"Bank branch audit is just ticking vouchers": what RBI's LFAR and IRACP norms actually demand
Bank branch audit is widely described, even inside the profession, as a week of voucher-ticking in April. That description is wrong in a way that creates real professional risk. A branch statutory audit is a regulatory certification in which the auditor independently forms a view on asset classification under RBI's IRACP Master Circular, and where a wrong call on a single large advance can understate provisioning by crores. This article sets out what Section 143 of the Companies Act 2013 and the RBI prudential norms actually require: the 90-day NPA trigger running from the day after the due date, the borrower-wise classification cascade, the out-of-order test for cash credit accounts, the Substandard to Doubtful to Loss progression with provisioning rates, and the twenty-odd heads of the Long Form Audit Report. It then walks through where branch audits go wrong in practice, most often on drawing power recomputation, manual overrides of system-flagged NPAs, restructured account provisioning, and stale security valuations, followed by a step-by-step engagement checklist and the Memorandum of Changes discipline that turns findings into actual provisioning.
Harun Raaj
Chartered Accountant · Harun Raaj & Associates
Ask most people — including a fair number of newly empanelled auditors — what a bank branch audit involves, and you will hear some version of "you go to the branch for a week in April, tick vouchers, sign the report, collect the fee." That description is wrong in a way that creates real professional risk. A branch statutory audit is not a voucher-verification exercise. It is a regulatory certification in which the auditor independently forms a view on asset classification, and where a wrong call on a single large advance can understate provisioning by crores and expose the auditor to action under Section 143 of the Companies Act 2013, the Chartered Accountants Act 1949, and RBI's own de-empanelment process.
The other half of the misconception is that the branch auditor merely reports what the branch's system already says. In practice the entire point of the Income Recognition, Asset Classification and Provisioning (IRACP) review is that the auditor is expected to disagree with the system where the facts warrant it.
What the law and the regulations actually say
Three distinct sources of obligation stack on top of each other here, and they are frequently confused.
The statutory audit mandate. Branch auditors of a banking company are appointed under Section 139 of the Companies Act 2013 read with Section 143(8), which deals specifically with branch audits, and — for nationalised banks — under the Banking Regulation Act 1949 read with the respective bank nationalisation Acts. Section 143(3) sets out the matters the auditor must report on. Section 143(12) creates the fraud reporting obligation: if the auditor has reason to believe an offence of fraud involving an amount of ₹1 crore or above is being or has been committed, the report goes to the Central Government; below that threshold, to the Audit Committee or Board. This is not discretionary.
The RBI Master Circular on IRACP. Asset classification is not an accounting-judgement free-for-all. RBI's Master Circular on Prudential Norms on Income Recognition, Asset Classification and Provisioning pertaining to Advances prescribes the rules. A term loan becomes a Non-Performing Asset when interest or principal instalment remains overdue for more than 90 days. A cash credit or overdraft account is NPA if it remains "out of order" — meaning the outstanding balance stays continuously in excess of the sanctioned limit or drawing power for 90 days, or there are no credits continuously for 90 days, or credits are insufficient to cover the interest debited during that period. A bill purchased or discounted is NPA if overdue for more than 90 days. For agricultural advances, the trigger is two crop seasons for short-duration crops and one crop season for long-duration crops.
Two mechanics catch new auditors out. First, the overdue period runs from the day immediately after the due date — the old "past due" grace concept has been dead for years. Second, the borrower-wise rule: once a borrower is classified NPA, all facilities to that borrower are generally treated as NPA, not just the defaulting one. Exceptions are narrow and specified.
Classification then cascades: Substandard for up to 12 months from the date the account became NPA; Doubtful thereafter, sub-tiered as D1 (up to 1 year doubtful), D2 (1–3 years), D3 (over 3 years); and Loss assets where loss has been identified but the amount has not been written off. Provisioning follows the category — 15% on secured substandard advances (25% where the exposure was unsecured ab initio), rising through the doubtful tiers on the unsecured portion up to 100%, and 100% for loss assets.
The Long Form Audit Report. The LFAR is the supplementary report the branch auditor submits alongside the main audit report, in the format RBI prescribes. It runs across roughly twenty broad heads covering cash, balances with RBI and other banks, investments held at the branch, advances, other assets, deposits, contingent liabilities, profit and loss items, KYC and AML compliance, and specific reporting on frauds and on the branch's internal control environment. Since the revised format took effect, the LFAR has been materially more pointed on credit appraisal quality, monitoring of stressed accounts, and IT-system-generated NPA identification versus manual overrides.
For the 2025–26 audit cycle, the reference date auditors work back from for identifying accounts that had crossed the 90-day mark by the year end is 1 January 2026 — anything that went overdue on or before that date and was not regularised is NPA at 31 March 2026.
Practical implications: where branch audits actually go wrong
Drawing power computation. This is the single most common source of misclassification. Drawing power in a cash credit account is derived from the stock and book-debt statements the borrower submits, after applying the sanctioned margin and excluding creditors for goods. If stock statements are more than three months old, RBI treats the borrowing as irregular; if the irregularity continues for 90 days, the account is NPA regardless of what the branch's system shows. An auditor who accepts the branch's DP figure without recomputing from the underlying statements has not done the work.
Manual overrides of system-flagged NPAs. Banks run system-driven asset classification, but branches retain the ability to flag accounts back to standard on the basis of a purported regularisation. The LFAR specifically asks about this. Where the "regularisation" happened close to the year end through a temporary credit that was reversed shortly after, the account remains NPA — this is window dressing and needs to be reported, not accepted.
Restructured accounts. A restructured standard advance carries higher provisioning and, in most cases, is downgraded to substandard on restructuring unless it meets the specific carve-outs. Auditors routinely miss the additional provision on accounts restructured under resolution frameworks.
Security valuation for the doubtful provision. The provision on doubtful assets applies at 100% to the unsecured portion and at the tier rate to the secured portion. That split depends on a current realisable value of security. A property valuation from 2019 supporting a 2026 classification is not a valid basis, and the LFAR asks about the age of valuation reports.
Sample size on advances. There is no fixed statutory sample, but the general working expectation is coverage of all advances above a cut-off — often the higher of a percentage of the branch's advance portfolio or an absolute rupee threshold set in the bank's closing circular — plus a judgemental sample of smaller accounts and all accounts showing stress indicators.
Step-by-step: how to run the engagement
- Confirm eligibility and independence before accepting. Check RBI/ICAI empanelment status, verify there is no borrowing relationship with the bank that breaches independence norms, and obtain the appointment letter and the bank's closing circular. The closing circular is the operational bible for that year — read it before you travel.
- Get the data before you arrive. Request the branch's advances master, the system-generated NPA list, the list of accounts with overdues between 60 and 90 days, restructured accounts, accounts with manual classification overrides, and the previous year's LFAR with management responses.
- Recompute, do not accept. Independently recompute drawing power for the top cash credit accounts from stock and book-debt statements. Independently apply the 90-day test to term loans from the repayment schedule and actual credits.
- Test the borrower-wise cascade. For every NPA identified, list all other facilities to the same borrower and confirm they have been classified consistently.
- Verify security and valuation currency. Check that valuation reports supporting the secured portion are current and from a valuer on the bank's approved panel.
- Quantify and communicate divergences. Prepare a schedule of every account where your classification differs from the branch's, with the additional provision quantified. This schedule is what the central statutory auditors and the bank's management will act on.
- Complete the LFAR head by head. Do not write "Nil" or "Satisfactory" as a default. Every head that draws a substantive answer needs supporting working papers in the file.
- Assess the Section 143(12) fraud trigger separately. Suspected fraud reporting is a distinct obligation and is not discharged by a comment in the LFAR.
- Sign the Memorandum of Changes. The MOC is how classification and provisioning corrections flow into the bank's consolidated accounts. An unsigned or vaguely worded MOC is where audit findings go to die.
See Also
Frequently Asked Questions
Is the branch auditor liable if a wrongly classified account is detected later by RBI inspection?
Yes, potentially. RBI's divergence reporting framework compares the bank's reported NPAs and provisioning against RBI's own assessment. Material divergence triggers disclosure by the bank and can lead to de-empanelment of the auditor and disciplinary proceedings before the ICAI Disciplinary Committee for gross negligence under the Chartered Accountants Act 1949.
Does the 90-day rule apply from the due date or from the end of the month?
From the day immediately following the due date. There is no month-end rounding and no grace period. An instalment due 15 October 2025 that is unpaid makes the account NPA from 14 January 2026.
If a borrower pays only the overdue interest at year end, does the account become standard?
Only if the account is genuinely regularised — meaning the entire overdue interest and principal is cleared and the account operates normally thereafter. A single credit that clears overdues and is followed by immediate re-drawal is treated as an attempt to evade classification, and the account stays NPA.
Are NBFC IRACP norms the same as bank norms?
No. NBFCs are governed by a separate RBI framework, and the RBI (NBFC) Income Recognition, Asset Classification and Provisioning Amendment Directions, 2026 — which take effect from 1 July 2026 — further diverge the two, including on how Default Loss Guarantee arrangements interact with Expected Credit Loss under Ind AS. Do not carry bank branch audit assumptions into an NBFC engagement.
Need help with this?
Our team handles the paperwork. You focus on your business.