Auditing Banks & Financial Institutions

• This chapter focuses on the special features of auditing banks and non-banking financial companies
• The unit specifically covers the special features of auditing banks

Learning Outcomes

• Understanding the legal and regulatory framework for financial statements of banks
• Knowing the unique aspects of auditing bank accounts and auditor reports
• Understanding concepts like Cash Reserve Ratio (CRR), Statutory Liquidity Ratio (SLR), and Capital Adequacy
• Understanding the procedures for verifying bank assets and liabilities
• Acquiring knowledge about concurrent audits and the activities they cover
• Knowing the audit committee's role in bank audits

Unit Overview

• The overview shows the relationships between various aspects of bank audits, such as:
• Regulatory framework
• Financial statement form and content
• Audit of accounts and reports
• Audit process
• Internal controls
• Verification procedures

Viraj & Associates

• Viraj & Associates, an experienced auditing firm, was appointed a Statutory Central Auditor for a nationalized bank
• CA Mansukh reviews treasury operations to understand bank operations and internal controls alongside joint auditors
• Treasury operations in banks are crucial for processing transactions and managing risks
• The main components of treasury are investments, forex, and derivatives

Investment Auditing

• Auditing bank investments is vital due to regulatory norms and financial statement impact
• Understanding IT controls and system applications related to investment functions is key since the investment function is automated
• Gaining detailed insights into deposit products, interest rate determination, and charges is important
• KYC verification processes must be examined
• The accurate application of interest rates on deposit products is a key area for sampling during audits
• Customer complaints are reviewed to identify potential material or contingent liabilities

Audit Partner Responsibilities

• CA Piyush (P K S D & Associates) is familiarizing himself with credit recovery policy and RBI guidelines
• CA Piyush is considering automation and income recognition related to credit portfolio recovery
• Ensuring consistency in income recognition and bank internal policy alignment is essential
• Planning procedures to upgrade Non-Performing Assets (NPAs) in line with RBI norms is necessary
• Reviewing the credit monitoring and restructuring department is also crucial for auditors due to its role in bank policies
• Credit monitoring helps manage risks effectively
• This department can also be responsible for restructuring stressed advances

CA Gopal

• CA Gopal (GSK & Co.) is performing internal and office account verification for the bank
• Verifying accounts holds significance, since those accounts can be misused for frauds like unauthorized openings
• Such accounts can be opened to afford credits to borrower accounts, preventing them from becoming NPAs
• Opening such accounts and periodic reconciliation is essential for auditors

Introduction to Bank Audits

• The banking industry, which is the pivot of economies and financial systems, acts as a foremost agent of financial intermediation
• A strong and resilient banking system is essential due to factors, including:
• Operation in competitive environments
• Regulatory alignment with international best practices
• Financial deepening in India is progress with consideration towards; orderly financial markets, growth
• Banks are different from other commercial organizations
• Banks safeguard monetary items and negotiable instruments
• This necessitates formal procedures, defined discretion limits, and internal control
• Banks engage in a large volume and transactions, driving complex accounting, internal control, and IT use
• Operations span wide geographic networks, necessitating decentralized authority and control, but with risks to uniform practice
• Banks assume significant commitments without immediate fund transfers, called 'off-balance sheet' items, potentially difficult to detect
• Transactions initiated in one location are recorded and managed elsewhere, increasing complexity in auditing
• Customers directly initiate and complete transactions, like through digital channels
• Integration and linkages of national and international settlement systems can create systemic risks
• Government regulatory requirements affect accounting and auditing in the banking sector

Special Audit Considerations

• Special audit considerations arise in the audit of banks due to factors including
• Risks of transactions
• Scale of banking operations
• IT dependence
• Statutory and regulatory requirements
• New products/services
• Technology evolution has led to operational and financial risks
• Auditors should design an audit approach that considers these factors
• Branch auditors and central auditors must have detailed knowledge of the products offered and associated risks
• Different applications can be used to carry out different transactions and use interface controls between applications.

Legal Framework

• A legal framework governs the operation of banks in India
• The principal acts include
• The Banking Regulation Act, 1949
• The Reserve Bank of India Act, 1934
• The State Bank of India Act, 1955
• The Co-operative Societies Act, 1912
• The Companies Act, 2013
• The Securitization and Reconstruction of Financial Assets and Enforcement of Security Interest Act, 2002
• The Prevention of Money Laundering act, 2002
• The Information Technology act, 2000
• The payment and settlement systems act, 2007
• The acquisition and transfer of undertakings (for bank companies) acts

RBI Powers

• The Reserve Bank of India has powers over banks

Form and Content of Financial Statements

• Every banking company must prepare a Balance Sheet and Profit and Loss Account as per the Third Schedule of the Banking Regulation Act
• Third Schedule Form A outlines Balance Sheet form, while Third Schedule Form B outlines Profit and Loss Account
• Banking companies must comply with disclosure requirements in Accounting Standards and section 133 of the Companies Act 2013
• Implementation of Indian Accounting Standards (Ind AS) is currently deferred by RBI for scheduled commercial banks
• Balance sheets often involve preparing standalone and consolidated financial statements
• Standalone include consolidating branch accounts and incorporating bank functions
• Procedures vary across banks
• Private banks have accounting processes, so there is no mandated branch audit
• Public and private sector banks comply with SEBI regulations including LODR if they are listed

Audit of Accounts & Auditor Appointment

• Section 30 of the Banking Regulation Act mandates balance sheet and profit and loss account audits for banking companies by qualified auditors
• Nationalized and public sector banks specifically appoint multiple firms of CA to act as statutory central auditors (SCAs)
• The appointment letter includes:
• Appointment period
• Central auditors information
• Past auditor information
• Acceptance compliance for appointment procedures
• Work division and reporting responsibilities
• Assignment scope for reports
• Details specific to branch auditors

Auditor Appointment Authority

• Auditors of banking companies are appointed at the annual general meeting, as per enactments
• For nationalized banks, bank acts through the board of directors
• Reserve Bank approval is required

Conducting an Audit

• The audit process can be broken down into steps
• initial considerations
• understanding the entity
• risk assessment
• execution
• reporting

Initial Considerations

• Engagement risk is assessed for audit engagements and influences the acceptance decision
• Banks obtain a declaration of indebtedness before appointing central and branch auditors.
• Banks ensure that auditor/firm/partners/family members have not been declared as willful defaulters
• Statutory auditors should not take on both statutory audit work and internal assignments simultaneously

Audit Engagements

• SA 210 requires agreement on the terms of audit engagements for each audited period
• Engagement terms should be written to detail agreed upon terms and responsibilities
• Communication with the previous auditor is necessary before accepting an audit
• The audit plan needs to be documented with respect to timing, extent of checking and it should be continuously updated
• Qualified experienced professionals should be assigned

Stage 2: Understanding

• Audits require qualified and experienced professionals.
• The size of the engagement team depends on the bank’s size, nature, and complexity
• Understanding the bank, its environment enables auditors to identify risks
• Allows auditors develop a plan considering the effectiveness of controls
• Banks create accounting processes for proper management
• Process helps in assessing risk of missatatement and for designing procedures

What is Required For the Auditor?

• Developing an understanding the risk management process
• Management develops controls and performance indicators to manage risks
• Effective banks require:
• Oversight by those charged with governance such as written management policies which are consistent with strategy
• Identification, measurement, and monitoring of the risks
• Risk should be identified, measured, and monitored against approval of limits
• Banks should manage risks including duties, Segregation and Physical Security and contingency planning
• Regularly assess and update risk
• Needs Banks require systems which produce adequate information, allowing them to assess risk.

Risk Assessment

• SA 315 requires auditors to assess the risk of material misstatement
• As per SA 240, auditors should assess the risk of material misstatement due to fraud
• Professional skepticism is important
• RBI has “Know Your Customer (KYC)” to prevent money laundering activities

Evaluating Risks

• Auditors should identify specific risks of material misstatement at the financial statement level, referencing IT industry regulations
• Banks use outsourcing, reducing costs and making sure experts are available
• Risk must be managed
• Engagement teams hold discussions to gain better understanding of banks

Risk Responses

• Implement overall responses to address the risk of material misstatements
• Prepare appropriate audit procedures to minimize risks
• SA 300 highlights need for plan
• Engagement partners should determine planning of an audit
• The auditor should provide documentation on scope, highlighing issues and risks

Audit Memorandums

• Audit planning memorandum should :
• Describe audit procedures
• Highlight risk, or planning
• Provide evidence on engagement and any response to engagement risks

Audit Materiality and Going Concern

• Auditors should relate audit materiality and audit to audit risk when performing audits
• Professional judgement depends on the engagement and the specific bank.
• In understanding a bank, the auditor must determine whether there are any conditions of risk within the bank.

Audit Reports and The IT Implication

• There are specific reporting requireements here, it's critical to look at all aspects
• The technology has changed banking.
• Banks must provide the auditor with detailed information
• Auditors should examine:
• Overall IT policy
• Data processing
• Data security
• Disaster control plans
• Accounting manual
• Control

Key Security for Computerized Banks

• Auditors should ensure various controls are operating effectively, which are put in place by management
• Audits are also designed around the methodology employed by the bank during application
• Ensure authorised, accurate data
• In the case of power failure, the system continues to create the records
• IT has a security to ensure that employees are not able to read other information
• Changes are authenticated
• Exceptions reports being reported
• An account master must be authorised

Internal Audit and Inspection

• Centralized audit and inspection are combined at banks, headed by an executive
• Function: undertaking based internal audit
• Identifying new branches
• Make sure that audits are running and discussing issues — Primary function in ensuring the audit runs smoothly

Risk Assessment

• Identification of risks
• Making assessment of risk levels
• Draw uping of risk matrix
• Internal controls are necessary to maintain regulatory requirements and mitigate risks

Areas That Require Internal Controls

• General
• Verify all employees are continually shifted
• Work is checked by another regularly
• Accurately proof books
• Check officer is in possession of items
• Officer checks is receiving correspondence
• Insurance is held
• Cash
• Double checking everything
• Clearning
• Signature and drawer must be verified