RBIA governance and audit universe
Risk: The internal-audit plan does not reflect the NBFC's risk profile, scale-based regulation layer, products, branches, outsourcing and technology dependence.
Controls
- Board-approved RBIA policy
- Risk-ranked audit universe
- Independent reporting line
- Coverage and follow-up tracker
Tests
- Inspect RBIA policy and annual plan approval
- Check whether high-risk products/branches are covered
- Review independence and reporting line
- Trace prior high-risk findings to follow-up status
Evidence
RBIA policy, audit universe, risk assessment, annual plan, board/audit committee minutes, prior reports and ATR register.
Customer onboarding, KYC and loan origination
Risk: Loans are booked for ineligible, unidentified or inadequately assessed borrowers, creating credit, fraud and compliance exposure.
Controls
- KYC and CKYC completion
- Credit appraisal checklist
- Sanction authority matrix
- Fraud/negative-list checks
Tests
- Sample new loans for KYC and credit appraisal completeness
- Match sanction terms to approved authority
- Review exceptions and overrides
- Check adverse screening evidence where applicable
Evidence
Loan file, KYC documents, credit note, bureau report, sanction letter, authority matrix, exception approvals and onboarding checklist.
Disbursement and end-use monitoring
Risk: Disbursements are made before conditions are met, to wrong parties, or without evidence that funds were used for the approved purpose.
Controls
- Pre-disbursement condition checklist
- Maker-checker bank validation
- End-use verification
- Tranche-release approval
Tests
- Trace disbursement to sanction terms and borrower bank details
- Review pending pre-disbursement conditions
- Inspect end-use certificate or supporting utilisation evidence
- Test tranche releases against milestones
Evidence
Sanction terms, disbursement memo, bank proof, condition checklist, end-use evidence, invoice/supporting documents and tranche approval.
Collections, overdue management and repossession
Risk: Collections are not recorded correctly, overdue accounts are not escalated, or recovery actions breach policy or regulatory expectations.
Controls
- Daily collection reconciliation
- Overdue bucket monitoring
- Collection-agent controls
- Repossession and settlement approval
Tests
- Reconcile receipts to loan system and bank
- Review ageing movement and skipped instalments
- Test collection-agent cash/UPI controls
- Inspect repossession, waiver and settlement approvals
Evidence
Collection dump, bank statement, ageing report, collection-agent statement, repossession file, settlement note and approval trail.
NPA / IRACP classification and income recognition
Risk: Accounts are incorrectly classified, interest income continues on impaired accounts, or borrower-level overdue status is not applied consistently.
Controls
- System-driven DPD computation
- Borrower-level classification review
- NPA interest reversal
- Restructuring and upgradation checks
Tests
- Recompute DPD/classification for selected accounts
- Check borrower-level aggregation logic
- Trace NPA interest reversal
- Review restructuring and upgradation evidence
Evidence
Loan master, repayment schedule, DPD report, classification report, interest reversal working, restructuring file and reviewer sign-off.
ECL, provisioning and write-offs
Risk: Expected credit loss, prudential provisions or write-offs are unsupported, stale or inconsistent with portfolio risk.
Controls
- ECL model governance
- Stage migration review
- Provisioning reconciliation
- Write-off and recovery approval
Tests
- Review ECL input data, assumptions and overlays
- Test stage migration for sampled accounts
- Reconcile provisions to GL
- Inspect write-off approval and post-write-off recovery tracking
Evidence
ECL model, PD/LGD/EAD inputs, stage report, provision working, GL reconciliation, write-off note and recovery register.
Treasury, borrowings, ALM and liquidity
Risk: Borrowing covenants, liquidity mismatches, ALM reporting, bank limits or investments are not monitored in time.
Controls
- Borrowing covenant tracker
- ALM gap review
- Investment approval
- Bank-limit reconciliation
Tests
- Inspect covenant compliance and lender reporting
- Review ALM bucket preparation and approval
- Test investment purchase/sale approvals
- Reconcile bank facilities to books and confirmations
Evidence
Loan agreements, covenant tracker, ALM statement, investment register, bank confirmations, board approvals and treasury MIS.
RBI returns, outsourcing and branch controls
Risk: Regulatory returns, outsourced activities, field branches or digital-lending partners are not controlled or evidenced.
Controls
- Return-preparation checklist
- Outsourcing due diligence
- Branch surprise review
- Partner reconciliation and exception review
Tests
- Tie selected RBI returns to source reports
- Review outsourcing agreements and monitoring evidence
- Inspect branch cash/document controls
- Reconcile partner/customer data with the loan system
Evidence
RBI return working, source reports, outsourcing agreement, SLA reports, branch visit report, partner reconciliation and exception tracker.
ITGC and loan-system controls
Risk: Loan-system access, product configuration, interest logic or interface controls can change without approval or audit trail.
Controls
- Role-based access
- Product/interest configuration approval
- Change management
- Interface reconciliation
Tests
- Review privileged access and leaver removal
- Test product master and interest-rate changes
- Sample loan-system changes for UAT/approval
- Compare source and GL interface totals
Evidence
User list, role matrix, access review, product master change log, UAT sign-off, interface logs and reconciliation file.
