Credit, Operational & IT Risk Reviews

Three related but distinct questions. Credit risk review asks: is the loan/credit book actually as healthy as it appears, and is provisioning adequate for the risk actually present? Operational risk review asks: where could a process, people, or control failure cause a direct financial or reputational loss, and are those gaps currently open? IT risk review asks: is the technology environment — access controls, data security, system resilience — adequately protected, governed, and compliant with current data protection law? PNPC scopes these individually or together depending on your regulatory status and specific concern.

For banks and NBFCs, elements of this review are effectively mandatory through RBI's supervisory framework: NBFCs in the Middle and Upper Layers under the Scale Based Regulation framework must meet enhanced risk management and IT governance requirements, and RBI's IT Governance, Risk, Controls and Assurance Practices Master Direction applies directly to banks and Middle/Upper Layer NBFCs. For a non-regulated corporate, there is no single statute mandating this exact review, but a material trade-credit book, significant process dependencies, or meaningful IT/data exposure make it a genuinely prudent, increasingly expected practice — particularly given DPDP Act, 2023 obligations that apply regardless of sector.

SBR, effective from October 2022, classifies NBFCs into four layers — Base, Middle, Upper, and Top — based on size, activity, and perceived riskiness, with progressively more stringent governance, risk management, and capital requirements at each higher layer. Upper Layer NBFCs face requirements closer to those applicable to banks, including mandatory Board-level Risk Management Committee constitution, more rigorous IT governance, and enhanced disclosure. The layer your NBFC currently sits in — and how close it is to crossing into the next layer — directly determines how rigorous a credit, operational, and IT risk review needs to be, and how soon.

IRAC (Income Recognition and Asset Classification) norms are RBI's traditional, incurred-loss-based framework classifying advances as Standard, Sub-Standard, Doubtful, or Loss, with prescribed minimum provisioning percentages for each category. Ind AS 109's Expected Credit Loss (ECL) model, applicable to NBFCs that have adopted Ind AS, is a forward-looking framework requiring provisioning based on probability-weighted expected losses over the life of the exposure, factoring in macroeconomic forward-looking information — generally producing higher, more risk-sensitive provisioning than IRAC in a deteriorating credit environment. RBI has indicated its intent to move banks toward an ECL-based framework as well, though implementation timelines have been extended; NBFCs on Ind AS already apply ECL.

No — we independently recalculate provisioning on a risk-based sample of accounts using the entity's own stated methodology and assumptions, then separately stress-test those assumptions against actual portfolio performance (roll-rates, recovery experience, collateral realisation history) to assess whether the assumptions themselves are defensible, not just whether the formula was applied correctly. A mathematically correct ECL calculation built on unrealistically optimistic assumptions still understates real risk.

Operational risk covers loss arising from inadequate or failed internal processes, people, and systems, or from external events — excluding credit and market risk. Concrete examples: a payment released without the required dual approval due to a workflow override, a key-person dependency where only one employee understands a critical reconciliation process, a vendor failing to deliver a critical service with no contingency plan, a data entry error in loan disbursement that goes undetected for months, or an internal fraud enabled by inadequate segregation of duties between transaction initiation and approval.

Segregation of duties is the control principle that no single individual should be able to both initiate and approve a transaction, or both execute and reconcile it, without independent oversight — reducing the risk of undetected error or fraud. It comes up constantly because it is one of the most foundational operational controls, yet is also one of the most commonly compromised as organisations scale quickly, add system access without revisiting role design, or rely on informal trust rather than system-enforced controls.

A penetration test is a narrow, technical exercise simulating an attacker attempting to breach specific systems — valuable, but scoped to technical vulnerabilities. An IT risk review is broader: it examines IT governance (is there a Board-approved IT strategy and risk-owning function), access controls, change management discipline, data backup and disaster recovery readiness, vendor/third-party IT risk, and regulatory compliance posture (RBI IT Governance Master Direction, DPDP Act) — of which technical vulnerability is only one component. Many organisations with a clean penetration test result still have material IT governance and access control gaps.

The DPDP Act, 2023 creates specific obligations around lawful processing of personal data, consent management, data breach notification, data principal rights, and significant penalties for non-compliance — all of which materially expand the scope of what a current IT risk review needs to assess beyond traditional cybersecurity and access control testing. We specifically assess consent mechanisms, data processor agreements, breach notification readiness, and data retention practices as part of the IT risk review, with rules and compliance timelines being operationalised progressively by the government.

It depends on your specific exposure rather than regulatory status alone. If you extend material trade credit to customers, a credit risk review of your receivables book and credit-approval process is worthwhile regardless of RBI applicability. If you have significant manual process dependencies — payments, procurement, payroll — an operational risk review adds real value. And given that virtually every business today depends on ERP systems, customer data, and digital payment infrastructure, an IT risk review covering access controls and DPDP compliance readiness is increasingly a prudent baseline rather than a regulated-entity-only exercise.

For a single-entity bank or NBFC of moderate size and complexity, a realistic timeline from scoping through Board presentation is 8–10 weeks. A single-domain review — credit risk only, or IT risk only — typically takes 4–6 weeks. Larger, multi-branch organisations, or those with limited existing documentation and process maps, should expect a longer timeline. A follow-up remediation verification review, typically conducted 3–6 months after the initial report, is a separate and shorter engagement.

Cost depends materially on portfolio size, number of branches/locations, IT system complexity, and whether the engagement covers all three domains or a single domain. PNPC agrees a fixed, written scope and fee before any engagement begins, distinguishing the initial review phase from any follow-up remediation verification review, so the client knows exactly what is included at each stage.

Most commonly the Board or the Risk Management Committee/Audit Committee commissions the review directly, given its independent assurance nature, though the CFO, Chief Risk Officer, or Head of Internal Audit is usually the primary internal coordination point for scoping and document access. For entities without a dedicated CRO, the CFO or Company Secretary typically fills that coordination role.

A risk-based sample, not a full-portfolio review — full-portfolio testing is rarely proportionate or necessary to assess systemic quality. The sample is weighted toward higher-value exposures, recent originations (where appraisal discipline is most current), and accounts already showing early-warning stress signals, since these are where provisioning and appraisal weaknesses are most likely to be material. Sample size and stratification are agreed with the client and, where relevant, calibrated to what an RBI inspection team would typically expect to see tested.

An EWS framework is a set of defined indicators — payment delays, bounced cheques, adverse credit bureau movement, declining account turnover, sector-level stress signals — designed to flag a credit exposure showing early signs of stress before it formally slips into a lower asset classification. A well-functioning EWS framework allows proactive engagement with a stressed borrower and earlier provisioning recognition; a weak or non-existent one means asset quality deterioration is discovered only when it has already progressed to NPA classification, by which point recovery options are more limited.

ITGCs are the foundational controls over an IT environment that support the reliability of application-level controls and data — access management, change management, IT operations (backup, job scheduling), and program development controls. Statutory auditors test ITGCs specifically to determine how much reliance they can place on system-generated financial data. Beyond the audit context, weak ITGCs — particularly around access provisioning and change management — are frequently the root cause of both operational risk incidents and cybersecurity exposure, which is why IT risk review tests them more broadly than an audit-scoped ITGC review would.

Yes. Insurers increasingly require, or price more favourably based on, evidence of the applicant's risk management maturity — documented IT governance, access controls, incident response readiness, and backup/recovery testing. An IT risk review report and its remediation roadmap can materially support the underwriting conversation and, in our experience, has helped clients secure improved terms upon renewal after addressing identified gaps.

Credit, operational, and IT risk are three of the risk categories within a comprehensive ERM risk universe, alongside strategic, financial, compliance, and reputational risk. Where an ERM framework already exists, this review serves as a deeper, more technically rigorous assessment within those three specific categories, feeding its findings back into the broader risk register. Where no ERM framework exists yet, this review can stand alone, or serve as a natural starting point that later expands into a full ERM build once the organisation sees the value of structured risk assessment in these three material domains.

No. PNPC escalates any finding assessed as an immediate, material risk — a live fraud indicator, a critical unpatched security vulnerability, or a provisioning gap severe enough to affect the entity's regulatory capital position — directly and promptly to the Audit Committee or Board Chair, rather than holding it for the scheduled final report presentation. The final report still documents the finding formally, but urgent risks are not left to sit until the standard reporting cycle.

Both models are available and are scoped separately. Many clients engage PNPC for the review and findings report as a defined project, then handle remediation internally with PNPC available for ad hoc advisory support on specific fixes — provisioning methodology correction, control redesign, IT governance policy drafting. Other clients, particularly those without deep in-house risk or IT governance expertise, prefer PNPC to remain actively involved through remediation execution and the follow-up verification review.

RBI's Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (2023) applies to banks and to NBFCs in the Middle and Upper Layers under the Scale Based Regulation framework — Base Layer NBFCs are not directly bound by its detailed requirements, though adopting proportionate elements of it as good practice is prudent given how quickly an NBFC can scale into the Middle Layer. The Direction requires a Board-approved IT strategy, a dedicated IT function with appropriate governance, defined RTO/RPO for critical systems, and structured IT risk assessment.

Yes. PNPC operates from Chennai, Bangalore, Hyderabad, and Dubai. For groups with lending, operational, or IT infrastructure spanning both jurisdictions, we build a consolidated view that accounts for cross-border considerations — UAE Central Bank regulatory requirements for any UAE-licensed finance entity, cross-border data flow implications under both DPDP Act and applicable UAE data protection law, and group-level operational risk that can propagate between entities — rather than two disconnected, single-jurisdiction reviews.

The statutory auditor's primary objective is an opinion on whether the financial statements present a true and fair view, which includes testing ITGCs and internal financial controls specifically to the extent they affect financial reporting reliability — a narrower, financial-statement-focused lens. Credit, Operational & IT Risk Review is a broader, forward-looking management assurance exercise — assessing portfolio quality and provisioning adequacy beyond audit sampling thresholds, operational risk beyond financial-reporting-relevant processes, and IT risk beyond ITGCs relevant to the audit — designed to inform Board and RBI-facing risk management, not primarily to support an audit opinion.

Where fieldwork surfaces something that appears to be an actual regulatory breach — for example, provisioning materially below RBI's prescribed minimum, or an exposure limit breach — rather than simply a control weakness, PNPC flags this distinctly and promptly to the Board/Audit Committee, with a clear factual basis, so the entity can assess its own disclosure and remediation obligations with appropriate legal input alongside our findings. We do not make the disclosure decision on the client's behalf, but we ensure the Board has the facts promptly and clearly.

A single review establishes a valuable baseline, but credit portfolios, operational processes, and IT environments all change continuously — new products, new systems, new vendors, evolving cyber threats. Most clients in regulated categories (banks, Middle/Upper Layer NBFCs) benefit from an annual cycle, aligned to the financial year-end and any RBI inspection cadence, with lighter-touch interim reviews for specific domains if a material change occurs (a new core banking system, a significant portfolio shift) between annual cycles.

Documented policy that does not match actual practice. Nearly every organisation we review has a credit policy, an operational SOP, and an IT security policy that reads well on paper — the recurring gap is between what the policy says should happen and what our testing shows actually happens: appraisal shortcuts under commercial pressure, manual overrides of segregation-of-duties controls, and access rights that were never revoked after role changes. The policy exists; the discipline of following it consistently does not.

Yes. A structured, independently performed risk review — particularly one covering credit portfolio quality and provisioning adequacy — can support conversations with lenders and rating agencies who are themselves assessing the entity's credit and risk management maturity as part of their own rating or lending decision. We are candid, however, that the review's purpose is genuine risk assessment, not producing a favourable document for external presentation — findings are reported factually regardless of how they may be received externally.

Where PNPC also serves as internal auditor or statutory auditor for a client, we manage independence carefully — RBI and ICAI guidelines govern the boundaries of what the same firm can perform for a regulated entity, and we structure engagement teams and scope accordingly, including using separate engagement teams where independence rules require it. We discuss this explicitly with clients during scoping, rather than assuming no conflict exists.

Concentration risk is the exposure an entity carries when its credit book is disproportionately weighted toward a single borrower, borrower group, sector, or geography — meaning a single adverse event can impact a large share of the portfolio at once. We measure it against the entity's own internal exposure limits (if defined) and, for larger NBFCs, against RBI's large exposure framework where applicable, breaking the portfolio down by top-N borrower groups, sector-wise exposure as a percentage of net worth, and geographic clustering, particularly for entities with a regional lending focus.

Collateral valuation directly affects Loss Given Default (LGD) assumptions in provisioning models and the practical recoverability of an exposure if it turns delinquent. There is no single statutory revaluation frequency applicable to all lenders, but RBI guidance and prudent practice generally call for periodic revaluation — more frequently for volatile asset classes like unlisted equity or certain movable assets, less frequently for stable asset classes like registered immovable property — with a clear, Board-approved revaluation policy rather than an ad hoc or purely origination-date valuation relied upon indefinitely.

Yes, and this is a common and proportionate engagement. For a corporate with a material trade-credit book, we scope a focused review of the customer credit-approval process, receivables ageing and provisioning against Ind AS 109 (which applies to trade receivables for entities on Ind AS as well), and customer concentration — without the RBI-specific regulatory testing that applies only to banks and NBFCs. Operational and IT risk review scope is similarly right-sized to the corporate's actual process and system complexity.

A symptom finding describes what went wrong in a specific instance — for example, 'a loan was disbursed without complete KYC documentation.' A root-cause finding explains why it was possible — for example, 'the loan origination system does not block disbursement when a mandatory KYC field is incomplete, and no compensating manual check exists.' Remediating only the symptom (correcting that one file) leaves the underlying gap open for the next transaction; remediating the root cause (a system control or compensating check) prevents recurrence across the whole portfolio.

All data accessed during the review — borrower-level credit information, system access credentials context, incident details — is handled under the engagement's confidentiality terms, accessed only by the assigned engagement team, and retained only as long as necessary to support the review and any follow-up verification. Where the review touches personal data within the scope of the Digital Personal Data Protection Act, 2023, we apply data-minimisation principles in our own working papers, extracting only what is needed for testing rather than retaining full data sets beyond what the engagement requires.

It depends on what the internal audit actually covered and how it was scoped. Internal audit typically tests a broader annual plan across many process areas at a defined depth, often rotating focus areas year to year, whereas a dedicated Credit, Operational & IT Risk Review goes deeper specifically into these three domains, with credit portfolio sampling and provisioning recalculation, IT governance assessment against RBI's Master Direction, and cross-domain correlation that a general internal audit plan may not have scoped this cycle. We review the internal audit's scope and findings first to avoid duplicating work, and focus this review on genuine gaps.

Not necessarily. Some clients conclude the engagement after follow-up verification confirms remediation, planning to commission the next full review at the next annual cycle. Others transition to a lighter-touch ongoing advisory arrangement — periodic check-ins on emerging risk areas, ad hoc review of new products or systems before launch, and support preparing for the next RBI inspection cycle — rather than a hard stop between one-off engagements.