
  3. Analyse: missing income proof means repayment capacity was not assessed, raising credit risk. Sanction beyond authority breaches the board's delegation and is a governance lapse.
  4. Rate severity: sanction beyond authority is high since it bypasses approval control. Missing income proof is high-medium since it weakens appraisal.
  5. Recommend: obtain missing documents or record the reason, system block on disbursement without mandatory documents, a system-enforced authority matrix, and ratification by the proper authority for the 3 cases.
  6. Report to the Audit Committee with a timeline and a follow-up review of a fresh sample.

Answer: The audit finds appraisal and delegation weaknesses (15% and 7.5% exceptions). It recommends system-enforced document and authority controls, ratification of the 3 loans, and a reported follow-up to the Audit Committee.

Example 2

An NBFC has gross advances of ₹500 crore and gross NPAs of ₹25 crore. Provisions held against these NPAs are ₹10 crore. Compute the gross NPA ratio and provision coverage ratio, and state what the internal auditor should do.

Show the solution
  1. Gross NPA ratio = 25 ÷ 500 × 100 = 5%.
  2. Provision coverage ratio = 10 ÷ 25 × 100 = 40%.
  3. The auditor does not decide whether 40% is enough. The auditor recomputes the provision required under RBI norms account by account and compares it with ₹10 crore.
  4. The auditor also tests that overdue days are counted correctly and that no account was kept standard through improper restructuring or evergreening.
  5. Any shortfall is reported to the Audit Committee, along with the effect on profit and the capital position.

Answer: Gross NPA ratio is 5% and provision coverage ratio is 40%. The auditor should verify classification and required provisions against RBI norms and report any shortfall to the Audit Committee.

Exam tips

  • Begin with one line on the NBFC's type and layer, then move to the audit area. It shows you read the facts.
  • Use the credit cycle as your skeleton. It lets you write a full checklist quickly.
  • Always compare NBFC with bank when the question says 'difference'. Two or three points are enough.
  • Avoid exact circular numbers and percentages unless the question supplies them.
  • End every case answer with recommendation, owner and Audit Committee follow-up.

Practice questions from Special Points relating to Internal Audit in various Entities

Internal Audit in Non-Banking Financial Companies in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit in Non-Banking Financial Companies: frequently asked questions

Is internal audit mandatory for NBFCs?

RBI expects NBFCs to have an internal audit framework approved by the board. A company NBFC may also fall under the Companies Act internal audit requirement, depending on its class and size. Check the specific entity facts in the question.

What does an internal auditor check in NBFC lending?

The auditor checks KYC, appraisal of repayment capacity, sanction within authority, documentation, disbursement and end-use. Monitoring and recovery are tested too. Sample loan files and compare them with board policy.

How does NBFC internal audit differ from bank internal audit?

Both are guided by RBI expectations, but a bank has deposit, clearing and branch operations that need branch-level and concurrent audits. An NBFC audit centres on credit, funding, asset quality and regulatory returns.

Who should the NBFC internal auditor report to?

The internal audit function should be independent of business teams and report to the Audit Committee or the board. This protects objectivity and ensures findings reach those who can act.