Generate an Excel workbook for NBFC internal audit and RBIA fieldwork: loan-file testing, KYC, disbursement, collections, NPA/IRACP, ECL, ALM, RBI returns, outsourcing and loan-system ITGC.
| Area | Risk | Control | Test | Evidence | Cadence |
|---|---|---|---|---|---|
| RBIA governance | Audit universe, coverage, reporting line or follow-up does not reflect the NBFC risk profile. | Board-approved RBIA policy, risk-ranked audit universe, independent reporting and ATR review. | Inspect RBIA policy, plan approval, high-risk coverage and prior issue closure. | RBIA policy, audit universe, risk assessment, annual plan, committee minutes and ATR. | Annual / Quarterly |
| Loan origination and KYC | Loans are onboarded for ineligible, unidentified or inadequately assessed borrowers. | KYC/CKYC completion, credit appraisal checklist, sanction authority and adverse screening. | Sample new loans for KYC, appraisal, bureau, sanction authority and override approvals. | Loan file, KYC documents, bureau report, credit note, sanction letter and approval trail. | Monthly / Quarterly |
| Disbursement and end use | Disbursements are made before conditions are met, to wrong bank accounts or without end-use evidence. | Pre-disbursement condition checklist, maker-checker bank validation and end-use verification. | Trace disbursement to sanction terms, borrower bank details, conditions and utilisation support. | Sanction terms, disbursement memo, bank proof, condition checklist and end-use documents. | Monthly |
| Collections and overdue management | Receipts are mismatched, overdue buckets are misstated or recovery actions are not evidenced. | Collection reconciliation, overdue bucket review, agency monitoring and settlement approval. | Reconcile collection files to bank and loan system; inspect skips, waivers, settlements and repossessions. | Collection dump, bank statement, ageing report, agency statement, settlement note and approval. | Weekly / Monthly |
| NPA / IRACP classification | DPD, borrower-level classification, income recognition or upgradation is wrong or manually overridden. | System-driven DPD, borrower-level classification review, interest reversal and upgrade controls. | Recompute DPD for sampled accounts, test borrower aggregation and trace interest reversal. | Loan master, repayment schedule, DPD report, classification report and interest reversal working. | Monthly / Quarter-end |
| ECL and provisioning | ECL assumptions, stage migration, prudential provisions or write-offs are unsupported. | ECL governance, model input review, provisioning reconciliation and write-off approval. | Review PD/LGD/EAD inputs, overlays, stage movement, provision GL tie-out and write-off approvals. | ECL model, model inputs, stage report, provision working, GL reconciliation and write-off note. | Quarterly |
| Treasury and ALM | Borrowing covenants, liquidity mismatches, ALM reporting or investments are not monitored in time. | Covenant tracker, ALM gap review, investment approval and bank-limit reconciliation. | Inspect covenant compliance, ALM bucket preparation, lender reporting and treasury confirmations. | Loan agreements, covenant tracker, ALM statement, investment register and bank confirmations. | Monthly / Quarterly |
| RBI returns and outsourcing | Regulatory returns, outsourcing arrangements, branches or digital-lending partners lack control evidence. | Return checklist, source tie-out, outsourcing due diligence, SLA monitoring and partner reconciliation. | Tie selected RBI returns to source reports and inspect outsourcing/partner monitoring evidence. | RBI return working, source reports, outsourcing agreement, SLA report and partner reconciliation. | Monthly / Quarterly |
| Loan-system ITGC | Access, product configuration, interest logic, interface jobs or master data change without approval. | Role-based access, product master approval, change management and interface reconciliation. | Review privileged users, leaver removal, product/rate changes, UAT approvals and GL interface totals. | User list, role matrix, access review, product master log, UAT sign-off and interface reconciliation. | Monthly / Quarterly |
Use this with the NBFC internal audit checklist, the NPA classification calculator and the ECL calculator.
NBFC internal audit needs a workbook that connects the RBIA audit universe to loan-level testing. The same file should show how governance, onboarding, disbursement, collections, asset classification, provisioning, treasury, returns and ITGC evidence connect.
The Excel export gives auditors separate sheets for engagement scope, RCM rows, loan-file testing, NPA/IRACP recomputation, collections reconciliation, ECL/provision tie-out, ALM/treasury/returns and monitoring exceptions. It is a workpaper starting point and must be tailored to the applicable RBI directions.
A CA firm is performing quarterly internal audit for a middle-layer NBFC with MSME loans, vehicle finance and personal loans.
