Bank Branch Audit Under RBI Guidelines: LFAR, NPA Classification & IRACP Norms

Bank Branch Audit: The RBI Framework

Bank branch audits are not optional. Scheduled commercial banks conducting business in India must comply with RBI guidelines on branch audit and the long-form audit report (LFAR). The audit function serves two masters: statutory compliance under the Companies Act and regulatory oversight under RBI directives. This post clarifies the framework, LFAR requirements, and how Non-Performing Asset (NPA) classification works under IRACP norms.

RBI's Statutory Audit Framework

The RBI's "Guidelines for Statutory Auditors of Banks in India" (last updated substantially in 2017 with ongoing circulars) establishes the scope and responsibility of statutory auditors. Key points:

• Banks must appoint statutory auditors under Section 30 of the Banking Regulation Act, 1949.
• The audit must cover financial statements, compliance with RBI directions, and asset quality certification.
• RBI Circular DBS.CO.Audit.No.2655/13.10.00/2014-15 and subsequent issuances form the operating framework.

Statutory auditors are expected to act as the first line of regulatory defense. Your audit opinion is a signal to RBI about the bank's health.

Long-Form Audit Report (LFAR): Structure & Content

The LFAR is the detailed narrative that sits alongside the statutory audit report. It is not the short-form financial statement audit opinion; it is a comprehensive review submitted to RBI (and to the Audit Committee of the bank's board).

Mandatory Sections in LFAR:

• Compliance Certification: Has the bank complied with RBI directions on capital adequacy (under Basel III norms as applicable)?
• Advances & Asset Quality: Detailed certification of NPA classification, provisioning adequacy, and risk categorization.
• Compliance with Prudential Norms: CRR, SLR, Statutory Liquidity Ratio maintenance, exposure limits, large exposures.
• KYC/AML Compliance: Has the bank followed Know Your Customer and Anti-Money Laundering guidelines (per FEMA regulations)?
• Connected Party Transactions: Disclosures of related-party lending and compliance with exposure limits.
• IT Systems & Security: Audit of core banking system controls and data integrity.
• Regulatory Violations: If any, detailed disclosure.

The LFAR is not confidential--it is submitted to RBI and accessible to RBI inspectors. Non-compliance flagged in the LFAR can trigger RBI action: supervisory pressure, enforcement notices, or even license restrictions.

NPA Classification Under IRACP Norms

The Income Recognition and Asset Classification (IRACP) framework is the backbone of bank asset quality reporting. RBI Circular BSD.CO.No.274/09.07.005/2015-16 (and updates) mandates the standards.

NPA Definitions:

• Non-Performing Advance (NPA): An advance where interest and/or principal is overdue by 90 days or more.
• Special Mention Account (SMA): Pre-NPA category--overdue by 30-89 days. Banks must disclose SMAs separately in financial statements.

Asset Classification Categories:

• Standard Asset: Performing, no credit risk. Full profit recognition permitted.
• Sub-Standard: NPA for less than or equal to 12 months. Provisions required (25% for unsecured advances, 10% for secured advances, or per RBI directive).
• Doubtful: NPA for more than 12 months. Higher provisioning (40% to 100%, depending on vintage and recovery expectation).
• Loss: Uncollectible. 100% provision required; asset should be written off.

Key Compliance Points for Auditors:

• Ascertain Cut-off Dates: NPA status is determined as of the balance sheet date. Advances recovered post-balance-sheet are NOT reclassified.
• Verify Moratorium Claims: COVID-19 relief measures (now expired) previously allowed restructuring without NPA classification. Verify no expired moratoria are still being applied.
• Provisioning Adequacy: Compare actual provisions against IRACP minimums. Shortfalls must be flagged in the LFAR.
• Write-offs: Verify that fully-provisioned advances are written off in accordance with RBI guidelines. Hiding write-offs is a red flag.

Practical Audit Steps

• Obtain Advances Schedule: Request the bank's aged advances ledger, classified by SMA/NPA status.
• Sample Testing: Audit a statistically significant sample. Verify repayment history, last transaction date, and borrower communication.
• Board Minutes Review: Check if the bank's Audit Committee or board has discussed asset quality issues, recovery efforts, or policy deviations.
• Regulatory Correspondence: Review RBI inspection reports, if available to you, and confirm remediation.
• Certification Language: Draft LFAR language that is precise: "We certify that advances classified as NPA are in accordance with IRACP norms" is stronger than vague reassurance.

Common Pitfalls

• Under-Provisioning: Believing that bank's own loan loss reserves exceed IRACP minimums. IRACP is a floor, not a ceiling.
• Restructuring Loopholes: Advances formally restructured but not meeting restructuring criteria should remain NPA.
• Delays in Classification: An advance overdue 90+ days must be classified NPA in the year it crosses the threshold, not when management decides.
• Weak Controls: Auditor reliance on bank's classification without independent verification invites RBI criticism.

Your Role as Auditor

RBI expects auditors to challenge the bank's NPA classification, not rubber-stamp it. The LFAR is your platform to voice concerns. If you believe the bank has misclassified advances or under-provisioned, document it and escalate to the Audit Committee. RBI examiners will cross-check your audit report against their findings. Discrepancies harm your credibility and the bank's standing.

I'm CA Harun Raaj, Visakhaputnam. If you're auditing a bank branch or need guidance on LFAR compliance, reach out.

Need help with this?

Our team handles the paperwork. You focus on your business.