Bank & Concurrent Audit (RBI / Statutory)

It is an ongoing, near-real-time review of a bank branch's or specialised unit's day-to-day transactions and internal controls, conducted by an appointed Chartered Accountant, reporting to bank management on a monthly or quarterly cycle throughout the year — distinct from the once-a-year statutory branch audit, which culminates in a signed attest opinion and the Long Form Audit Report (LFAR).

Concurrent audit is a continuous, internal control-focused review that reports to bank management (branch, zonal, or head office) on a recurring cycle, with no formal audit opinion issued. Statutory branch audit is an annual attest engagement under the Banking Regulation Act 1949, resulting in a signed audit report on the branch's financial statements plus the RBI-prescribed LFAR. The two are complementary — a branch under active concurrent audit coverage typically enters the annual statutory audit with fewer unresolved issues, because irregularities have already been surfaced and addressed during the year.

Appointment is generally made by the bank's zonal, regional, or head office through its own concurrent audit empanelment process — which is typically a separate list from the RBI/ICAI statutory branch audit panel, even at the same bank. Eligible CA firms apply to the bank's concurrent audit panel based on the bank's specific eligibility criteria (often partner strength and prior banking-audit experience), and branches or units are then allotted based on the bank's coverage requirements.

This is set by the specific bank's concurrent audit manual and the appointment letter — commonly monthly, though some banks specify quarterly reporting for lower-risk units. The underlying testing itself is meant to be near-continuous (close to the transaction date), even where the formal written report is submitted on a monthly or quarterly cycle.

RBI's concurrent audit guidelines require banks to bring a specified proportion of their business under concurrent audit coverage, with priority typically given to high-risk or high-volume branches, large advances portfolios, treasury and investment operations, forex/authorised dealer desks, and centralised processing units — rather than uniform coverage across every branch.

Typical scope includes: cash and vault operations, KYC/AML documentation at new account opening, sanction and documentation compliance at the time of loan disbursement, remittance and clearing transactions, deposit mobilisation and premature closure handling, foreign exchange transactions at authorised branches, and ongoing reconciliation of suspense, sundry, and inter-branch accounts — all tested close to the transaction date rather than in a year-end review.

Concurrent audit reviews documentation and sanction-term compliance at the point of disbursement and periodically thereafter — a real-time control check. Statutory branch audit's advances testing is a year-end exercise applying RBI's IRAC (Income Recognition, Asset Classification and Provisioning) norms to classify each sampled account as Standard, Special Mention Account, Sub-Standard, Doubtful, or Loss based on overdue days. Both examine advances, but with different objectives and timing — concurrent audit for ongoing control discipline, statutory audit for year-end classification and provisioning accuracy.

Serious or time-sensitive findings — a suspected unauthorised transaction, a significant documentation gap on a large disbursement, evidence of KYC circumvention — are escalated to bank management outside the normal reporting cycle, following the bank's specified escalation protocol, rather than held for the next scheduled monthly or quarterly report.

No. RBI requires banks to bring a specified proportion of their overall business under concurrent audit coverage based on the bank's own risk assessment and RBI's guidelines, rather than mandating coverage of every branch. Banks select branches and units for coverage based on business volume, risk profile, and any specific regulatory or internal audit concern, and periodically review this selection.

Concurrent audit requirements extend to cooperative banks operating under a banking licence (subject to RBI directions applicable to banking-licensed cooperatives, read with the relevant State Cooperative Societies Act), in addition to commercial bank branches. NBFCs in the Upper and Middle Layers under RBI's Scale-Based Regulation framework are subject to enhanced internal audit and governance norms, and many such NBFCs adopt a concurrent-audit-style continuous review as internal policy, though this is framed under RBI's internal-audit and governance expectations for NBFCs rather than the same concurrent-audit circulars that apply to banks. The specific coverage criteria and reporting expectations differ by category of regulated entity.

Yes, subject to the bank's own policy and any independence considerations the bank or RBI framework may apply. Where permitted, holding both mandates allows genuine continuity — concurrent audit findings through the year inform the statutory auditor's risk assessment at year-end, and the statutory audit's LFAR benefits from a fuller picture of the branch's control environment across the year rather than a single point-in-time sample.

The format is set by the bank's own concurrent audit manual and varies by institution — but typically structures findings by functional area (cash, advances, deposits, KYC/AML, reconciliation, forex where applicable), rates the severity of each observation, and tracks whether prior-period observations have been resolved. PNPC follows the bank's prescribed format precisely rather than substituting a generic template.

Internal audit is typically a broader, risk-based review of the bank's or branch's overall operations and controls, often conducted by the bank's own internal audit function (or an external firm engaged for that specific role) on a periodic cycle that may be annual or aligned with a risk-based audit plan. Concurrent audit is narrower in scope but far more frequent — a continuous or near-continuous transaction-level review of specific high-risk areas, run in parallel with, and complementary to, the internal audit function rather than replacing it.

We conduct a conflict check against the branch's major borrower and account relationships at engagement acceptance, and reassess periodically given the continuous nature of the engagement. Where PNPC has an existing advisory, tax, or audit relationship with a party whose transactions would be reviewed under concurrent audit, we assess and, where appropriate, disclose or decline the relevant portion of the engagement, consistent with ICAI's Code of Ethics.

At minimum: daily cash and vault registers, CBS transaction reports for the review period, the new account opening register with KYC documentation, the loan disbursement register with linked security documentation, remittance and clearing records, and reconciliation statements for inter-branch and suspense accounts, kept current rather than reconstructed at review time.

Yes. Banks periodically review coverage based on changing risk profile, business volume growth at a branch, or specific regulatory or internal audit concerns, and can expand (or occasionally reduce) concurrent audit coverage accordingly, subject to the bank's own internal approval process and any RBI-linked minimum coverage requirement.

Where the branch or desk is authorised for foreign exchange or treasury operations and is included within the bank's concurrent audit coverage for that function, yes — this typically involves reviewing forex transaction documentation against RBI's applicable master directions, treasury deal confirmations, and nostro/vostro reconciliation, requiring team members with specific familiarity with these transaction types beyond general branch banking.

Concurrent audit fees are agreed between the firm and the bank as part of the engagement letter, typically structured as a periodic (monthly or quarterly) retainer reflecting the scope of coverage and the frequency and depth of on-site or on-call testing required, rather than a per-visit fee as with some periodic audit types. PNPC confirms the applicable fee basis with each bank at engagement acceptance.

Concurrent audit reports go to bank management, which decides on any disciplinary, corrective, or process action based on the findings — the concurrent auditor's role is to identify and report irregularities accurately, not to determine consequences for staff. In cases involving suspected fraud or serious regulatory breaches, the bank may separately escalate to its vigilance or fraud investigation function, or to RBI, depending on materiality and the bank's own policy.

Yes, where the branch or bank's coverage scope includes digital channels. As banks shift a growing share of transaction volume to internet banking, mobile banking, and UPI-linked flows, concurrent audit scope increasingly extends to testing controls around digital onboarding, transaction authorisation limits, and reconciliation of digital channel transactions with the core banking system, in addition to traditional over-the-counter branch transactions.

Concurrent audit is a function the bank itself commissions and pays for, using an empanelled CA firm or internal team, reporting to bank management as part of the bank's own internal control architecture. RBI inspection (or supervisory examination) is a distinct regulatory exercise conducted by RBI's own supervisory teams under its statutory powers over banks, assessing the bank's overall health, compliance, and governance — concurrent audit findings can be reviewed by RBI inspectors as part of assessing the bank's internal control environment, but the two are not the same exercise.

This depends on the bank's own concurrent audit manual and the nature of the branch or unit. Many banks require on-site presence, at least periodically, for cash verification and physical document review, while allowing certain transaction-level testing to be conducted off-site using core banking system MIS extracts and scanned documentation, particularly for centralised processing units. PNPC confirms the specific on-site/off-site expectation with each bank at engagement acceptance.

On completion or non-renewal of a concurrent audit mandate, the outgoing firm typically hands over its working papers, outstanding observations, and a status summary of unresolved findings to the bank (and, where applicable, to the incoming firm), so continuity of oversight is not lost at the transition. PNPC provides a structured handover summary in every case, whether the mandate ends by natural conclusion, bank-driven rotation, or non-renewal.

Concurrent audit does not itself address the bank's tax audit obligations under Section 44AB of the Income-tax Act, which are typically handled at the entity level by the bank's appointed tax auditors, drawing on consolidated financial data rather than branch-level concurrent audit reports. However, the reconciliation and documentation discipline that concurrent audit reinforces at branch level — accurate TDS deduction records, clean suspense accounts — supports the overall quality of data that eventually feeds the bank's consolidated tax audit.

A branch under active, well-executed concurrent audit coverage typically enters its annual statutory audit with fewer unresolved documentation gaps, better reconciliation discipline, and a documented track record of how prior irregularities were identified and addressed — all of which can streamline the statutory auditor's risk assessment, though it does not substitute for the statutory audit's own independent IRAC-based testing and LFAR preparation.

PNPC's statutory bank audit practice covers branch-level statutory audit under the Banking Regulation Act 1949, including IRAC-based advances classification testing, LFAR preparation, and financial statement certification, for public sector banks (through RBI/ICAI empanelment and bank allotment), private sector banks, and cooperative banks (direct appointment). This is offered as a standalone engagement or in combination with concurrent audit at the same branch, at the bank's preference.

The LFAR is a structured, RBI-prescribed questionnaire completed as part of the annual statutory branch audit, covering asset quality, credit appraisal adherence, security documentation, and internal control observations. Concurrent audit does not produce an LFAR — it produces periodic management reports on its own format — but well-documented concurrent audit findings through the year can meaningfully inform the statutory auditor's LFAR responses where the same firm, or a coordinating firm, holds both mandates.

IRAC stands for Income Recognition, Asset Classification and Provisioning — RBI's framework for classifying every advance account (Standard, Special Mention Account, Sub-Standard, Doubtful, or Loss) based primarily on overdue days, and determining the provisioning required for each classification. IRAC-based classification testing is core to the annual statutory branch audit rather than concurrent audit's day-to-day scope, though concurrent audit's ongoing review of disbursement documentation and account conduct can flag early warning signs (excess drawings, documentation lapses) relevant to eventual IRAC classification.

PNPC structures its audit teams with a dedicated engagement lead for each branch or unit under concurrent audit coverage, with partner-level oversight built into the periodic reporting cycle, rather than a single team serially rotating across multiple mandates in a way that compresses testing depth at any one unit.

Yes — KYC documentation completeness at new account opening and ongoing due diligence on existing accounts is a standard and important part of concurrent audit scope, given that KYC/AML gaps are precisely the kind of control lapse that continuous, near-real-time review is positioned to catch quickly, compared to a once-a-year statutory sample.

Beyond loan disbursement documentation, concurrent audit typically covers: cash handling and dual-custody controls over the vault, adherence to sanctioned delegation-of-authority limits, deposit account operations including premature closures, remittance and clearing transaction accuracy, reconciliation discipline over suspense and inter-branch accounts on a running basis, and — where applicable — forex and treasury transaction compliance.

PNPC has executed concurrent audit, statutory branch audit, and related banking-sector assignments across public sector, private sector, and cooperative banks since 1986. Our teams bring disciplined, on-time periodic reporting for concurrent audit, technical depth in IRAC classification and LFAR preparation for statutory audit, and — where a bank engages PNPC for both functions at the same branch — genuine continuity of institutional knowledge across the audit calendar rather than two disconnected engagements. We are a practising CA firm with decades of banking-audit experience, not a generalist audit team applying a one-size-fits-all checklist to a specialised function.