Internal audit in banks and NBFCs differs from a normal company because the RBI sets expectations for the function itself: it must be risk-based, overseen by the board or its audit committee, and independent of risk management. The audit work also centres on credit, treasury, liquidity, KYC and technology, not on a factory or a sales cycle.
Last reviewed: 17 October 2026. Facts checked. We searched for RBI's risk-based internal audit (RBIA) framework for banks and NBFCs and for 2026 internal audit directions. We read only secondary summaries of those 2026 directions and did not open the RBI text, so we give no circular numbers, thresholds or deadlines here. Always check the RBI notification that applies to your entity type. We did not verify concurrent audit rules.
This article is about what is different. For a detailed NBFC checklist, read our guide to the NBFC internal audit function directions and RBIA checklist.
Who sets the rules
In a normal company, the board and audit committee decide the scope of internal audit within the Companies Act and the company's own charter. In a bank or NBFC, the RBI adds sector rules on top.
Summaries we read describe a framework with these features:
- A risk-based internal audit approach, which replaces a purely transaction-by-transaction approach.
- Board or Audit Committee of the Board oversight of the function.
- An annual risk-based audit plan approved by that committee.
- A board-approved internal audit policy covering purpose, authority and independence.
- A separation between internal audit and risk management.
- A quality assurance and improvement programme for the function.
RBI first asked scheduled commercial banks to adopt risk-based internal audit in 2002, and extended it to some NBFCs and urban cooperative banks later. Which entities are covered, and from when, depends on the current directions, so check them.
Where banks and NBFCs differ from a normal company
| Area | Normal company | Bank or NBFC |
|---|---|---|
| Who prescribes the function | Board, audit committee, Companies Act | RBI directions as well |
| Audit approach | Plan chosen by the head of internal audit | Risk-based approach expected, with documented risk assessment |
| Core risks | Procurement, sales, inventory, payroll | Credit, liquidity, market, operational, compliance, technology |
| Key data | ERP and ledgers | Loan management system, core banking system, MIS |
| Reporting line | Audit committee | Board or its audit committee, with a clearly independent head |
| Outsourcing | Common | Tightly limited. Secondary sources say the 2026 NBFC directions restrict it. Check the text |
Risk-based internal audit in plain words
Risk-based audit means you spend effort where the risk is highest. Under the older RBI approach, you rate the inherent risk of each business activity, rate how well controls manage it, and combine the two in a risk matrix. High-risk and weak-control areas get audited more often and in more depth.
In a normal company, risk-based planning is good practice. In a bank or NBFC, it is the expected method, and the regulator may ask to see how you decided.
Areas internal audit tests
Exact scope depends on the entity, but these areas come up often.
Credit.
- Does loan approval follow the credit policy and delegated powers?
- Are documents complete before disbursal?
- Is the borrower's repayment capacity assessed and recorded?
- Are collateral and security created and valued as required?
Asset classification and provisioning.
- Is overdue and stressed-loan identification system-driven?
- Are classification rules applied consistently?
- Are provisions computed correctly?
KYC and anti-money laundering.
- Is customer due diligence complete and refreshed?
- Are alerts reviewed and escalated?
Treasury and liquidity.
- Are limits set and respected?
- Is there separation between dealing and settlement?
Technology.
- Access rights, change control and data integrity in core systems.
- Reconciliation between sub-systems and the general ledger.
Regulatory reporting.
- Are returns to the regulator accurate and on time?
Customer service and grievances.
- Are complaints logged, tracked and closed?
Use these as prompts, not a complete programme. Our NBFC internal audit workbook lays out a structured set of tests.
The board's role
Because oversight sits with the board or its committee, reporting is more formal. Expect the committee to approve the plan, review audit findings, track action on observations and review the quality of the function itself. Be ready to evidence all of these.
Independence
Internal audit should not run controls it later audits, and should be separate from risk management. If a small NBFC combines roles, document how independence is protected.
Practical tips for a mixed audit team
- Learn the regulator's language before writing reports. Use their terms.
- Link every finding to a policy, regulation or risk.
- Test the system, not only the paper. Use data from the loan system where possible.
- Track action closure with dates and owners.
- Keep a record of how you updated the plan when risks changed.
For tech-enabled approaches, see our article on audit automation for NBFCs in India.
Frequently Asked Questions
Is risk-based internal audit mandatory for all NBFCs?
Not for every NBFC. RBI has applied it to specified categories. Check which category your entity falls under in the current directions.
Can a bank or NBFC outsource internal audit?
Secondary summaries say the 2026 directions restrict outsourcing the function while allowing experts under conditions. Read the RBI text for your entity before relying on that.
How is this different from a statutory audit?
Statutory audit gives an opinion on the financial statements once a year. Internal audit reviews governance, risk management and controls through the year and reports to the board.
Does RBI have separate directions for banks and NBFCs?
Our search found separate 2026 directions for commercial banks and for NBFCs and housing finance companies, reported by secondary sources. Confirm on the RBI website.
Where should a new internal auditor start?
Read the board-approved internal audit policy, the latest risk assessment and the last year's audit committee papers.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error