Audit of Banks

If an auditor of a company, during the performance of duties, has reason to believe that an offence involving fraud is being or has been committed against the company by its officers or employees, they are statutorily obligated under Section 143(12) of the Companies Act, 2013, to report the matter to the Central Government within the prescribed time and manner. [3, 11, 27, 35] For frauds involving amounts below a prescribed threshold, the report is made to the Audit Committee or the Board. The auditor must first report to the Board or Audit Committee, seeking their reply within 45 days, and then forward their report along with the management's response to the Central Government within 15 days. [27, 38] RBI's Master Directions on Fraud Risk Management also mandate banks to report frauds to the RBI within specific timelines, and auditors play a crucial role in this process. [10, 23, 24, 26] The ICAI's Guidance Note on Audit of Banks provides further clarity on these reporting obligations. [4, 8, 9, 12]

Income from non-performing assets (NPAs) is not recognized on an accrual basis. It is recognized only when it is actually received.

Maintaining auditor independence is crucial for providing an unbiased and credible audit opinion. The ICAI Code of Ethics sets out fundamental principles, including independence, that auditors must adhere to. Section 144 of the Companies Act, 2013, explicitly prohibits auditors from rendering certain non-audit services to their audit clients, including banks, to prevent threats such as self-review, self-interest, and advocacy. These prohibited services typically encompass accounting and bookkeeping, internal audit, actuarial services, investment advisory services, and management services. Auditors must also rigorously assess and mitigate any potential conflicts of interest arising from financial interests, close business relationships, or family relationships that could impair their independence, both in fact and appearance. The 'Guidance Note on Audit of Banks' issued by the ICAI provides specific guidelines and considerations for auditors to ensure independence in the unique context of the banking sector.

While an auditor's primary ethical duty is to maintain client confidentiality, this duty is overridden by statutory and regulatory obligations to report frauds or irregularities. Section 143(12) of the Companies Act, 2013, mandates auditors to report fraud against the company by its officers or employees. If the fraud amount exceeds a prescribed threshold, it must be reported to the Central Government; otherwise, it is reported to the Audit Committee or the Board. Furthermore, the Reserve Bank of India's (RBI) Master Directions on Fraud Risk Management require banks to report frauds to the RBI within specified timelines, and auditors play a crucial role in ensuring compliance with these reporting requirements. Standard on Auditing (SA) 240, 'The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements,' also outlines the auditor's responsibilities, emphasizing communication with management and those charged with governance, and in certain circumstances, to regulatory and enforcement authorities, overriding the duty of confidentiality. The ICAI Code of Ethics provides the overarching ethical framework for these responsibilities.

An NPA is a loan or an advance where interest and/or installment of principal remains overdue for a period of more than 90 days in respect of a term loan.

A conflict of interest arises when an auditor's objectivity or independence is, or appears to be, impaired due to relationships or activities. For a bank auditor, this could include having a financial interest in the bank, providing certain non-audit services (as prohibited by Section 144 of the Companies Act, 2013) [2, 6, 7, 29, 30], or having close personal or business relationships with the bank's management or employees. The ICAI Code of Ethics provides a framework for identifying and evaluating threats arising from conflicts of interest and requires the implementation of safeguards or, if necessary, withdrawal from the engagement. [1, 13, 33, 36, 39] RBI guidelines for the appointment of statutory auditors also address conflict of interest, stating that the Board/Audit Committee of the bank shall monitor and assess the independence of auditors and conflict of interest, and report any concerns to NABARD/RBI. [28, 42, 43]

Auditor independence is paramount in bank audits to ensure an unbiased opinion on the financial statements. The Companies Act, 2013, particularly Section 144, prohibits auditors from rendering certain non-audit services to the audited company, its holding company, or its subsidiary company, such as accounting, internal audit, investment advisory, and management services, to prevent conflicts of interest and maintain independence. [2, 6, 7, 29, 30] The ICAI Code of Ethics further elaborates on fundamental principles like integrity, objectivity, and professional competence, and identifies threats to independence (self-interest, self-review, advocacy, familiarity, and intimidation threats). [1, 13, 33, 36, 39] Safeguards include robust internal policies, rotation of engagement partners, and peer reviews. RBI also issues guidelines on the appointment of statutory auditors, emphasizing independence and prohibiting concurrent auditors from being appointed as statutory auditors for the same bank, with a minimum gap of one year between assignments. [28, 42, 43]

The auditor is bound by strict confidentiality requirements as per the ICAI Code of Ethics. Information obtained during the audit, including sensitive customer data, cannot be disclosed to third parties. However, this confidentiality is not absolute and can be breached when disclosure is required by law (e.g., under a court order, by regulatory bodies like RBI or MCA, or under specific statutes like the Prevention of Money Laundering Act) or when it is necessary to comply with the quality review of the Institute. Section 143(13) of the Companies Act, 2013, specifically states that an auditor reporting fraud in good faith will not be regarded as having contravened any duty of confidentiality. [27, 35]

Before accepting a statutory audit engagement for a bank, a Chartered Accountant is ethically and professionally obligated to communicate with the previous auditor in writing. This mandatory requirement is stipulated under Clause 8 of Part I of the First Schedule to the Chartered Accountants Act, 1949, and is further elaborated in the ICAI Code of Ethics. The primary objective of this communication is to ascertain if there are any professional reasons that might prevent the new auditor from accepting the appointment. This includes inquiring about any outstanding audit fees, significant disagreements with management on accounting principles or audit procedures, or other issues that could impact the new auditor's decision or the scope and conduct of their work. Failure to communicate with the previous auditor before accepting the engagement constitutes professional misconduct under the Chartered Accountants Act, 1949.

Standard on Quality Control (SQC 1) requires audit firms to establish a system of quality control designed to provide reasonable assurance that the firm and its personnel comply with professional standards, regulatory, and legal requirements, and that reports issued are appropriate. [5, 15, 31, 37, 40] This includes policies and procedures related to ethical requirements, client acceptance, human resources, engagement performance, and monitoring. Peer Review, conducted by the ICAI's Peer Review Board, is a systematic monitoring process to ensure that members comply with technical, professional, and ethical standards, and have proper systems for quality assurance in their audit engagements. [18, 20, 21, 22, 25] For bank audits, given their complexity and public interest, adherence to SQC 1 and successful peer review are critical for demonstrating the firm's commitment to ethical conduct and high audit quality.

Upon identifying significant non-compliance with RBI regulations or prudential norms, a bank auditor's ethical responsibility extends beyond merely informing the bank's management or Audit Committee. The auditor has a direct reporting obligation to the Reserve Bank of India (RBI) in certain circumstances, as stipulated by specific RBI circulars and the Banking Regulation Act, 1949. This is vital for safeguarding the stability and integrity of the financial system. The auditor must exercise professional judgment and due diligence to assess the implications of such non-compliance. Reporting typically involves informing the bank's Board/Audit Committee, who then bear the responsibility to report to the RBI. However, in severe cases or as mandated by specific regulations, direct communication with the RBI may be required, overriding the auditor's duty of confidentiality. The ICAI Code of Ethics and the 'Guidance Note on Audit of Banks' further elaborate on these responsibilities and the appropriate reporting channels.

Beyond the Companies Act, bank auditors have specific obligations to report certain matters directly to the RBI, as mandated by various RBI circulars and directions. These obligations often arise from the RBI's role as the primary regulator of the banking sector, aiming to ensure financial stability and protect public interest. [17, 19] For instance, auditors may be required to report significant irregularities, non-compliance with banking regulations, or any matter that could have a material impact on the bank's financial health or systemic stability, even if it does not strictly fall under the fraud reporting mechanism of the Companies Act. [23, 24, 26] The ICAI's Guidance Note on Audit of Banks frequently updates auditors on such specific reporting requirements to the RBI. [4, 8, 9, 12, 14] The Board/Audit Committee of the bank is also required to review the performance of statutory auditors annually and report any serious lapses or negligence to the RBI. [28, 43]

Professional skepticism, as defined in SA 200, is an attitude that includes a questioning mind, being alert to conditions that may indicate possible misstatement due to error or fraud, and a critical assessment of audit evidence. [44, 45] In a bank audit, this is crucial when evaluating management's estimates, provisions for Non-Performing Assets (NPAs), valuation of complex financial instruments (e.g., derivatives covered by Ind AS 109), and compliance with various regulatory norms. [34, 41, 46, 48, 49] Due diligence requires the auditor to plan and perform the audit with professional competence and care, obtaining sufficient appropriate audit evidence. The ICAI Guidance Note on Audit of Banks provides specific guidance on applying these principles to the unique aspects of banking operations, such as credit appraisal, treasury operations, and asset classification. [4, 8, 9, 12] SA 240 specifically addresses the auditor's responsibilities relating to fraud in an audit of financial statements, requiring auditors to identify and assess risks of material misstatement due to fraud and respond appropriately. [5, 32, 44, 45, 47]

The ethical principle of professional competence and due care dictates that an auditor should not undertake an engagement unless they possess the necessary expertise and resources to perform it diligently. This principle is enshrined in the ICAI Code of Ethics and further detailed in SA 200, 'Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with Standards on Auditing'. If an audit firm lacks significant prior experience in auditing complex financial instruments prevalent in banking, there is an ethical risk of issuing an inappropriate audit opinion due to a lack of understanding or inadequate audit procedures. In such a scenario, the auditor should either acquire the requisite knowledge and skills through training, engage specialists with proven expertise in those specific financial instruments, or, if competence cannot be assured, ethically decline the engagement. The 'Guidance Note on Audit of Banks' also underscores the importance for auditors to possess adequate knowledge of banking operations, including complex financial products and regulatory requirements, to ensure a quality audit.

Advances are classified into Standard, Sub-standard, Doubtful, and Loss assets based on the period of default and realisability of the asset. This classification determines the provisioning requirements.