RBI/2020-21/33

Ref.No.DOS.CO.PPG./SEC.01/11.01.005/2020-21                                  September 05, 2020

The Chairman / Managing Director / Chief Executive Officer All Scheduled Commercial Banks (Excluding RRBs)

All Local Area Banks

All Small Finance Banks and All Payment Banks

Madam /Dear Sir,

Long Form Audit Report (LFAR) – Review

Please refer to RBI circular No. DBS.CO.PP.BC.11/11.01.005/2001-2002 dated April 17, 2002 on revision of Long Form Audit Report (LFAR).

• Keeping in view the large scale changes in the size, complexities, business model and risks in the banking operations, a review of the LFAR formats, in consultation with the stakeholders, including the Institute of Chartered Accountants of India (ICAI), was undertaken and it has been decided to make the following changes.

• The format of LFAR, as mentioned below, have been revised:
  • Annex I for Statutory Central Auditors (SCA)
  • Annex II for Branch Auditors
  • An Appendix as part of Annex II for the specialized branches and
  • Annex III on Large / Irregular / Critical accounts for branch auditors. The revised formats are enclosed.

• The revised LFAR formats are required to be put into operation for the period covering FY 2020-21 and onwards. The mandate and scope of the audit will be as per this format and if the SCA feels the need of any material additions, etc., this may be done by giving specific justification by the SCA and with the prior intimation of the bank’s Audit Committee of Board (ACB).

• Regarding other operational issues relating to submission of LFAR, we further advise as under:
  • Timely receipt of LFARs from the auditors should be ensured;
  • The LFAR on the bank, after due examination, should be placed before the ACB / Local Advisory Board of the bank indicating the action taken/proposed to be taken for rectification of the irregularities, if any, mentioned therein; and
  • A copy each of the LFAR (i.e. for the bank / all Indian Offices of foreign bank as a whole) and the relative agenda note, together with the Board’s views or directions, should be forwarded to the concerned Senior Supervisory Manager (SSM) in the Department of Supervision, Reserve Bank of India within 60 days of submission of the LFAR by the statutory auditors.

• The LFAR format and other instructions issued vide RBI circular No. DBS.CO.PP.BC.11/11.01.005/2001-2002 dated April 17, 2002 stand repealed.

• Please acknowledge receipt.

Yours faithfully,

(Ajay Kumar Choudhary) Chief General Manager

Encl: Annex I and II and III

Annex I – Long Form Audit Report (LFAR) by the Statutory Central Auditors (SCA) to the Management of the bank

1. Guiding principles on objectives, strategy, scope and coverage of LFAR
   1. The overall objective of the Long Form Audit Report (LFAR) should be to identify and assess the gaps and vulnerable areas in the business operations, risk management, compliance and the efficacy of internal audit and provide an independent opinion on the same to the Board of the bank and provide their observations.
   1. This may also involve commenting on various risks to which the banks are exposed to like credit, market, operational and liquidity risk and risk management efficacy, assessment of appropriateness of procedures for preparation of supervisory returns, KYC/AML/CFT issues, cyber security, business performance, business strategy including very high growth / high ROE accompanied with high risks, etc.
   1. Some of the matters to be dealt with by the SCA in their LFARs will be based on the LFARs received from the branches. In dealing with such matters, the SCA are expected to exercise their own judgement to make their observations on the basis of review of branch auditors’ LFARs.
   1. While deciding their audit strategy, the auditors may factor-in all material issues which are considered critical by looking at the size and complexity of the business operation, business strategy/models, internal controls including the control culture of the bank, structure and complexity of the IT systems, etc.
   1. The scope and coverage of Statutory Audit and LFAR will broadly be as per the given format. However, if the SCA feels a need of some material additions, etc. in the scope, this may be done by giving specific justification and with the prior intimation to the Audit Committee of the Board of the bank.
   1. SCA may resort to need based limited transaction testing as hitherto.
   1. In deciding whether a qualification in the main report is necessary, the auditors should use their judgement based on the available evidences / facts and circumstances of each case.

B.    Coverage in the Long Form Audit Report (LFAR) by the Statutory Central Auditors (SCA) (Indicative)

1. Loan Policy: The observations should broadly cover the sufficiency and effectiveness of the loan policy along with the compliance to instructions issued by RBI in areas like exposure norms, interest rates, statutory and other restrictions, among others. Other aspects relating to updation of the policy, system of monitoring and adherence thereto should also be commented upon. The observations should also comprise business model/business strategy as per the policy as against the actual business/income flow of the bank.
2. Credit Assessment: Whether the credit assessment process is sufficiently placed to capture the risk as also the adequacy of information/data available with the bank. The quick mortality cases be closely examined.
3. Sanctioning / Disbursement: Policy relating to delegation of powers at various levels, appropriateness of checks and balances, adherence to authorised limits, disbursal after complying with terms and conditions of disbursal be examined.
4. Documentation: The entire process, including the system of ensuring execution as per the terms of sanction, system of documentation in respect of joint/consortium advances, availability of relevant documents to ensure creation of charge in favor of banks when required, renewal of documents, should be examined. Defects observed along with compliance to RBI guidelines/bank’s internal policy in this regard be also examined.
5. Review / Monitoring / post sanction follow-up/Supervision: Extent of coverage and effectiveness of credit monitoring system covering both on balance sheet and off-balance sheet exposures, along with the quality of reporting both within the bank and outside agencies (like RBI CRILC, CIBIL, etc.) be examined along with adherence to RBI instructions/bank’s own policy be examined. Special focus be given on functioning and effectiveness of system of identifying and reporting of Red Flagged Accounts, Early- Warning System (EWS), receipt of periodic balance conformation / acknowledgement of debts, stock/book debt statements, balance-sheet, audited-accounts etc. System of scrutiny of the above information and follow-up by the bank should also be examined to identify process gaps. System of periodic physical verification or inspection of stocks, equipment, machinery, other securities etc. and review/renewal of advances including enhancement of limits, overall monitoring of advances through maturity/aging analysis should also be

examined and suitably factored-in.

• Restructuring/Resolution of Stressed Accounts: Comments on deviations observed in restructured accounts/stressed accounts under resolution with reference to Internal / RBI guidelines should be provided. Special emphasis should be given on the stance of the bank with respect to resolution of stressed accounts, specially covering compliance to regulatory guidelines, formulation of board approved policies including timelines for resolution, the manner in which decisions are taken during review period, board approved policies regarding recovery, compromise settlements, exit of exposure through sale of stressed assets, mechanism of deciding whether a concession granted to a borrower would have to be treated as restructuring or not, implementation of resolution in accordance with the laid down conditions, among others.
• Asset Quality: Special emphasis should be given on continuous monitoring of classification of accounts into Standard, SMA, Sub-standard, Doubtful or loss as per IRAC Norms by the system, preferably without manual intervention, correct recognition of income, and adequacy of provision thereof. Effectiveness of the system for compiling data relating to NPA and their provision, data integrity, system of suspension of charging of interest and adherence thereto, should be examined and commented upon. Deviations observed, if any, should be provided along with requisite examples. Further, comments  be provided on the procedure followed by the bank in upgradation of NPAs, updation of the value of securities with reference to RBI regulations and compliance by the bank with divergences observed during earlier RBI Inspection(s) with requisite examples of deviations, if any.
• Recovery Policy: The existence and effectiveness of recovery policy, along with regular updates, manner of appropriation of recovery, instances wherein the appropriation was not as per the recovery policy be examined and commented upon. Instances observed / reported wherein the instructions of controlling authority related to legal action for recovery or recalling of advances is not acted upon, system of compromise settlements, system of monitoring accounts under Insolvency and Bankruptcy Code 2016 (IBC), write-off be specifically commented. In respect of compromise settlement, special emphasis should be given to the systems and processes relating to cases of recovery of Rs. 1.00 crore and above and also the cases wherein limits of sacrifice laid down in the recovery policy is breached. Further, the auditors should verify the list of accounts where insolvency proceedings had been initiated under IBC, but subsequently was taken out of insolvency under Section 12A of the IBC. The auditors may satisfy themselves regarding

the reasons of the creditors, especially the bank concerned, to agree to exiting the insolvency resolution process, and may comment upon deficiencies observed, if any.

• Large Advances: Comment on adverse features considered significant in top 50 standard large advances and the accounts which need management’s attention be provided. In respect of advances below the threshold, the process needs to be checked and commented upon, based on a sample testing.
• Audit Reports: Major adverse features observed in the reports of all audits/inspections, internal or external, carried out at credit department during the financial year should be suitably incorporated in the LFAR, if found persisting.
• Recovery Records: Recovery from all the written-off accounts during the finance year should be examined and commented upon.
• Wilful Defaulter: System of identifying and reporting of wilful defaulter should be examined and commented upon.

1. Investments including Derivatives: The focus should be on the merit of investment policy and adherence to RBI guidelines. Any deviations to the RBI directives, and guidelines issued by FIMMDA / FIBIL / FEDAI should be suitably highlighted. Special focus should be given on system of purchase and sale of investments, delegation of powers, reporting systems, segregation of back, middle and front office functions, efficacy of control over investments, including periodic verification/reconciliation of investments with book records, valuation mode, changes in mode of valuation, system relating to inter-bank call money operations, system relating to unquoted investments in the portfolio, system of audit including periodic verification/verification of investment activities/portfolios, policies and systems for monitoring activities such as underwriting, derivatives, etc. among others. With respect to RBI directives, special focus should be given on compliance to exposure norms, classification of investments into HTM / AFS / HFT category and inter-category shifting of securities, compliance to valuation, asset classification and provisioning norms, along with deviation from accounting and disclosure norms, among others. In respect of investment held at foreign branches, valuation mode, regulatory reserve requirements, liquidity etc. should be examined. Comments should also be made on the composition of investment portfolio as per RBI

guidelines and the depreciations on investments, if not provided for. System of recording of income from investments, income accrued and due but not received, monitoring of mature investments and their timely encashment etc. should be examined  and commented. The auditor may also comment upon the veracity of liquidity characteristics of different investments in the books, as claimed by bank in different regulatory/statutory statements. The internal control system, including all audits and inspections, IT and software being used by the bank for investment operations be examined in detail.

• SLR/CRR Requirements: Any discrepancies in the process of compilation and calculation of NDTL by the bank should be highlighted in the report. It should be specifically commented whether the bank has complied with CRR/SLR requirements, with the instances of non-compliance, thereof.
• Asset Liability Management: Existence of Policy on Asset-Liability Management and monitoring thereof, along with compliance with RBI guidelines and functioning of Asset Liability Management Committee should be examined.

1. Governance and Assurance Functions: Observations on governance, policy and implementation of business strategy and its adequacy vis-à-vis the risk appetite statement of the bank, effectiveness of assurance functions (risk management, compliance and internal audit) should be examined and suitably incorporated in the LFAR. Adequacy of risk-awareness, risk-taking and risk-management, risk and compliance culture per se, compliance testing, including the sustenance of the compliance, as also system of branch inspection, frequency, scope/coverage of inspection/internal audit, concurrent audit or revenue audit should also be examined along with the system of follow-up of these reports, position of compliance, corrective action taken by the bank among others.
   1. Balancing of Books/Reconciliation of control and subsidiary records: Special focus should be given on the system of control for internal accounts along with effectiveness   of the system of monitoring the position of balancing of books/reconciliation of control and subsidiary records, with details of books not balanced, if any. The item wise details  of system generated transitory accounts not nullified at the year-end should be given separately with ageing of such items.

• Inter-branch Reconciliation: The effectiveness of the system of inter-branch / inter- office reconciliation with respect to each type of entries, along with sufficiency of audit trail should be examined and commented upon. Age-wise analysis of unreconciled entries for each type of entry covered under Inter-branch reconciliation, as on balance sheet date along with subsequent clearance, thereof if any should be provided. Any unusual entries observed in the reconciliation process along with procedure for auto and forced matching of entries should be commented. Compliance with RBI guidelines with respect to provisioning for old outstanding entries, should be factored in the observations.
  • Frauds / Vigilance: Appropriateness of fraud risk management system and processes for early detection , timely reporting to RBI, investigation of frauds as also adequacy of provisioning with respect to reported frauds and deviations observed in compliance with directives issued by RBI should be examined and commented upon. . Age-wise analysis of the cases/complaints investigated/under investigation of Vigilance Department along with observations on major frauds discovered during the year under audit be provided. Special focus should be given on the potential risk areas which might lead to perpetuation of fraud (e.g. falsification of accounts/false representation by the borrower; misappropriation of funds especially through related party / shell company transactions; forgery and fabrication of financial documents like invoices, debtor lists, stock statements, trade credit documents, shipping bills, work orders and encumbrance certificates and avail credit; Use of current accounts outside consortium where Trust and Retention Account (TRA) is maintained, to divert funds; List of Debtors/ Creditors were being fabricated and receivables were not followed up/ write off of debt of related parties; Fake export/shipping bill, etc.; Over statement of invoice amounts, stock statements, shipping bills, turnover; fly by night operations -including the cases where vendors, related/ associate parties, manufacturing units etc. aren’t available on the registered addresses; Round Tripping of funds, etc.).
  • Suspense Accounts, Sundry Deposits, etc.: System of clearance of items debited / credited to suspense / sundry accounts should be examined with the focus on audit trail, along with age-wise analysis of un-cleared entries of suspense account, sundry deposit, etc. as on balance sheet date along with subsequent clearance, thereof, if any. Any unusual entries observed in suspense account, sundry deposit etc. should be specifically commented. An examination of inactive/ inoperative accounts may also be carried out, as it is a fraud prone area. It should also be examined, whether the bank has made adequate

provision with respect to un-cleared entries in suspense account, sundry deposits, etc. as per the RBI guidelines and to the satisfaction of the auditor.

• KYC / AML: It should be examined whether the bank has duly updated and approved KYC and AML policies in synchronization with RBI circulars / guidelines and whether the said policies are effectively implemented by the bank. Assessment of the effectiveness of provisions for preventing money laundering and terrorist financing may be provided for.
  • Cash and other security items: System of monitoring of cash at branches, and management of cash through currency chest operations, including adequacy of insurance cover, system and procedure for physical custody of cash, systems and controls for procurement, issue and custody of valued stationary items such as Cheque Books, Demand Drafts, Pay Orders, Gold Coins etc. should be examined.
  • Para-Banking Activity: It should be examined whether the bank has effective internal control system with respect to para-banking activities undertaken by the bank. A list of such para-banking activities undertaken by the bank should be provided.
  • Management Information System: Existence and adequacy of management information system, method of compilation and accuracy of information, appropriateness of procedures for preparation of supervisory returns and its reliability under the Off Site Surveillance System of the RBI, reliability of information flow for the internal risk management system should be commented. Additionally, comment should also be provided on whether the bank has effective system of preparation and consolidation of branch returns and financial statements.
  • Any Other comments relating to People, Process and System Risks: Any other concerns relating to people, process and system risks may be commented upon.

Capital Adequacy: A copy of the capital adequacy certificate be provided along with comments as to whether the bank has effective system of calculation of capital adequacy as per the directives of RBI. Any concerns which is considered material relating to the bank’s solvency and capital may be commented upon.

ICAAP Document: Whether Stress test is done as per RBI stress test Guidelines. Whether assumptions made in the document are realistic, encompassing all relevant risks. Also banks

strategies are aligned with their Board approved Risk Appetite Statements.

1. Going Concern Assessment: The auditor should comment whether the going concern basis of preparation of financial statements is appropriate; and auditor’s evaluation of the bank’s assessment of its ability to continue to meet its obligations for the foreseeable future (for at least 12 months after the date of the financial statements) with reasonable assurance for the same. Any material uncertainties relating to going concern should be disclosed.
2. Profitability: Analysis of variation in major items of income and expenditure compared to previous year should be carried out along with important ratios such as RoA, RoE, etc.
3. Liquidity Assessment: As a part of assessment of the bank on going concern basis, the auditor should also consider the robustness of the bank’s liquidity risk management systems and controls for managing liquidity, , any external indicators that reveal liquidity or funding concerns, the availability of short-term liquidity support and compliance with norms relating to Liquidity Coverage Ratio (LCR) and Net Stability Funding Ratio (NSFR- as and when applicable) among others.

1. Robustness of IT Systems: Auditors should comment on the robustness of IT systems covering all the software used by the bank along with functions thereof, inter- linkage/interface between different IT Systems, ATM network and its security, payment system products and services among others. Further, it should be examined whether the software used by the bank were subjected to Information System & Security Audit, Application function testing and any other audit mandated by RBI. Adequacy of IS Audit, migration audit (as and where applicable) and any other audit relating to IT and cyber security system and bank’s compliance to the findings of those audits should be commented upon.
2. IT Security and IS Policy: Auditors should comment whether the bank has duly updated and approved IT Security and IS Policy and whether the bank has complied with the RBI advisory/directives relating to IS environment/cyber security, issued from time-to-time.

• Critical Systems / Processes: It should be examined whether there is an effective system of inter-linkage including seamless flow of data under Straight Through Process (STP) amongst various software / packages deployed. Special emphasis should be placed on outsourced activities and bank’s control over them, including bank’s own internal policy for outsourced activities.

1. Comments on accounting policies including comments on changes in accounting policies made during the period.
2. Adequacy of provisions made for statutory liabilities such as Income Tax, Gratuity, Pension, Provident Fund, etc.
3. Adequacy of provisions made for off-balance sheet exposures and other claims against the bank.
4. Balances with other banks- observations on outstanding items in reconciliation statements.
5. Procedure for revaluation of NOSTRO accounts and outstanding forward exchange contracts.
6. Comment on system related to compliance with DEAF norms be provided.
7. Comment on compliance mechanism with regard to recommendations of specific committees appointed by RBI such as Ghosh, Jilani, Mitra, etc.
8. Observations on the working of subsidiaries/ associates/ joint ventures of the bank:
   1. reporting system to the holding bank and
   1. major losses of the subsidiary, if any.
9. Comment on business conduct including customer service by the bank describing instances, if any, of wrong debit of charges from customer accounts, mis-selling, ineffective complaint disposal mechanism, etc.
10. Any other matter, which the auditor considers should be brought to the notice of the management.

Annex II – Long Form Audit Report (LFAR) to the Management and the Statutory Central Auditors of the bank by the branch auditors in case of bank branches

The following paragraphs list the matters which the branch auditors of the bank are required to comment upon in their Long Form Audit Reports (LFAR). The appendix to this questionnaire additionally contains questions, which are relevant to the specialized branches dealing in foreign exchange transactions, branches having very large advances, recovery of non- performing assets (NPA) and clearing house operations, if any. Auditors of foreign branches of Indian banks should also furnish this report. In the case of foreign branches, reference to Reserve Bank of India should be construed to include Reserve Bank of India, as well as the relevant regulating authority of the foreign country where the branch is located.

A.    Guiding principles on objective, strategy, scope and coverage of LFAR for branch auditors

1. The overall objective of the branch audit should be to have transaction testing and provide inputs to the Statutory central Auditors on adequacy of implementation of various policy and regulatory requirements, including efficacy of the system and assurance functions (risk management, compliance and internal audit) at branch level.
   1. The threshold fixed for different purposes for comments in the LFAR will decide that above the threshold, the transaction detailing needs to be seen and commented upon. However, below the threshold, the system and processes should be checked and commented upon.
   1. Verification of data integrity and data related control systems and processes should be carried out and commented upon, with the special thrust on those data inputs which are to be used for MIS at corporate office level and for supervisory reporting purposes.
   1. Where any of the comments made by the auditors in their LFAR is adverse, they should consider whether a qualification in their main report is necessary. It should not, however, be assumed that every adverse comment in the LFAR would necessarily result in a qualification in the main report. In deciding whether a qualification in the main report is necessary, the auditors should use their professional judgment in the facts and circumstances of each case.

B.    Indicative Format / Coverage in the Long Form Audit Report (LFAR) by the Statutory Branch Auditors (SCB)

Name of Bank Name of Branch Branch Code Zone / Circle Code Financial Year

Appendix

Additional Questionnaire Applicable to Specialised Branches

1. For Branches dealing in Foreign Exchange Transactions
   1. Are there any material adverse features pointed out in the reports of concurrent auditors, internal auditors and/ or the Reserve Bank of India’s inspection report which continue to persist in relation to NRE/ NRO/ FCNR-B/ EEFC/ RFC and other similar deposits accounts. If so, furnish the particulars of such adverse features.
   2. Whether the branch has followed the instructions and guidelines of the controlling authorities of the bank with regard to the following in relation to the foreign exchange and, if not, state the irregularities.
      1. deposits
      2. advances
      3. export bills
      4. bills for collection
      5. dealing room operations (where a branch has one)
      6. any other area

3.         NOSTRO Accounts

Obtain from the branch management, a list of all NOSTRO Accounts maintained/ operated by the branch.

• Whether the bank has a system of periodic confirmation/ reconciliation of the balances in NOSTRO accounts maintained with each overseas bank/ correspondent? Has such confirmation been received and account reconciled at year end in each case. If not, give details.
• Whether the system of the bank ensures that all entries originated by overseas banks/correspondents, have been duly responded promptly in the respective NOSTRO accounts maintained by the bank?
• Are there any dormant/closed NOSTRO accounts in respect of which balances continue to exist in the books of the branch, at year end?
• Have the NOSTRO balances been converted at year end at the rates of exchange as prescribed by controlling authorities?
• In case, any matter deserves special attention of the management, the same may be reported

• Does the branch follow the prescribed procedures in relation to maintenance of Vostro Accounts?

B.    For branches dealing in Clearing House Operations, normally referred to as Service Branches

1. Does the branch have a system of periodic review of the outstanding entries in clearing adjustments accounts? In your view has the system generally been complied with?
   1. Whether review of the clearing adjustments accounts (inwards/ outwards) reveals any old/ large/ unusual outstanding entries, which remain unexplained? Give year-wise break-up of outstanding in number and value.
   1. Has the branch strictly followed the guidelines of the controlling authority of the bank with respect to operations related to clearing transactions? Comment on the systems and procedures followed by the branch in this regard.

C.    For branches dealing in recovery of Non-Performing Assets such as Asset Recovery Branches

1. In respect of borrowers with outstanding of Rs. 10.00 Crores and above the information should be obtained from the Branch Management. Comments of the Branch Auditor on advances with significant adverse features and which might need the attention of the management / Statutory Central Auditors should be appended to the LFAR.
   1. List the accounts with outstanding in excess of Rs. 10.00 Crores, which have been upgraded from Non-Performing to Standard during the year and the reasons thereof.

• Whether the branch has a system of updating periodically, the information relating to the valuation of security charged to the bank?
  • Age-wise analysis of the recovery suits filed and pending may be furnished, for the last three years along with latest status thereof.

Years               No. of Accounts                      Amount [Rs. in crore] Upto March 2018

2018-19

2019-20

2020-21

• Is the branch prompt in ensuring execution of decrees obtained for recovery from the defaulting borrowers? Also list the time barred decrees, if any, and reasons thereof. Give age-wise analysis of decrees obtained and not executed.
  • List the recoveries and their appropriation against the interest and the principal and the accounts settled / written off / closed during the year as per the bank’s policy. Give particulars of recoveries which are pending for appropriation as on year-end with reasons thereof.
  • List the new borrower accounts transferred to the branch during the year. Have all the relevant documents and records relating to these borrower accounts been transferred to the branch? Has the branch obtained confirmation that all the accounts of the borrower [including non-fund-based exposures and deposits pending adjustment / margin deposits] been transferred to the branch?

Signature of the Branch Auditor

Annex III – Long Form Audit Report (LFAR) for Large / Irregular / Critical Advance Accounts

(To be obtained by the Branch Auditors from branches dealing in large advances/asset recovery branches)

Date, Signature and Seal of Branch In-Charge