Guide to Concurrent Audit of Banks

Concurrent Audit of Banks means verifying the transactions without any time gap.

That’s one of the most frequently heard terms in the context of bank audits.

Isn’t the banking system crucial for the survival of any economy?

The answer will be an obvious yes.

There is a need to place robust controls and checkpoints for the smooth functioning of those banks.

Concurrent Audit of Banks helps in attaining such objectives.

Before diving deep into the concept, we will try to understand the basics.

What does Concurrent Audit mean?         

Short Definition: 

Concurrent Audit is a way of performing an audit simultaneously as and when the transaction happens. 

Long form of Definition:

The word Concurrent means “happening or done at the same time”. Audit means verification of transactions, typically by an independent body. 

A concurrent Audit is a systematic verification of financial transactions or activities at the time of happening or in parallel with the occurrence of the transaction.

Concurrent Audit reduces the time gap between the happening of a transaction and its verification. It aims to prevent errors or fraudulent transactions by taking timely remedial actions.

How about an example?

Consider a transaction allowing a 9% Personal Loan of Rs.100 Crore to a customer by a Bank.

Assume that the Bank has to undergo concurrent audits. 

The concurrent Auditor must verify all the transactions happening in the Bank. The Bank’s headquarters defines the audit’s scope.

The auditor noted that the interest charged (9%) is less than that stipulated by the bank policy of 10%. Early discovery of this resulted in saving the interest amount to the Bank. So, the Auditor found out the income leakage of around Rs.1 Crore.

That’s a wow moment, right?

Which Entities require Concurrent Audits?

We often tend to correlate concurrent Audits with banks for various reasons such as regulatory compliance, its wide implementation in this sector, etc. However, concurrent Audit is an audit methodology that can fit in any business sector. 

The methods and examples in this post apply to the banking industry. We can implement those in other sectors as well. That’s because the design of the concurrent audit scope is based on the following fundamentals:

1. Prevention and timely detection of serious irregularities or fraud
2. Strengthening the Internal controls in place
3. Identifying early warning signals (Like Multiple instances of Cheque bounces by a customer)

Why more emphasis on Concurrent audits?

Frauds or errors are one of the foremost reasons for considerable losses to banks, and this leads to more emphasis on establishing independent examination of financial transactions.

Fraud vs Errors

Intention is the distinguishing factor between these two. Frauds are nothing but a careful plan to deceive and gain an unfair advantage. Errors, on the other hand, are unintentional, and there is no objective of false representation. Below paras discusses these two intentions in detail.

Frauds

The alarming rise in banking sector fraud resulted in more emphasis on concurrent audits. Also, RBI and other banks are increasing the scope of audits, and this adds more responsibilities to concurrent auditors. 

As per the RBI Annual Report, bank fraud increased to 74% in 2018-19. It resulted in a total fraud of Rs. 71,543 crores in 2018-19 as against Rs.41,167 crore in 2017-18.

Current Year Update

According to official data, the number of fraud cases in private as well as public sector banks dropped to 118 in FY22 from 265 in 2020-21. 

Source: Live Mint

Fraud example

PNB Scam: The bank initially said that two of its employees at the branch were involved in the scam, as the bank’s core banking system was bypassed when the corrupt employees issued LOUs to overseas branches of other Indian banks. Read the full article on the Wikipedia page.

It seems that bank employees tried to gain an unfair advantage with a false representation.

Errors

RBI has imposed a fine on seven public sector banks. The total fine amount is Rs. 11 Crore. One of the reasons for the imposition of a fine is non-compliance in respect of the code of conduct for opening and operating current accounts. This non-compliance could be a result of an error.

The concurrent Auditor has a duty to report non-compliances pertaining to the opening of new savings and current accounts. This example will illustrate why the banks insist on more testing areas under concurrent audit scope and introducing the concurrent audit to a larger number of branches in order to avoid such fines.

So, Concurrent audits act as a medium of preventive vigilance to detect such kinds of frauds or errors.

Current Year Update

RBI imposed the following fines in recent times.

1. Bank of Maharashtra – Rs.1.12Cr fine
2. Axis Bank – Rs.25 lakh fine

Who Performs Concurrent Audits?

Banks’ own staff (Retired employees) or external auditors (independent) can perform these audits. However, there are specific guidelines laid out by the RBI for appointing Chartered Accountants (CA) firms for these assignments. Such guidelines are:

1. Any partner of the CA firm shall not be a director on the board of the Bank (Independence of CA)
2. No other partner of the firm mentioned above (first point) is also ineligible
3. CA’s should not be subjected to inquiry in the past as per the Institute of Chartered Accountants Act, 1949
4. Completion of Certificate course on Concurrent Audit of banks by ICAI

The List goes on…

To sum up, the idea behind the above requirements is to ensure that there shall not be any compromise in the Auditor’s ability to carry out the audit function or report significant deficiencies.

How to Conduct Concurrent Audits?

Concurrent Audits of banks are primarily driven by the scope defined by the Bank’s head office and RBI guidelines. The Bank Head Office or respective authority overseeing such audits provides the guidelines and desired format of the expected report. These help auditors to give a clear picture of typical audit areas to test. Additionally, Chartered Accountants can take the help of various resources provided by ICAI through its portal. Manual on Concurrent Audits is the best resource.

We must first understand the areas that a Concurrent Auditor needs to verify. The same are added below in detail.

Cash Verification

Cash transactions are most common in banks. However, there has been a decrease in Cash usage due to the convenience of using digital payment platforms. Thanks to those platforms.

Auditors should focus on the following areas:

• Physical verification of Cash in the currency chest of the Bank and ATM, if any 
• Cash always comes with the inherent risk of theft. So, there are certain retention limits laid down by the respective bank. So, Cash at the branch shall not exceed the retention limits. If so, then auditors need to mention it in the report. (Retention Limits are laid down in concurrent audit guidelines provided by the Head Office of the respective Bank).
• Ensure Proper Insurance coverage for the inward and outward remittances
• Banks need to report counterfeit currency. Check whether such instances happened during previous months or years. Practicality: The happening of such events is remote.

Soiled or Mutilated Notes:

All bank branches facilitate the exchange of Soiled or Mutilated notes.

Reserve Bank of India (Note Refund) Rules, 2009 require all the bank branches to display a board indicating the facility of such exchanges. 

Such Soiled or Mutilated notes will be handed over to the Currency Chest.

Currency Chest will submit all such notes to the RBI.

However, there is no time limit for this. But the Auditor shall verify whether the branch has a notice board displayed and inquire about the existence of such procedures. 

• Bank needs to report the accounting of currency chest transactions and the delays to the RBI

What are the consequences of delayed reporting to RBI?

Currency Chests must report all the transactions on the same day to RBI. If this is not the case, banks are charged penal interest or flat fees for the period of delayed reporting.

Penal interest is not only for delay in reporting but also covers the following instances:

• Wrong Reporting
• Non-Reporting
• Inclusion of Ineligible Amounts in Chest Balances

Source: RBI Website

Disclaimer: The above information is extracted from the RBI website solely intended to educate users.

Is KYC Compliance a Mandate for Concurrent Audit of Bank?

Yes, that’s very much required. Let’s understand KYC and the need for its compliance.

KYC means Know Your Customer.

RBI has issued guidelines (KYC Guidelines – Anti Money Laundering Standards) requiring banks to frame policies and controls to prevent Money laundering activities. 

Banks must obtain certain proofs to validate a customer before entering a financial transaction or establishing a banking relationship. Proof here would depend on the type of customers opening the bank account or entering into a banking relationship. 

What are the types of Customers?

Customers are categorized into two types 

1. Natural Person
2. Artificial Persons (Like Companies, LLP, etc.)

There is a requirement for Natural Persons to provide proof of Identity and Proof of Address. We have added an inclusive list of Proofs below in the table:

 Note: Banks have pre-defined acceptable proofs in their KYC Norms or account opening forms. As a Concurrent Auditor, ensure that the branch has adhered to such guidelines.

Artificial Persons are also required to provide proof such as a Partnership Agreement for firms, Company Incorporation documents (Memorandum and Articles of Association), and a Board resolution authorizing the opening of bank accounts.

Mere submission of a photocopy of the above proofs will not suffice. The authorized officer of the bank shall also confirm the authenticity of photocopies with the Original documents. Such officer will add their initials to photocopies confirming verification with the Originals.

PAN Card is also mandatory for opening a bank account irrespective of whether the person is a natural or artificial person.

Why KYC?

• There shall not be the opening of any new accounts with a fictitious name
• Banking transactions shall not be allowed for persons on the RBI sanctions list or Government Watch Lists.
• Details such as the nature of business and customer financial status help in risk categorization. It furthers the bank in determining financial credibility and thereby assists in providing Credit facilities to the customers
• Obtaining such proofs helps the bank to monitor transactions and avoid unnecessary hardships and costs. 
• Anti-Money Laundering (AML) Guidelines require banks to obtain such information. AML – Means changing the identity of illegal money into legal.

Let’s go through the example below to have a clear understanding of the requirements to comply with KYC norms.

KYC Example:

It is an illustrative example for understanding purposes. 

Mr A has a huge amount of cash received as a bribe during his business. Then, he opened bank accounts with fake proofs and used such accounts for his business payments. Previously, the bribe amount was not in the books. But now, it’s legal money. So, Mr A got a double benefit (Conversion of Illegal money and moving it into business as legal money). 

The auditor should perform the following checks in verifying KYC:

1. The Account Opening form is filled with all mandated details such as Nomination, specimen signatures, passport photos, etc.
2. Bank officers need to verify the address and identity proofs.
3. Submission of PAN Card or Form 60/61
4. Verify whether all the details are properly entered into the bank application software. Specimen signature also needs to be scanned and attached to the customer profile. Specimen signature helps bankers to validate various services like Cheques and DDs issued by the customer
5. Bank needs to obtain the KYC details on a periodic basis. Periodicity is determined by customer risk and bank norms.

How to verify steps taken by bank for KYC compliance?

• Inquire whether there is such a procedure in the bank
• If so, then check for its implementation
• Normally, banks do a follow-up through SMS/Email to update KYC
• If the risk is higher, the submission requirement might be less than 2-3 years. It all varies from bank to bank.

ATM/Debit Cards/Credit Cards

Verify whether the branch levies charges for issuing a debit card or ATM card per the bank policies.

In General, if the cards are due for renewal, then there will not be any charges. However, if there is a need for replacement (Stolen or missing cards), then the bank needs to charge for it. Ensure you check if applicable taxes like GST are levied.

Perform a physical count of the following cards

• Cards which are left over (Not possible for bank to deliver due to a variety of reasons)
• Banks started with a new approach for quick opening of bank accounts. So, the customer can open the bank account and get the instant kit on the same day. The instant kit includes a debit card as well. The bank will have inventory Cards which are ready for immediate activation.

Cards which are unused within their expiry date shall be destroyed or sent to the head office as per their policy. So, the audit team can check for the same.

Does Concurrent Audit benefit from verifying Dormant/Inoperative Accounts?

Accounts that are not operative for a pre-defined period will be frozen, and no further operations are allowed unless authorized by a competent banker officer.

Consider verifying whether appropriate charges are levied before bringing it to an active state.

How to verify Dormant Accounts?

Dormant Accounts report can be pulled from bank software. So, obtain the report as of the date and three months old (for example). Run a quick comparison and figure out the active accounts in those.

Typically, such accounts come into operation if the bank has received a request from the customer. Banks will also insist on a deposit along with KYC proofs.

Loans and Advances

Bankers’ primary business is to lend money for interest. Interest payments are due monthly, quarterly, half-yearly, or annually. No specific period is applicable for all loans and advances, and it depends on a case-to-case basis.

Loans and Advances are a prime audit risk for concurrent auditors due to the volume of money involved. So, a special focus shall be given to these banking products.

What are the Checkpoints in Loans and Advances?

The answer depends on the type of Loan Product. However, we can see the generic pointers applicable to all loans first. Then, we will move on to specific audit checkpoints for each loan category.

General Checkpoints

• Check whether the Interest rate charged is per bank terms.
• Loan Application and appropriate forms are filled in by the customer. Also, verify if those applications are backed by proper supporting documents.
• Check whether documentation charges and processing charges along with GST are levied as per bank policy.
• Obtain the Loan statement and verify whether principal and interest repayment are regular.
• In case of irregular payments, ask for the next steps taken by the branch to ensure prompt collection.

Gold Loans

Gold Loans are loans granted against the Security of Gold Coins or ornaments. The checkpoints are below.

1. Obtain the Gold Valuation Report to check the security value and compare it with the sanctioned Loan amount. The loan amount shall always be lower than the value of the Security. 
2. Most banks have a policy of sanctioning loans with an upper cap of 60% to 70% of security value. So, there will always be a buffer of 30-40% on the security value, and the loan is sanctioned for the remaining balance. Request the policy and verify whether the same is followed.
3. Depending on the loan amount, the Banker may approach a second valuer for the valuation of the Security. Here, the second valuer shall be independent of the traditional valuer. So, check for those instances as per bank policy and verify whether the same is followed appropriately.

For example, the Bank policy is to obtain a second valuation report for a gold loan exceeding Rs.1 Crore. 

Mr. Loss approaches a bank for a Rs. 1.5 Crore Gold Loan. Now, bankers request a second opinion to gain better comfort over the security value per their policy. 

Note: Primary and Second valuation reports shall not be on the extreme end. For instance, Report A values gold as worth Rs . 10 Crores, and Report B mentions the same gold security value as Rs . 5 Crores. Then, this current scenario results in checking for the competence of the valuers.

A difference of 5%-10% is acceptable.

Individual Loans

Bank Overdraft and Credit Cards fall into these categories. 

Bank overdraft:

A bank overdraft is a loan facility that allows the account holder to withdraw money beyond what is available in their account. One interesting concept to learn is the drawing power here. So, these are an equivalent version of credit cards.

Overdrafts are one of the oldest banking products, dating back to before the start of using credit cards.

Bank overdrafts are generally unsecured. 

Do you recall seeing an option to ask to open an overdraft facility instead of prematurely closing your online fixed deposit?

Banks are making the most of technology. So, they started showing up those pop-up questions to increase their banking business.

Credit cards:

Credit cards are the best banking products. Banks allow their customers a free credit period (45 days or 50 days, or 90 days) per their policy. It generates a statement with the outstanding balance after the completion of the credit term. Customers can pay the entire amount with no interest fees or pay a minimum amount with interest.

The initial limit will be lower and gradually rise as per the person’s spending ability. The individual credit score, salary, or business income are additional factors that contribute for increasing the limits.

These days, financial institutions are moving forward with novel strategies, such as customizing credit cards for each individual. Examples include e-commerce-specific credit cards (Flipkart Axis Bank, Amazon ICICI Card), travel-related cards (Doctors Credit Card), and the list could go on and on.

These loan applications are handled by banking teams based in the corporate headquarters. So, the concurrent auditor has nothing to do with it.

Checks to be done

Let’s look at the checkpoints in this instance to gain a broad picture.

• Credit card transactions will be converted into EMI per customer preferences. Such an EMI transaction requires the levy of processing charges. 
• Furthermore, any processing fees will be subject to GST. Verify if the charged GST rates are per the GST Act and Rules.
• Banks shall consider classifying the unpaid credit cards as non-performing assets if the amount is outstanding for more than 90 days.
• Obtain the late payments report and determine whether any penalties for late payments are imposed.
• If bank overdrafts are granted with a fixed deposit as Security, then ensure that appropriate withdrawal controls (like a lien on FD) are in place.

Corporate Loans

Loans sanctioned for corporate organizations to meet their working capital needs, expansion or commencement of business, or the purchase of fixed assets are referred to as corporate loans.

Check Points

• Board of Directors will approve fresh borrowings or modifications to the existing financings. So, verify if the loans are adequately supported with a Board resolution.
• If a loan is given on the Security of immovable assets such as land, buildings, or others, ensure that the Security was adequately inspected before loan sanction. Obtain the inspection report as well as photos of the securitized asset.
• Working capital Loans like Cash Credit or overdrafts are granted by hypothecation of inventory and book debts. So, check the value of the inventory and book debts with the most recent audited financial statements. 
• Banks may require frequent audits of stock and book debts if necessary. Inspect those for such reports and check if any concerning discoveries will result in the borrowers defaulting.
• Borrowers must present a periodic stock and book debts statement, an audited balance sheet, and a provisional balance sheet per the loan terms. Check to see if the submission is on time.

Drawing Power

Drawing power is the maximum amount which borrowers can use for their personal or business needs.

• Similar to Gold Loans, there will be a buffer between the security value and the loan amount, and the buffer or margin must always be met during the loan tenure.
• For example, the banker’s margin amount per their policy is 40%. If the value of inventory is Rs.100 Lakhs, then the Working Capital Limit is Rs.60 Lakhs. So, the bank needs to check the drawing power for the loan periodically as and when stock statements are received. 

What if the inventory value is lower?

If the value of inventory is Rs.50 Lakhs, then the working capital limit will reduce to Rs.30 Lakhs. It does not stop there. Bankers might, and bankers repay immediately based on their credibility assessment.

Auditors are advised to pick up samples of borrowers whose drawing power depends on the value of stock and book debts. Further, also verify whether the security value after considering the margin is at least equal to the sanctioned amount.

Does Concurrent Audit of Banks help in finding Income Leakage?

• Banks charge a fee for providing chequebook facility and non-maintenance of minimum balance. Verify whether the bank levies such charges before allowing further transactions. The bank’s software may not charge the fees if the account does not have a sufficient balance.
• Loan comes with stipulated terms like submission of data/reports such as stock and book debt statements, balance sheet, confirmation that proper statutory returns are filed. If there is non-submission or delay in submission, then the bank needs to levy the charges as per their policy. Check for those instances
• Ensure proper recovery of Locker rents. Ask if there is any e-mandate to the associated savings or current account.
• Verify the Staff welfare and Stationery expenses GL. Those expenses shall be consistent with prior months.

Lastly, perform substantive analytical procedures over periodic revenue and expenses to help you in understanding the historic trends and in finding gaps

Summary

Concurrent Audit is a way to reduce the time gap between occurrence and verification of transactions. It helps in preventing and detecting frauds/errors and thereby contributing to the smooth functioning of banks.

The typical areas to be covered are:

• Firstly, the audit team needs to check for KYC Compliance
• Physical verification of Cash and Debit or Credit cards
• Verify whether the Loans and advances are sanctioned as per bank powers.
• Check if the Loans and advances are sanctioned after obtaining appropriate loan applications and other forms along with supporting documents like pre- and post-inspection reports, title deeds of property, if applicable, regular repayments, etc.
• Ensure that there is no loss due to income leakage
• Ask for compliance with applicable state and central laws
• Perform Physical inspection of borrowers’ security (for example – Immovable property, Stock)

The above list is not comprehensive. So, follow as per the guidelines and scope defined by the appointing authority. We hope this guide helps in steering your audits in the right direction.

All the best for your bank audits. Keep reading and loving this blog.

Do share this guide with your co-professionals!