Master Circular Inspection & Audit Systems in Primary (Urban)Co-op. Banks - આરબીઆઈ - Reserve Bank of India
Master Circular Inspection & Audit Systems in Primary (Urban)Co-op. Banks
RBI/2007-2008/73 July 2, 2007 Chief Executive Officers of Master Circular
Yours faithfully (N.S.Vishwanathan) Master Circular on
Master Circular on 1.1 It has been observed that quite often the internal inspection machinery in banks has failed to highlight and pinpoint the existence of gross and serious irregularities such as improper credit appraisal, disbursement without observing the terms of sanction, failure to exercise proper post-disbursement supervision, even suppression of information relating to unauthorised excess drawals allowed, kite flying in bills and cheques, etc. 1.2 The internal inspection reports rarely make any adverse comments on the failure of officials of Controlling/Head Offices. It is observed that very few cases of frauds and malpractices come to light through internal inspection/audit reports indicating that there is room for improvement in the quality of inspection. The failure of the internal inspection machinery is mainly attributable to the incompetence of the internal inspection personnel and the casual manner in which the work is carried out. The follow up of the inspection is not carried out seriously. Personnel who cannot otherwise be deployed in other sensitive/critical areas more often staff the inspection/audit department. 2. Ghosh Committee Recommendations on Internal Inspection and Audit The Reserve Bank of India had constituted a High Level Committee, under the chairmanship of Shri A. Ghosh, the then Deputy Governor of RBI, to enquire into the various aspects relating to frauds and malpractices in banks. The Committee made a number of recommendations and suggested precautions to be taken to avoid incidence of frauds and malpractices in the banks. Reserve Bank of India had examined these recommendations and some of the recommendations relevant to the primary (urban) co-op. banks commended for adoption by them are indicated below: The banks should introduce a sound system of internal audit. With a view to strengthening the credibility of the inspection system in detecting cases of frauds/malpractices, steps need to be taken to gear up the inspection/audit machinery and to improve the quality of officers of the inspection department. The head of the inspection department at the Head Office should be a sufficiently senior person and should report directly to the Chairman. If the bank has Regional Offices, there should be an audit machinery under an official of sufficient seniority as the Regional Office Chief to conduct the periodical audit of branches under its jurisdiction. The officers posted to this department should have sufficient experience and exposure and the department should be headed by an official of sufficient seniority and proven integrity. In order to attract competent staff to the department, minimum, continuous experience of three years in Inspection Department should be made as a prerequisite for promotion to scale IV and above. 2.2 Periodicity of Internal Audit The periodicity of the internal audit of the branches should be at least once in every 12 months, which should be really of surprise character. 2.3 Coverage of Internal Audit 2.3.1 The coverage of such inspections should also be made more comprehensive, inter alia, to include a thorough examination of the internal control system obtaining at the branches including the various periodical control returns submitted to the controlling offices. The internal inspection report should specifically comment, on the position of irregularities pointed out in the inspection report of Reserve Bank of India. The inspection/audit officials should also critically analyse and make in-depth study of the corruption/fraud prone areas such as appraisal of credit proposals, balancing of books, reconciliation of inter-branch accounts, settlement of clearing transactions, suspense accounts, premises and stationery accounts during the course of inspections leaving no scope for any malpractices/irregularities remaining undetected. 2.3.2 The internal inspector should scrutinise the suspense account during inspection / visit and give specific instructions for early reversal of entries. 2.3.3 The banks should ensure that the system evolved for recording the details of off-balance sheet transactions are properly followed by all branches. These records should be periodically balanced and internal inspectors should verify the same and offer critical comments. 2.3.4 Proper inventory of dead stock articles, stationary should be maintained and subjected to surprise check at periodical intervals by the officials of the branch as also internal inspectors. 2.4 Supplementary Short Inspections The annual internal inspection should be supplemented by surprise short inspections at irregular intervals, particularly of large branches, to be carried out by officials at appropriate higher levels not only to look into the general working of the branches but also to ensure that no malafide practices are being indulged in to by the branch officials. In addition wherever so warranted, spot/special inspections or scrutiny should also be carried out on receiving signals to that effect. Besides internal audit and short inspections, there should be a regular system of revenue audit of the large branches. The reasons of leakage of income unearthed during such audit should be examined in-depth and action taken against the officials responsible for the lapses. 2.6.1 A system of exclusive scrutiny of credit portfolio with focus on larger advances and group exposures at regular intervals may be introduced. A special scrutiny of high value accounts shifted to the bank along with executives/officials including General Managers/ Chief Executive Officer/ Managing Directors transferred from other banks should be done. Similarly the accounts transferred from other branches along with the officials should be subjected to thorough scrutiny during the internal inspection. The summary of the important findings may be submitted to the Committee of the Board. Irregular accounts over a cut off point may be reported to Reserve Bank of India. The points made by the Reserve Bank of India at the time of discussion of findings of inspection with the top management of banks should be effectively followed up by banks without delay and compliance report should be put up to the Board periodically. 2.6.2 Banks should examine the need for introducing a separate section of internal inspection machinery to scrutinise credit portfolio only. It will be necessary to staff this Section with competent and experienced personnel who will make an in-depth examination of the credit portfolio. It should be the responsibility of this Section to particularly scrutinise larger accounts and group exposures. To be effective, apart from competent officials to man the Section, the Section should be under the charge of a senior personnel reporting directly to the Chief Executive Officer of the bank. The summary of important findings should also be put up to the Audit Committee of the Board. 2.6.3 The Head Offices officials should have a squad, which should also make surprise inspection of the goods pledged/hypothecated to the bank. 2.6.4 Quarterly snap inspections of the branches should be made by the branch level senior officers or by Head Office / Regional Office officers, to especially verify whether drawing power/limit, interest rates, etc. are correctly entered. 3.1 Investment Portfolio Audit Primary (urban) co-operative banks are required to include the following measures in respect of investment portfolio audit: 3.2 compliance with Prudential Norms Internal auditors should bring out non-compliance with the prudential norms relating to income recognition, asset classification and provisioning for taking suitable action in the matter. 3.3 Cheque Purchase Transactions The internal inspectors should verify all the cheque purchased/discounted beyond the sanctioned limit. They should be asked to conduct a sample checking of transactions. 4.1 Ghosh Committee had recommended introduction of concurrent audit at large and exceptionally large branches of banks to serve as administrative support to branches, help in adherence to prescribed systems and procedures and prevention and timely detection of lapses/irregularities. Accordingly, all scheduled and other primary (urban) co-op. banks with deposits over Rs.50 crore were required to introduce the system of concurrent audit. Subsequently, based on the recommendations of the Joint Parliamentary Committee (JPC), which enquired into stock market scam and matters relating thereto, all primary (urban) co-operative banks are required to introduce the system of concurrent audit. 4.2 The concurrent audit system is to be regarded as part of a bank's early-warning system to ensure timely detection of irregularities and lapses, which helps in preventing fraudulent transactions at branches. It is, therefore, necessary for the bank's management to bestow serious attention to the implementation of various aspects of the system such as selection of branches, coverage of business operations, appointment of auditors, appropriate reporting procedures, follow-up/rectification processes and utilisation of the feed-back from the system for appropriate and quick management decisions. 4.3 The Board should review the effectiveness of the system and take necessary measures to correct the lacunae in the system, once in a year. 4.4 It is basically for the individual banks' managements to decide the details of the concurrent audit system. However, a note indicating the broad features of concurrent audit system is given in the Annexure 1 for the guidance of the banks. The note broadly defines the concept and scope of concurrent audit, such as converge of business/branches, types of activities to be covered during the audit reporting system. The note also details the broad suggestions in respect of various aspects of concurrent audit. 4.5 It is expected that the suggestions in the note would ensure some uniformity in the systems The to be introduced by different banks. While framing a concurrent audit system, the banks may clearly spell out the linkages between different forms of internal inspections and audits already in existence and the proposed concurrent audit. 4.6 The concurrent auditors shall certify that the investments held by the bank as on the last reporting Friday of each quarter as reported to the Reserve Bank of India are actually owned / held by it as evidenced by physical securities or the custodians statement. The certificate should be submitted to the Regional Office of the Reserve Bank of India, having jurisdiction over the bank, within thirty days from the end of the relative quarter. 5. Audit for Electronic Data Processing System: 5.1 Primary (urban) co-operative banks which have partially / fully computerised their operations should introduce EDP audit system on perpetual basis. In case such banks have an independent Inspection & Audit Department, an EDP audit cell should be constituted as part of their Inspection and Audit Department to carry out EDP audit in branches/offices having computerised operations. However, those primary (urban) co-operative banks, which do not have an independent Inspection & Audit Department, should create a dedicated group of persons, who, when required, can perform functions of an EDP Auditor. The overall control and supervision of these EDP Audit Cells should be vested in the Audit Committees. In this regard, all primary (urban) co-operative banks having fully/ partially computerised operations should ensure to comply with the norms stipulated in the succeeding paragraphs. 5.2 A team of competent and motivated EDP personnel may be developed. It is beneficial to have a collective development system consisting of many persons instead of a few, in order to take care of a possible exodus of key personnel. EDP auditors' technical knowledge should be augmented on a continuing basis through deputation to seminars/conferences, supply of technical periodicals and books etc. 5.3 Duties of system programmer/designer should not be assigned to persons operating the system and there should be separate persons dedicated to system programming/design. System person would only make modifications /improvements to programs and the operating persons would only use such programs without having the right to make any modifications. 5.4 Major factors which lead to security violations in computers include inadequate or incomplete system design, programming errors, weak or inadequate logical access controls, absent or poorly designed procedural controls, ineffective employee supervision and management controls. These loopholes may be plugged by: 5.5 There is a need for formal declaration of system development methodology, programming and documentation standards to be followed by the bank, in the absence of which quality of system maintenance/improvement might suffer. EDP auditors should verify compliance in this regard. 5.6 Contingency plans/procedures in case of failure of system should be introduced/ tested at periodic intervals. EDP auditor should put such contingency plan under test during the audit for evaluating the effectiveness of such plans. 5.8 An appropriate control measure should be devised and documented to protect the computer system from attacks of unscrupulous elements. Before introducing an EDP application in place of certain manual procedures, parallel run of both the systems should be done for a reasonable period to ensure that all aspects of security, reliability and accessibility of data are ensured in the EDP application. 5.9 In order to ensure that the EDP applications have resulted in a consistent and reliable system for inputting of data, processing and generation of output, various tests to identify erroneous processing, to assess the quality of data, to identify inconsistent data and to compare data with physical forms should be introduced. 5.10 While engaging outside computer agencies, banks should ensure to incorporate the "clause of visitorial rights" in the contract, so as to have the right to inspect the process of application and also ensure the security of the data/inputs given to such outside agencies. 5.11 Entire domain of EDP activities (from policy to implementation) should be brought under scrutiny of Inspection and Audit Department. Financial outlay as well as activities to be performed by EDP department should be reviewed by senior management at periodical intervals. 5.12 In order to bring about uniformity of software used by various branches/offices there should be a formal method of incorporating change in standard software and it should be approved by senior management. Inspection and Audit Department should verify such changes from the view-point of control and for its implementation in other branches in order to maintain uniformity. 6. Audit Committee of Board (APEX AUDIT COMMITTEE) 6.1 The Reserve Bank of India has, from time to time, emphasised the need on the part of the directors of the primary (urban) co-operative banks to ensure timely review and action on the findings of statutory inspection/audit reports and submission of the compliance reports thereto. Yet, in most of the banks, there is no proper system to examine and follow-up the observations and suggestions made in the inspection reports of Reserve Bank of India, statutory auditors and those submitted by the internal inspection department, vigilance cell and internal auditors. Timely follow-up action on the findings of inspection reports and guidelines, circulars etc. issued by RBI as also the internal audit/inspection, etc. is considered desirable to tone up the overall functioning and operational efficiency of the banks. 6.2 In order to ensure and enhance the effectiveness of internal audit/inspection as a management tool, it is considered necessary that an Apex Audit Committee should be set up at the Board level for overseeing and providing direction to the internal audit/inspection machinery and other executives of primary (urban) co-operative banks. The Audit Committee of the Board of Directors (ACB) may consist of the Chairman and three/four Directors, one or more of such Directors being Chartered Accountants or persons having experience in management, finance, accountancy and audit system, etc. This also implies that the banks need to constitute, wherever necessary, their Boards with an adequate number of such professionals. 6.3 The Audit Committee of the Board should review the implementation of the guidelines issued by RBI and submit a note thereon, to the Board at quarterly intervals. 6.4 The other duties/ responsibilities of the Audit Committee of Board (ACB) are as follows: 6.4.1 ACB should provide direction and oversee the operations of the total audit function in the bank. The total audit function will imply the organization, operationalisation and quality control of internal audit and inspection within the bank and follow-up on the statutory audit of the bank and inspection of the Reserve Bank. 6.4.2 As regards internal audit, ACB should review the internal inspection/audit function in the bank - the system, its quality and effectiveness in terms of follow up. It should review the follow up action on the internal inspection reports, particularly of "unsatisfactory" branches and branches classified by the bank as extra large branches. It should also specially focus on the follow up on: 6.4.2.2 Unreconciled long outstanding entries in inter-branch accounts and inter-bank accounts. 6.4.2.3 Arrears in balancing of books at various branches. 6.4.5 Periodical review of the accounting policies/systems in the bank with a view to ensuring greater transparency in the bank's accounts and adequacy of accounting controls. Master Circular [Vide para 4.4] 1. Introduction 1.1 A High level Committee set up by the Reserve Bank of India at the instance of Government of India under the chairmanship of Shri A. Ghosh, the then Deputy Governor, to enquire into various aspects of frauds and malpractices in banks, had recommended in its report, submitted in June 1992 that a system of Concurrent Audit should be introduced at large and exceptionally large branches to serve as administrative support to branches, help in adherence to prescribed systems and procedures and timely detection of lapses/irregularities. 1.2 With a view to standardising the scope of the concurrent audit system, an informal group set up by the Reserve Bank of India comprising senior officers of some large commercial banks and the representatives from the Institute of Chartered Accountants of India examined the various aspects connected with the system. The aspects covered are enumerated below: 1.2.1 Scope of concurrent audit. 1.3 The views emerged in the Group's discussions are detailed below which could be considered for adoption by primary (urban) co-operative banks. An opportunity has been taken to modify certain aspects suitable to the present requirements of primary (urban) co-operative banks. 2. Scope of Concurrent Audit 2.1 Concurrent audit is an examination, which is contemporaneous with the occurrence of transactions or is carried out as near thereto as possible. It attempts to shorten the interval between a transaction and its examination by an independent person not involved in its documentation. There is an emphasis in favour of substantive checking in key areas rather than test checking. This audit is essentially a management process integral to the establishment of sound internal accounting functions and effective controls and setting the tone for a vigilance internal audit to preclude the incidence of serious errors and fraudulent manipulations. 2.2 A concurrent auditor may not sit in judgement of the decision taken by bank/branch Manager or an authorised official. However, the auditor will necessarily have to see whether the transactions or decisions are within the policy parameters laid down by the Head Office/Board of Directors, they do not violate the instructions or policy prescriptions of the Reserve Bank of India and that they are within the delegated authority and in compliance with the terms and conditions for exercise of delegated authority. 3. Coverage of Business/Branches 3.1 The suggested coverage may be as under: 3.1.1 The Departments/pisions at the Head Office dealing with treasury functions viz. investments, funds management including inter-bank borrowings, bill rediscount, stock invest scheme, credit card system and foreign exchange business are to be subjected to concurrent audit. In addition, all branch offices undertaking such business, as also large branches and dealing rooms have to be subjected to continuous audit. 4. Types of Activities to be Covered 4.1 The main role of the concurrent audit is to supplement the efforts of the bank in carrying out simultaneous internal check of the transactions and other verifications and compliance with the procedures laid down. In particular, it should be seen that the transactions are properly recorded/documented and vouched. The concurrent auditors may broadly cover the following items: 4.1.1 Cash 4.1.1.2 Proper accounting of inward and outward cash remittances. 4.2 The aforesaid list is illustrative and not exhaustive. The banks may, therefore, add other items to the list, which in their opinion are useful for the purpose of proper control of the branch operations. In the context of volume of transactions in the large branches it may not be always possible for the concurrent auditors to do a cent percent check. They may, therefore, consider adopting the following norms : 4.2.1 In certain areas, such as off balance sheet items (LCs and BGs), investment portfolio, foreign exchange transactions, fraud prone/sensitive areas, advances having outstanding balances of more than Rs. 5 lakhs, if any unusual feature is observed, the concurrent auditors may conduct cent percent check. 5. Appointment and Remuneration of Auditor 5.1 The option to consider whether the concurrent audit should be done by the external auditors (professionally qualified Chartered Accountants) or its own staff may be left to the individual banks. In case bank decides to appoint external auditors for the purpose, the terms of their appointment and remuneration to be paid may be fixed by the banks within the broad guidelines approved by the Board and/or by the Registrar of Co-operative Societies of the State concerned. 5.2 The audit firms will be responsible for any omissions or commissions in respect of transactions seen by them. In case any serious act of omission or commission is noticed in the working of the concurrent auditors (external), the bank may consider terminating their appointment and a report may be made to the Institute of Chartered Accountants of India for such action as they deem fit under intimation to RBI/RCS. 5.3 In case the bank prefers to entrust the audit to its own officers, the bank has to ensure that these officers are well experienced and of sufficient seniority in order to exercise necessary independence and objectivity while conducting concurrent audit. It would be desirable and necessary to rotate the auditors, whether internal or external, periodically. Progressively, it may be considered whether reliance on external auditors may be reduced as soon as requisite skills for audit work are developed by the proper selection and training of officers from within. 6. Reporting System 6.1 The concurrent auditors may report the minor irregularities, wrong calculations etc. to the Branch Manager for an on-the-spot rectification and reporting compliance. 6.2 If these irregularities are not rectified within a reasonable period of time say a week, these may be reported to the head office. If the auditors observe any serious irregularities, these should be straight away reported to Head Office immediately. The auditor will have to lay emphasis on the propriety aspect of the audit. Banks may institute an appropriate system of follow-up of the reports of the concurrent auditors. There must be a system of annual review of the working of concurrent audit. 7. Conclusion While instituting the concurrent audit system, the attempt should be to integrate the same with other systems of internal audit/inspections, which are already in existence. One of the drawbacks hitherto has been non-integration of the different systems of internal audit and inspections and lack of response to audit objections/qualifications. It is necessary that the entire system of audit, inspection and their follow-up is properly documented and the performance of the integrated audit system is reviewed from time to time. Master Circular on List of Circulars consolidated in the Master Circular
B. List of other circulars from which instructions relating to Inspection & Audit Systems in Primary (Urban) Co-operative Banks have also been consolidated in the Master Circular
|