Bank Audit Technical Guide on Audit of Internal Financial Controls by ICAI

The Institute of Chartered Accountants of India has issued Technical Guide on Audit of Internal Financial Controls in Case of Public Sector Banks.

1. Introduction

1.1 Auditor’s reporting on internal controls is not a new requirement in India. This requirement was introduced in Manufacturing and Other Companies (Auditor’s Report) Order, 1988 (MAOCARO, 1988) which required auditors to report if there was an adequate internal control procedure commensurate with the size of the company and the nature of its business, for the purchase of stores, raw materials, including components, plant and machinery, equipment and other assets, and for the sale of goods. The Companies Act, 2013 introduced section 143(3)(i) which required the auditors of companies, other than specified class of companies, to report whether the company has adequate internal financial controls with reference to financial statements in place and the operating effectiveness of such controls.

1.2 Since Public Sector Banks (“PSBs”) are not companies under the Companies Act, 2013, auditor’s reporting on internal financial controls with reference to financial statements was hitherto not applicable to PSBs.

1.3 The RBI vide its letter no. DOS. ARG No.6270 /08.91.001/2019-20 dated 17th March 2020 has directed the PSBs to advise their Statutory Central Auditors (“SCAs”) to report in their independent auditor’s report, inter alia, whether the Bank has adequate internal financial controls system in place and the operating effectiveness of such controls [Refer paragraphs 108 and 109 and IG 11 and IG 12 of the “Guidance Note on Audit of Internal Financial Controls Over Financial Reporting” issued by the ICAI in September 2015 (“the Guidance Note”) for testing the design of a control and paragraphs 110 and 111 and IG 13 of the Guidance Note for testing operating effectiveness of controls]. Subsequently, the RBI in May 2020 clarified that the reporting on internal financial controls system is with reference to financial statements.

1.4 The aforesaid reporting on internal financial controls with reference to financial statements was recommendatory for the financial year ended March 31, 2020 and is mandatory with effect from the financial year ended March 31, 2021. Extract of the RBI advice and the subsequent clarification are given as Appendix I and II to this Technical Guide respectively.

1.5 In the case of Banks, including PSBs, the guiding principles on objectives, strategy, scope and coverage of Long Form Audit Report (“LFAR”) prescribed by the RBI requires the SCAs and the Statutory Branch Auditors (“SBAs”) to consider the Bank’s internal control including the control culture of the bank, structure and complexity of the IT systems, etc. when determining the audit strategy and for reporting on various particulars of the Bank’s operations in the LFAR. As such, reporting on internal controls in the case of Banks is not entirely new under the aforesaid advice of the RBI.

1.6 It may be noted that the principles and guidance stated in the Guidance Note though issued with reference to section 143(3)(i) of the Companies Act, 2013 shall be equally applicable to reporting on internal financial controls with reference to financial statements even in the case of PSBs since the fundamental concepts of internal financial controls and the approach to testing such controls would be similar in an audit of companies and in an audit of PSBs and therefore should be followed wherever applicable.

1.7 This “Technical Guide on Audit of Internal Financial Controls in Case of Public Sector Banks” has been issued by the Auditing and Assurance Standards Board of ICAI to provide additional guidance in relation to certain specific matters that may arise in an audit of internal financial controls with reference to financial statements of PSBs. It may be noted that this Technical Guide should be used in conjunction with the Guidance Note while carrying out audit of internal financial controls in case of public sector banks. The guidance provided in this Technical Guide can be used in any audit of internal financial controls with reference to financial statements to the extent relevant.

Board Responsibility for Internal Controls in a PSB and the SCA Responsibility

1.8 Preparation of the financial statements of the Bank as a whole (after consolidation of accounts of branches) is the responsibility of the Bank’s management. RBI vide its Circular No DBOD.No.BP.BC.72/ 21.04.018/2001-02 dated February 25, 2003 has issued guidelines to banks on consolidated accounting and other quantitative methods to facilitate consolidated supervision. This responsibility also includes maintenance of adequate accounting records for safeguarding of the assets of the Bank and for preventing and detecting frauds and other irregularities; selection and application of appropriate accounting policies; making judgments and estimates that are reasonable and prudent; and design, implementation and maintenance of adequate internal financial controls, that were operating effectively for ensuring the accuracy and completeness of the accounting records, relevant to the preparation and presentation of the financial statements that give a true and fair view and are free from material misstatement, whether due to fraud or error.

Those Board of Directors are also responsible for overseeing the Bank’s financial reporting process.

1.9 As per the requirements of the RBI, SCAs are required to report whether the Bank has adequate internal financial controls with reference to financial statements (hereinafter referred as internal financial controls over financial reporting or IFCoFR) and whether such controls were operating effectively as at the Balance Sheet date.

1.10 It appears that the aforesaid reporting on IFCoFR has been mandated only for PSBs. As such reporting on IFCoFR is not applicable for cooperative banks and other banks that are not companies incorporated under the Companies Act, 2013 or the Banks incorporated under the Banking Regulation Act, 1949. This Technical Guide and the Guidance Note, to the extent applicable, will become applicable to such banks when they are notified for reporting on IFCoFR by the RBI.

Applicability to SBAs

1.11 As per RBI requirement, SCAs are required to report on IFCoFR of the Bank. Since the financial statements of the Bank will include the financial information relating to the branches, whether in India or outside India, reporting on IFCoFR will be applicable in respect of branches. For this purpose, the branches that are required to be covered for reporting on IFCoFR will be determined and scoped in by the SCAs. It is not necessary that all the branches of the Bank are covered for reporting on IFCoFR since the controls operating at the branches will be common controls (refer paragraph 3 below) that are designed centrally at the Bank and operated at the branches.

1.12 As part of planning the audit for the bank, SCAs are required to scope in the branches for testing and reporting on IFCoFR and send appropriate referral instructions to the SBAs that are so scoped in. At branches, the design of control would not be required to be tested since the controls are expected to be designed centrally, whose design and implementation will be tested centrally by the SCAs. Accordingly, the SBAs would be required to test only the operating effectiveness of IFCoFR at the branches based on sample sizes to be tested at each branch as determined by the SCAs.

Reporting on IFCoFR

1.13 Reporting on IFCoFR by the SCAs has not been directly specified under the Banking Regulation Act, 1949 (hereinafter referred as “the Act”). The RBI requirement on reporting on IFCoFR by the SCAs has been issued in the context of “Appointment of Central Statutory Auditors of Public Sector Banks – Reporting obligations for SCAs from FY 2019-20. Since the requirement for such reporting is a regulatory requirement by the RBI, SCAs should include the reporting on IFCoFR as part of reporting under “Report on Other Legal and Regulatory requirements” section of the independent auditor’s report.

Applicability of Reporting on IFCoFR in the case of Consolidated Financial Statements (i.e. including Subsidiaries) of a Bank

1.14 It may be noted that section 129(4) of the Companies Act, 2013 states that “the provisions of this [Companies] Act applicable to the preparation, adoption and audit of the financial statements of a holding company shall, mutatis mutandis, apply to the consolidated financial statements”. The RBI requirement is that the SCAs should report if the Bank has adequate internal financial controls with reference to financial statements in place and the operating effectiveness of such controls. Sub-section (2) of Section 30 of the Banking Regulation Act, 1949 (“the Act”) states that the powers and functions of an auditor of a banking company shall be as provided in Section 227 of the Companies Act, 1956. This sub-section of Section 30 has been made applicable to SBI and Nationalized Banks by its incorporation in Section 51 of the Act. Since the Companies Act, 1956 has already been repealed and re-enacted as the Companies Act, 2013, the corresponding provisions in the Companies Act, 2013 appearing in Section 143 shall be deemed to apply to the banking companies, Nationalized Banks and SBI. As Section 129 of the Companies Act, 2013, is, prima facie, not applicable to PSBs, the reporting requirement as introduced by RBI regarding IFCoFR will apply only to standalone financial statements of PSBs and not to consolidated financial statements of PSBs.

To Read Further Download PDF given below.