Concurrent, Operational & Process Audit

A concurrent audit is a near-real-time review of transactions as they occur — typically daily, weekly, or fortnightly — most commonly mandated by RBI for bank branches, currency chests, and certain NBFC business lines. An operational audit is a periodic review of how efficiently and effectively an entire function or department operates — procurement, inventory, dispatch, HR — measured against process standards and organisational objectives. A process audit is the narrowest of the three: it checks whether one specific, documented Standard Operating Procedure is actually being followed, step by step, on the ground. All three are internal-facing assurance tools, distinct from the year-end statutory audit.

Concurrent audit is mandatory for scheduled commercial banks and, in a defined form, for certain classes of NBFCs and currency chests, under the Reserve Bank of India's Master Direction on concurrent audit. The Master Direction prescribes a minimum percentage of business — advances, deposits, non-fund exposures — that must be brought under concurrent audit coverage. It is not a general legal mandate for all companies; for a manufacturing or trading business, an operational/process audit is a voluntary, management-commissioned engagement rather than a statutory requirement, unless the entity separately falls within the internal audit mandate under Section 138 of the Companies Act.

There is no universal legal requirement for every company to have an operational audit. Internal audit becomes mandatory under Section 138 of the Companies Act 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014 only for companies meeting prescribed thresholds of turnover, outstanding loans/borrowings, outstanding deposits, or paid-up share capital — thresholds that differ for listed companies, unlisted public companies, and private companies. Below those thresholds, an operational or process audit is entirely a management or promoter choice — commonly adopted by growing businesses that want independent assurance beyond what the annual statutory audit provides.

The statutory audit under the Companies Act examines whether your financial statements, taken as a whole, present a true and fair view — it is retrospective, covers a full financial year, and reports to shareholders via the AGM and to the RoC via AOC-4. A concurrent, operational, or process audit examines how well a specific process or transaction stream is being controlled, in near-real-time or periodically through the year, and reports internally to management, the Audit Committee, or the Board. The statutory audit is about the destination — the numbers at year end. These audits are about the journey — the process discipline that produces those numbers.

Under Section 144 of the Companies Act 2013, a statutory auditor is prohibited from rendering certain specified services — including internal audit — to the company it statutorily audits, either directly or through a related entity, in order to preserve auditor independence. Where PNPC is engaged as statutory auditor for a company, we structure the internal, concurrent, or operational audit as a separate engagement, either through a different independent team within appropriate ethical walls or by recommending an alternative qualified provider, depending on the applicable independence rules for that entity's classification.

There is no single fixed statutory frequency for operational or process audits outside of the RBI concurrent-audit mandate. The right cadence depends on transaction volume, risk, and the pace of change in the business — high-risk, high-volume functions (inventory, cash, procurement) are commonly reviewed quarterly; lower-risk, more stable functions may be reviewed annually. Where Section 138 internal audit applies, the Audit Committee or Board typically approves an annual internal audit plan specifying the frequency for each area based on a documented risk assessment.

RBI's Master Direction requires banks to bring a specified minimum percentage of their total business — typically measured across advances, deposits, and non-fund based business such as guarantees and letters of credit — under concurrent audit coverage. The exact percentage and the specific categories of business/branches that must be covered (large branches, treasury operations, forex transactions, currency chests) are set out in the current Master Direction and are reviewed periodically by RBI. Coverage is measured and reported, and a bank falling short of the mandated coverage is a supervisory concern that RBI inspectors will specifically examine.

Common findings include: approval limits in the Delegation of Authority matrix not being enforced in practice (purchases approved above authorised limits by a single signatory), stock discrepancies between physical count and system records, vendor payments processed without three-way matching of purchase order, goods received note, and invoice, segregation-of-duties gaps in system access (the same person able to raise and approve a payment), stale or unfollowed SOPs, and control overrides during peak business periods that become the de facto process rather than the documented exception.

We do not apply a fixed percentage (such as 'test 10% of transactions') uniformly across every client and every process. Sample size is calibrated to the volume, value, and inherent risk of the specific process being tested — a high-value, low-volume process such as capital expenditure approvals may warrant near-100% testing, while a high-volume, low-value process such as petty cash disbursements is tested on a risk-based statistical or judgemental sample. This follows the risk-based approach set out in the ICAI's Standards on Internal Audit.

If, during an operational or process audit, evidence emerges suggesting fraud rather than a routine process weakness, PNPC escalates the matter immediately to the Audit Committee, Board, or designated promoter contact — rather than folding it quietly into the routine quarterly report. Depending on the materiality and nature of the finding, we recommend the engagement of a dedicated forensic audit, which follows a different methodology (evidence preservation, chain of custody, interview protocols) suited to matters that may proceed to disciplinary action, recovery proceedings, or reporting to authorities.

Process audits apply to any business with a documented or documentable process — manufacturing (procurement, production, quality, dispatch), trading (inventory, sales, logistics), and services businesses alike (client onboarding, billing accuracy, service delivery SLAs, timesheet-to-invoice reconciliation for professional services firms). The methodology is the same regardless of sector: identify the SOP, verify actual practice against it, document deviations, and recommend corrective action.

Our reports are structured around risk-rated findings — each observation is classified by severity (typically high/medium/low, or a similar risk grading), accompanied by the root cause, the potential financial or operational impact, a specific recommendation, and a management response with an agreed target closure date. This differs from a narrative-style report that simply lists observations without prioritisation — a risk-rated structure lets the Audit Committee or Board focus limited attention on what matters most first.

A stock audit is a narrower, specific engagement commissioned by a bank (often as a condition of a working capital facility) to independently verify the quantity, condition, and value of inventory pledged as security — it focuses almost entirely on inventory existence and valuation. An operational audit of the inventory function is broader — it examines the entire inventory management process (procurement planning, storage, movement, obsolescence policy, physical verification discipline), not just a point-in-time stock count for a lender's comfort. PNPC performs both, and the scope and deliverable differ accordingly.

Yes. Investors conducting operational due diligence before a fundraise commonly look for evidence of process discipline — documented SOPs, functioning approval controls, clean segregation of duties, and a track record of internal review. A recent, well-documented operational audit with a tracked closure record of prior findings is tangible evidence of operational maturity that strengthens a company's position in diligence, and surfaces (and lets you fix) weaknesses before an investor's own diligence team finds them first.

For businesses with multiple branches, warehouses, or plants, we design a rotational or risk-based coverage plan — auditing every location over a defined cycle (annually or across a 2-year rotation, depending on risk) rather than only ever auditing head office or the largest location. High-risk or historically problematic locations are prioritised for more frequent coverage. Findings are consolidated across locations to identify whether an issue is a single-site lapse or a systemic gap in the SOP or training that repeats across the network.

At minimum: the organisation chart and Delegation of Authority matrix for the function in scope, existing SOPs or policy documents (or confirmation that none exist, which is itself a Day 1 finding), a sample period of transaction records relevant to the process being tested, and access to the process owner for walkthroughs. For concurrent audit specifically, daily transaction registers and, for RBI-regulated coverage, KYC and sanction documentation are required on an ongoing basis for the duration of the engagement.

An operational, process, or (for non-RBI-regulated entities) internal audit report is an internal management document — it is addressed to the Audit Committee, Board, or promoters, and there is no general statutory requirement to file it with the RoC or share it with shareholders or the public. For RBI-regulated entities, concurrent audit reports and consolidated summaries are shared with the entity's own Head Office Inspection function and may be reviewed by RBI supervisors during an inspection, but they are not public filings in the way AOC-4 financial statements are.

A first-cycle operational audit of a single function at a single location typically runs 4–6 weeks from scoping to final report — covering SOP review, walkthroughs, transaction testing, and reporting. A broader, multi-function or multi-location engagement, or a first-time internal audit programme covering an entire Section 138-mandated audit universe, is scoped as a longer engagement with a phased plan across the financial year rather than a single sprint.

Risk Based Internal Audit is the framework mandated by RBI for banks and, in a scaled form, applicable to certain categories of NBFCs, requiring the internal audit function to prioritise audit coverage and frequency according to a documented risk assessment of each business area, rather than auditing everything with equal intensity. For a non-RBI-regulated company, RBIA is not a mandatory framework by name, but its underlying principle — risk-based rather than uniform audit coverage — is the same approach PNPC applies when designing an operational audit plan for any client, RBI-regulated or not.

Process audit methodology — verifying that documented procedures are actually followed — overlaps significantly with the internal audit requirements built into quality management standards such as ISO 9001, which itself requires periodic internal audits as part of its certification and surveillance cycle. PNPC's process audits are financial/operational-control focused rather than a formal ISO internal audit in themselves, but the discipline of SOP-versus-practice verification is directly complementary, and findings from our process audits often feed usefully into a client's broader quality management system work.

PNPC quotes a fixed, scope-based fee agreed in writing before fieldwork begins — driven by the number of functions/locations in scope, transaction volume, and audit frequency. Concurrent audit engagements for RBI-regulated entities are typically priced on an ongoing retainer basis reflecting the continuous, year-round nature of the mandate; operational and process audits are typically priced per cycle or as an annual programme fee covering an agreed number of cycles. We are not the lowest-cost provider in the market — our differentiation is in the depth of root-cause analysis and the corrective-action tracking discipline that a lower-cost, checklist-driven audit typically does not provide.

An in-house team has deep institutional knowledge but can face independence pressure — reporting to the same management whose processes they are reviewing creates a structural conflict that an external, independent auditor does not face. External engagement also brings cross-industry pattern recognition — PNPC's audit teams see recurring control weaknesses across dozens of client businesses and bring that experience to your specific engagement, rather than benchmarking only against your own history. Many mid-size businesses use a hybrid model: a lean in-house compliance function supported by PNPC for the independent, periodic operational/concurrent audit cycles.

The Institute of Chartered Accountants of India (ICAI) issues the Standards on Internal Audit (SIA), a series of standards covering planning, risk assessment, documentation, reporting, and quality control for internal audit engagements — including the operational and process audit work that typically forms part of an internal audit programme. ICAI has been rolling out mandatory compliance with the SIAs in a phased manner — starting with internal audit engagements for listed companies and progressively extending to other companies — for every ICAI member conducting an internal audit, regardless of whether internal audit is a statutory requirement for that particular entity under Section 138. PNPC applies the same disciplined SIA-based methodology to voluntary, management-commissioned operational and process audits as well, rather than using a lighter, non-standard approach for non-mandatory engagements.

A standard operational or process audit typically covers system-embedded process controls relevant to the function in scope — for example, whether the ERP enforces segregation of duties between purchase requisition, approval, and payment. It is not, by default, a full IT general controls (ITGC) audit or a cybersecurity/penetration-testing engagement, which are specialised assessments requiring different expertise and are scoped separately. Where a client's risk profile calls for it, PNPC scopes a dedicated IT controls review alongside the operational audit rather than folding a specialist exercise into a general process review superficially.

For companies required to constitute an Audit Committee under Section 177 of the Companies Act (applicable to listed companies and certain classes of public companies) or as a matter of good governance practice for others, the Audit Committee typically approves the internal/operational audit plan, reviews significant findings, monitors the closure of corrective actions, and evaluates the effectiveness and independence of the internal audit function itself, including any external provider such as PNPC. Where no formal Audit Committee exists, this oversight role is typically performed by the Board directly or by designated promoters/directors.

Asking a department head relies on self-reported compliance, which is subject to unconscious bias, incomplete visibility into what actually happens at the transaction level, and — in some cases — a direct incentive to understate deviations. A process audit independently verifies actual practice through documentary evidence, transaction sampling, and direct observation, rather than relying on a verbal or written assertion from the person whose own performance the process reflects. This independence is the entire value proposition of the engagement.

Yes. Not every engagement needs to be a recurring annual programme. PNPC scopes standalone, targeted operational or process audits — for example, a focused review of one branch's cash handling after an anomaly, or a single deep-dive into the procurement function following a vendor complaint — as a self-contained engagement with its own defined start, fieldwork, and report, independent of any broader audit calendar.

No. PNPC maintains an action tracker for every finding raised, with agreed target closure dates from management, and formally follows up on closure status at the next audit cycle — verifying, not just noting, whether corrective action was actually implemented. A finding that recurs unaddressed across two or three consecutive audit cycles is itself escalated as a distinct governance concern to the Audit Committee or Board, since it indicates either an unresolved root cause or inadequate management follow-through.

They are related but distinct. Concurrent audit, as mandated by RBI, is typically performed by an external chartered accountant firm (or, for very large banks, sometimes an internal team functioning with concurrent-audit-level independence and reporting lines) reviewing transactions at or near the point of occurrence. A bank's own internal inspection department conducts periodic, broader inspections of a branch or function — covering areas beyond what concurrent audit typically examines, and often at a lower frequency (annual or bi-annual) than the near-continuous concurrent audit cycle. Both feed into the bank's overall control assurance framework but serve different purposes and cadences.

Concurrent audit in its full, branch-level form under the RBI Master Direction has historically been most directly associated with scheduled commercial banks. For NBFCs, RBI's regulatory framework instead centres on the Risk Based Internal Audit (RBIA) requirement, applicable to specified categories and sizes of NBFCs, which mandates a structured, risk-prioritised internal audit function rather than the identical concurrent-audit branch-coverage model used for banks. The precise applicability depends on the NBFC's asset size classification and current RBI directions, which PNPC confirms against the client's specific classification at engagement scoping rather than assuming uniform applicability across all NBFCs.

Familiarity risk — where long-tenured auditors become less critical over time — is a recognised risk in any recurring assurance relationship. PNPC addresses this through periodic rotation of the engagement team (not necessarily the client relationship partner) across audit cycles, fresh risk assessment at the start of each cycle rather than simply repeating the prior year's programme, and an internal quality review process on our own audit files. We also actively look for evidence that our own prior-cycle recommendations were followed — testing our own work's effectiveness, not only the client's compliance.

A standard operational or process audit report can provide supporting evidence of a control weakness or deviation, but it is not designed, from a documentation and evidentiary standpoint, to meet the standards required for disciplinary action or legal proceedings against a specific individual — that requires the more rigorous evidence-handling, chain-of-custody, and interview protocols of a proper forensic audit or investigation. Where an operational audit finding raises a serious enough concern that disciplinary or legal action against an individual becomes a realistic possibility, we recommend commissioning a dedicated forensic review rather than relying on the operational audit report alone.

Where PNPC performs the internal/operational audit and a different firm serves as statutory auditor, we coordinate through the Audit Committee — sharing relevant operational audit findings that could have financial statement implications (such as inventory discrepancies, revenue recognition process weaknesses, or control gaps around related party transactions) so the statutory auditor can factor them into their own risk assessment and audit approach, subject to the client's consent and the Audit Committee's coordination protocol.