Reserve Bank of India (Urban Co-operative Banks - Internal Audit Function) Directions, 2026
UR
- Applies toUrban co-operative banks
- StatusIn force
- IssuedJul 31, 2026
- Amendmentsnone tracked
- Length54 points in 5 sections · 5 min read
The four dates on this rule
- PublishedJul 31, 2026The day RBI put this document out. This is the same day as the Issued date on this rule.
- Starts to applyJul 31, 2026The day this rule starts to apply, as RBI's own text states it.
- Time to get readyNoneIt starts to apply on the day it was published.
- Last date to actNot statedNo date to act by was found in this document. Other dates may sit inside single paragraphs.
Kept in your browser only. Your desk
Show me the points for
Nothing is removed from the page.
What it says
How firm is each point
Stated by RBI — RBI’s own paragraph says this. We have only made it plainer.
Our reading — BankPulse read RBI’s paragraph and shortened it. The paragraph is the authority, not this line.
Needs judgement — RBI leaves this to the bank to settle, so nobody can give you a fixed number here.
Chapter I. Preliminary
1. Starts at once
The rules start the moment RBI issues them.
2. Who must follow this
These rules apply to every urban co-operative bank named below.
3. Risk audit at 500 crore
The risk based audit chapters bind a bank of 500 crore and above.
4. A separate rule below that
A bank under 500 crore follows a chapter of its own instead.
Chapter II. Governance and Oversight
Must know
1. The board owns the audit
The board or its audit committee is first responsible for internal audit.
2. New audit tools
New tools and technology should cut down manual checking.
Do it
3. It approves the plan
It approves an audit plan built on the level and direction of risk.
4. A quality programme is required
A quality assurance and improvement programme must cover the whole function.
5. A minimum posting period
The board sets how long staff must serve in the audit function.
6. Senior staff follow the policy
Senior management must see the board's audit policy is actually followed.
7. Act on findings in time
Audit findings must be acted on within the time given.
8. Build the function properly
Senior management must build a full and independent audit function.
9. Staff it and train it
It must be staffed with skilled people who are trained regularly.
10. One risk picture a year
Senior management puts the whole risk picture to the board at least yearly.
Background
11. Yearly audit check: optional
The quality assurance programme may include an assessment of the internal audit function at least once a year.
Chapter III. Risk-Based Internal Audit Framework
Must know
1. Nothing escapes for ever
The policy must fix the longest time even a low risk area can go unaudited.
2. Give it standing
The function needs enough authority, standing, independence and resources.
3. Pay not tied to sales
Audit pay must not depend on how the audited business lines perform.
4. What auditors should know
Accounts, technology, data work and fraud investigation among others.
5. Nothing is left out
Every activity and location is assessed, risk and compliance staff included.
6. Risk decides the order
The risk assessment decides which material areas are audited first.
7. Count the time since
How long it has been since the last audit is one of the tests.
8. The report rests on evidence
The audit report must rest on proper analysis and evaluation.
9. Audit cannot be outsourced
The internal audit function must not be handed to an outside firm.
10. The reports stay inside
Ownership of every audit report stays with the regular audit staff.
Do it
11. Write the policy down
The board's policy must set out the purpose, authority and responsibility.
12. Review it and share it
The policy is reviewed from time to time and made known widely.
13. Tell audit about changes
New products, new reporting lines and accounting changes must reach audit.
14. A risk look every year
The risk assessment must be done at least once a year.
15. A matrix of two risks
The business risk and the control risk are put together in one matrix.
16. Look at the last report
The risk method starts from earlier audit reports and their compliance.
17. Fix the job before starting
Plan, scope, aims, timing and people are settled before the work begins.
18. Enough scope and people
The scope and the people put on it must be enough to meet the aims.
19. Follow the findings up
There must be a system to track compliance with audit observations.
20. Old high risk items up
Pending high and medium risk items go to the board with the old ones.
21. Sound data behind it
The audit needs a proper reporting system and clean data.
Background
22. Banking knowledge counts
Knowing how a lender actually operates is part of the skill needed.
Chapter IV. Head of Internal Audit
1. The audit head is senior
The head of internal audit is senior and can judge on his own.
2. Three years in the chair
He should be appointed for a long period, preferably three years at least.
3. No business targets
He has no reporting line to business.
4. And no sales to chase
He is given no business targets of any kind.
5. Meet him every quarter
The board or its audit committee meets the audit head alone each quarter.
Chapter V. Inspection and Internal Audit System
Must know
1. He reports to the chairman
The inspection head is a senior person reporting straight to the chairman.
2. Three years before promotion
Three continuous years in inspection are needed before a senior promotion.
3. Where fraud usually hides
Credit appraisal, book balancing and inter-branch reconciliation get attention.
Do it
4. An inspection system is required
The smaller bank must run an inspection and internal audit system.
5. Every branch every 12 months
Every branch gets a surprise internal audit at least once every 12 months.
BankPulse example. A small co-operative bank has 18 branches. Every one of them has to be surprise-audited inside 12 months, so about three branches a quarter keeps the bank straight. Doing 18 in the last month would meet the words and lose the surprise.
6. Short surprise visits too
Large branches also get short surprise inspections at irregular times.
7. Revenue audit of big branches
Large branches also go through a regular revenue audit.
8. Check the accounts that follow
High value accounts that arrive with a transferred officer get a special look.
Background
9. Inspection is not fault finding
Inspections should teach staff the safeguards, not hunt for blame.
Chapter VI. Repeal and Other Provisions
1. Old rules stand repealed
The earlier internal audit rules for these are repealed.
2. Old actions still stand
Anything done under the old rules stays governed by those old rules.
3. Old approvals still count
Approvals given under the repealed rules now come under these rules.
The same subject for other kinds of institution
The same subject for other kinds of institution.
Other RBI rules for urban co-operative banks
RBI capital adequacy rules for urban co-operative banks 2025
RBI compliance officer and compliance function rules for urban co-operative banks
RBI concurrent audit rules for urban co-operative banks 2026
RBI credit bureau reporting rules for urban co-operative banks 2025
RBI credit card and debit card rules for urban co-operative banks 2025
RBI customer service and fair conduct rules for urban co-operative banks 2025
Every rule page on BankPulse · Questions bankers ask, answered