Reserve Bank of India (Small Finance Banks - Internal Audit Function) Directions, 2026

1. Starts at once

The rules start the moment RBI issues them.

2. Who must follow this

These rules apply to every small finance bank.

1. Retired staff for three years

Retired people may be engaged, for a tenure not going beyond three years.

2. The board owns the system

The board must see that the audit system works and is understood everywhere.

3. Auditors stay impartial

Audit staff must do their work with objectivity and impartiality.

4. The board approves four things

A policy, a risk method, a yearly plan, and a rule on retired staff.

5. The method is written down

The audit department writes the risk method and the board approves it.

6. The plan and its reasons

The plan must carry the schedule and the reason for each piece of work.

7. The board judges the audit

The board checks the audit for reliability, accuracy and objectivity.

8. A minimum posting period

The board sets how long audit staff must serve in the department.

9. Senior staff spread the word

Senior management must make the whole bank understand why audit matters.

1. What the audit is for

It gives the board reasonable assurance that risk and control work.

2. Audit follows the risk

Audit work is planned around where the risk actually is.

3. Nothing is left out

Every activity and every location gets a risk assessment, risk staff included.

4. What auditors should know

Banking work, accounts, technology, data work and fraud investigation.

5. Pay not tied to sales

Audit pay must not depend on how the business lines they audit perform.

6. Testing is not optional

Testing real transactions is a necessary part of the work.

7. Full testing at worst risk

Where risk is extremely high, 100 per cent of transactions are tested.

BankPulse example. An audit team looks at a branch process with 900 entries in the year. The risk matrix puts it in the extremely high cell. So all 900 are checked, which is the 100 per cent RBI names. In a low risk area the team would have sampled instead.

8. Count the time since

How long it has been since the last audit is one of the tests.

9. Bad news must travel

The channels must encourage reporting of negative and sensitive findings.

10. Audit cannot be outsourced

The bank must not hand the internal audit function to an outside firm.

11. Experts work under the bank

Any expert hired works under the close supervision of the bank's management.

12. The reports stay the bank's

Ownership of every audit report stays with the bank's own audit staff.

13. Give the department people

The bank must give the audit department enough staff and resources.

14. A matrix for each activity

A risk matrix is drawn up for every business activity and location.

15. Look at the last report

The risk method starts from earlier audit reports and their compliance.

16. Tell audit about changes

New products, new reporting lines and accounting changes must reach audit.

17. A risk look every year

The risk assessment must be done at least once a year.

18. Money laundering is covered

The scope must include a review of the money laundering controls.

19. Report a serious gap

Serious weaknesses go to the right level of management as soon as found.

20. A review at least yearly

The audit department reviews its own work yearly, or more often.

21. Check the vendor first

Before any outside arrangement the bank checks the vendor can do the work.

22. Papers belong to the bank

The contract must say the reports and work papers are the bank's property.

23. Plan for a sudden end

The bank needs a fallback if the outside arrangement stops suddenly.

24. Experts may still be hired

Outside experts, even former employees, may be taken on contract.

1. The audit head is senior

The head of internal audit is a senior executive who can judge on his own.

2. He can see everything

He may speak to any staff member and reach any record or file.

3. No business targets

He has no reporting line to business and is given no business targets.

4. Three years in the chair

He should be appointed for a long period, preferably three years at least.

5. Meet him every quarter

The audit committee meets the audit head alone once in each quarter.

1. Old rules stand repealed

The earlier internal audit rules for these banks are repealed.

2. Old actions still stand

Anything done under the old rules stays governed by those old rules.

3. Old approvals still count

Approvals given under the repealed rules now come under these rules.