Risk-Based Internal Audit (RBIA)- Notification
Risk-Based Internal Audit (RBIA)- Notification
An independent and effective internal audit function in a financial entity provides vital assurance to the Board and its senior management regarding the quality and effectiveness of the entity’s internal control, risk management and governance framework. The essential requirements for a robust internal audit function include, inter alia, sufficient authority, proper stature, independence, adequate resources and professional competence.
2. The range and commonality of risks faced by Supervised Entities (SEs) would warrant effective and harmonized systems and processes for the internal audit function across the SEs based on certain common guiding principles.
3. The introduction of Risk-Based Internal Audit (RBIA) system was mandated for all Scheduled Commercial Banks (except Regional Rural Banks) vide our circular DBS.CO.PP.BC.10/11.01.005/2002-03 dated December 27, 2002, which was further supplemented vide circular DoS.CO.PPG./SEC.04/11.01.005/2020-21 dated January 07, 2021. It has now been decided to mandate RBIA framework for the following Non-Banking Financial Companies (NBFCs) and Primary (Urban) Co-operative Banks (UCBs):
- All deposit taking NBFCs, irrespective of their size;
- All Non-deposit taking NBFCs (including Core Investment Companies) with asset size of ₹5,000 crore and above; and
- All UCBs having asset size of ₹500 crore and above.
4. The Supervised Entities as indicated in Para 3 above shall implement the RBIA framework by March 31, 2022 in accordance with the Guidelines on Risk-Based Internal Audit provided in the enclosed Annex. The Guidelines are intended to enhance the efficacy of internal audit systems and processes followed by the NBFCs and UCBs.
5. Further, in order to ensure smooth transition from the existing system of internal audit to RBIA, the concerned NBFCs and UCBs may constitute a committee of senior executives with the responsibility of formulating a suitable action plan. The committee may address transitional and change management issues and should report progress periodically to the Board and senior management.
6. This circular should be placed before the Board in its next meeting. The implementation of these guidelines as per timeline specified should be done under the oversight of the Board.
