What changed
RBI issued a new circular on January 7, 2021, updating the 2002 RBIA guidance. Key changes include: HIA must be a senior executive with independent judgement, appointed for a minimum of three years (preferably), and report directly to the Audit Committee of the Board, MD & CEO, or Whole Time Director. Banks must ensure internal audit staff have skills in IT, data analytics, and forensic investigation, and the Board must prescribe minimum service periods for audit staff.
What it means for you
Banks must overhaul their internal audit governance to ensure functional independence and professional competence. The HIA cannot have business targets or report to business verticals, reducing conflicts of interest. This aligns Indian banks with international standards like BCBS and IIA, potentially increasing audit effectiveness but requiring significant organizational changes and investment in training.
What you must do
- Review and revise internal audit policy to ensure HIA is a senior executive with direct reporting to ACB, MD/CEO, or Whole Time Director, and no business targets.
- Ensure HIA appointment is for a minimum of three years (preferably), unless internal audit is a specialized career function.
- Assess and fill skill gaps in internal audit teams, especially in IT, data analytics, and forensic investigation.
- Implement Board-prescribed minimum service periods for audit staff and consider mandatory stints for staff from other departments.
- Set up quarterly meetings between ACB and HIA without senior management presence if HIA reports to MD/CEO or Whole Time Director.
Who it affects
All Scheduled Commercial Banks (excluding RRBs), All Local Area Banks, All Small Finance Banks, All Payments Banks, Heads of Internal Audit, Audit Committees of the Board
What is the minimum tenure for the Head of Internal Audit under the new framework?
The HIA should be appointed for a reasonably long period, preferably a minimum of three years, unless the internal audit function is a specialized career function.
Can the HIA report to a business vertical head?
No, the HIA must not have any reporting relationship with business verticals and should not be given any business targets. The reporting line is directly to the Audit Committee of the Board, MD & CEO, or Whole Time Director.
What skills are required for internal auditors as per this circular?
Internal auditors should have competence in banking operations, accounting, information technology, data analytics, and forensic investigation, among others.