Reserve Bank of India (Urban Co-operative Banks - Internal Audit Function) Directions, 2026

1. Starts at once

The rules start the moment RBI issues them.

2. Who must follow this

These rules apply to every urban co-operative bank named below.

3. Risk audit at 500 crore

The risk based audit chapters bind a bank of 500 crore and above.

4. A separate rule below that

A bank under 500 crore follows a chapter of its own instead.

1. The board owns the audit

The board or its audit committee is first responsible for internal audit.

2. New audit tools

New tools and technology should cut down manual checking.

3. It approves the plan

It approves an audit plan built on the level and direction of risk.

4. A quality programme is required

A quality assurance and improvement programme must cover the whole function.

5. A quality check yearly

The audit function itself is assessed at least once a year.

6. A minimum posting period

The board sets how long staff must serve in the audit function.

7. Senior staff follow the policy

Senior management must see the board's audit policy is actually followed.

8. Act on findings in time

Audit findings must be acted on within the time given.

9. Build the function properly

Senior management must build a full and independent audit function.

10. Staff it and train it

It must be staffed with skilled people who are trained regularly.

11. One risk picture a year

Senior management puts the whole risk picture to the board at least yearly.

1. Nothing escapes for ever

The policy must fix the longest time even a low risk area can go unaudited.

2. Give it standing

The function needs enough authority, standing, independence and resources.

3. Pay not tied to sales

Audit pay must not depend on how the audited business lines perform.

4. What auditors should know

Accounts, technology, data work and fraud investigation among others.

5. Nothing is left out

Every activity and location is assessed, risk and compliance staff included.

6. Risk decides the order

The risk assessment decides which material areas are audited first.

7. Count the time since

How long it has been since the last audit is one of the tests.

8. The report rests on evidence

The audit report must rest on proper analysis and evaluation.

9. Audit cannot be outsourced

The internal audit function must not be handed to an outside firm.

10. The reports stay inside

Ownership of every audit report stays with the regular audit staff.

11. Write the policy down

The board's policy must set out the purpose, authority and responsibility.

12. Review it and share it

The policy is reviewed from time to time and made known widely.

13. Tell audit about changes

New products, new reporting lines and accounting changes must reach audit.

14. A risk look every year

The risk assessment must be done at least once a year.

15. A matrix of two risks

The business risk and the control risk are put together in one matrix.

16. Look at the last report

The risk method starts from earlier audit reports and their compliance.

17. Fix the job before starting

Plan, scope, aims, timing and people are settled before the work begins.

18. Enough scope and people

The scope and the people put on it must be enough to meet the aims.

19. Follow the findings up

There must be a system to track compliance with audit observations.

20. Old high risk items up

Pending high and medium risk items go to the board with the old ones.

21. Sound data behind it

The audit needs a proper reporting system and clean data.

22. Banking knowledge counts

Knowing how a lender actually operates is part of the skill needed.

1. The audit head is senior

The head of internal audit is senior and can judge on his own.

2. Three years in the chair

He should be appointed for a long period, preferably three years at least.

3. No business targets

He has no reporting line to business.

4. And no sales to chase

He is given no business targets of any kind.

5. Meet him every quarter

The board or its audit committee meets the audit head alone each quarter.

1. He reports to the chairman

The inspection head is a senior person reporting straight to the chairman.

2. Three years before promotion

Three continuous years in inspection are needed before a senior promotion.

3. Where fraud usually hides

Credit appraisal, book balancing and inter-branch reconciliation get attention.

4. An inspection system is required

The smaller bank must run an inspection and internal audit system.

5. Every branch every 12 months

Every branch gets a surprise internal audit at least once every 12 months.

BankPulse example. A small co-operative bank has 18 branches. Every one of them has to be surprise-audited inside 12 months, so about three branches a quarter keeps the bank straight. Doing 18 in the last month would meet the words and lose the surprise.

6. Short surprise visits too

Large branches also get short surprise inspections at irregular times.

7. Revenue audit of big branches

Large branches also go through a regular revenue audit.

8. Check the accounts that follow

High value accounts that arrive with a transferred officer get a special look.

9. Inspection is not fault finding

Inspections should teach staff the safeguards, not hunt for blame.

1. Old rules stand repealed

The earlier internal audit rules for these are repealed.

2. Old actions still stand

Anything done under the old rules stays governed by those old rules.

3. Old approvals still count

Approvals given under the repealed rules now come under these rules.