Bank Audit Essentials: IRAC, Provisioning & Ind AS 109 ECL Guide

Bank audit essentials form the spine of the IIBF Certified Accounting and Audit Professional (CAAP) syllabus, and they reward candidates who can connect a prudential rule to the exact entry it forces in the ledger. Examiners rarely test a definition in isolation; they test whether you can trace an overdue loan through classification, provisioning and disclosure, and then explain how an auditor would catch an error in that chain.

This guide builds that chain step by step. We move from the statutory and concurrent audit framework, into the IRAC norms that govern income recognition and asset classification, up the provisioning ladder, across the forward-looking Ind AS 109 expected credit loss model, and finally into the Long Form Audit Report (LFAR) and the fraud reporting duties that every bank auditor must master for the 2026 examination.

What bank audit essentials actually cover

The audit of an Indian bank is deliberately multi-layered, because no single review can give complete comfort over a balance sheet built largely from loans. Understanding these layers is the first of the bank audit essentials, since each layer has a different scope, periodicity and reporting line that the CAAP paper loves to contrast.

At the top sits the statutory audit, conducted by Statutory Central Auditors and Statutory Branch Auditors who are appointed with Reserve Bank of India (RBI) approval. They express an opinion on whether the financial statements give a true and fair view under the Banking Regulation Act 1949 and the Companies Act 2013, supported by the Standards on Auditing issued by ICAI. Their work spans advances, investments, deposits, off-balance-sheet exposures and the verification of Capital to Risk Weighted Assets Ratio (CRAR) disclosures.

Running alongside is the concurrent audit, a continuous, near real-time examination of transactions at high-risk branches and central processing units. It checks adherence to internal controls, KYC and anti-money-laundering norms, foreign exchange limits and the correctness of interest application. Because concurrent auditors flag deviations early, management can correct them well before the year-end close.

The three assurance layers at a glance

• Statutory audit: annual, opinion-based, RBI-approved appointment, certifies the financial statements.
• Concurrent audit: ongoing, transaction-level, control-focused, catches issues in real time.
• Internal audit and RBI inspection: add further independent assurance over risk and compliance.

For the exam, be ready to distinguish scope, periodicity and reporting lines in a single sentence each. Once that framework is clear, strengthen it with structured practice on CAAP mock tests before you step into the prudential norms below.

IRAC norms: income recognition and asset classification

The IRAC norms are the heart of bank audit essentials, because they decide both what income a bank may book and how it must label every advance. Income Recognition requires that interest on a Non Performing Asset is not booked on an accrual basis; it is recognised only when it is actually realised in cash. This single rule prevents a struggling loan from inflating reported profit.

An account becomes a Non Performing Asset when, broadly, interest or principal on a term loan remains overdue for more than 90 days, when a cash credit or overdraft account stays out of order for more than 90 days, or when a bill remains overdue beyond 90 days. The precise triggers and any special cases are set out in the current RBI Master Circular on prudential norms, so always confirm the latest text on the official RBI and IIBF material.

Asset Classification then sorts advances into four buckets based on the ageing of default:

• Standard Asset: carries no default risk beyond normal business risk.
• Sub-Standard Asset: has remained an NPA for up to 12 months.
• Doubtful Asset: has stayed sub-standard beyond 12 months.
• Loss Asset: identified as largely uncollectible by the bank, the auditor or the RBI, even if not fully written off.

Auditors must also test for borrowers classified inconsistently across multiple banks, scrutinise Special Mention Accounts that signal early stress, and verify the system-driven asset classification that the RBI now mandates so that human override cannot quietly hide an NPA. A firm grasp of IRAC connects straight into the wider credit syllabus covered in the Certified Accounting and Audit Professional course, and it feeds directly into the provisioning calculation that follows.

The provisioning ladder explained

Provisioning is the cushion a bank sets aside against probable loan losses, and the rates climb as asset quality deteriorates. Under the current RBI prudential framework, Standard Assets attract a modest general provision that varies by sector, while NPAs carry steeper, classification-linked provisions. The auditor's core job here is to confirm that the bank has applied the correct percentage to the correct outstanding balance, after accounting for the realisable value of security.

The indicative ladder below reflects the broad prudential structure; treat the exact percentages as point-in-time figures and always reconcile them with the latest RBI prudential norms before the exam.

Beyond the headline rates, auditors examine the Provision Coverage Ratio, the use of floating provisions, and the special treatment of restructured advances, where a concession to a stressed borrower can change both classification and provisioning. Because an error here flows straight into reported profit and the capital position, this is consistently a high-marks area. Reinforce the percentages with quick daily revision on the CAAP matching games so the ratios stay fresh under exam pressure.

Ind AS 109 ECL: the forward-looking model and its stages

Where IRAC provisioning is rule-based and largely backward-looking, Ind AS 109 introduces a forward-looking Expected Credit Loss (ECL) model, even though full convergence for Indian banks has been phased and is still being shaped by the RBI's proposed transition. For the CAAP paper, the ECL approach is essential because it represents the direction of travel for bank provisioning.

ECL estimates losses by blending three components, the probability of default (PD), the loss given default (LGD) and the exposure at default (EAD), with reasonable and supportable forward-looking macroeconomic information. The standard then sorts financial assets into three stages based on how much credit risk has changed since the asset was first recognised:

• Stage 1: performing assets with no significant increase in credit risk. The bank recognises 12-month ECL and books interest on the gross carrying amount.
• Stage 2: assets showing a significant increase in credit risk since origination. The bank recognises lifetime ECL, while interest is still calculated on the gross carrying amount.
• Stage 3: credit-impaired assets. The bank recognises lifetime ECL and books interest on the net carrying amount.

Here the auditor evaluates whether the staging criteria are appropriate, whether the modelling assumptions are reasonable, how management overlays are justified, and whether the disclosures are complete. The key contrast to memorise for the exam is simple: ECL is generally more conservative and more dynamic than incurred-loss IRAC provisioning, because it anticipates losses rather than waiting for them. For a deeper treatment, study our companion explainer on Ind AS 109 ECL provisioning for banks.

LFAR and fraud reporting duties

The Long Form Audit Report (LFAR) is a detailed, questionnaire-based report that branch and central auditors submit in addition to the main audit report. It probes the adequacy of internal controls, the quality of advances and their documentation, the housekeeping of inter-branch accounts, the reconciliation of suspense and sundry accounts, and compliance with KYC norms. In effect, the LFAR helps management and the RBI surface systemic weaknesses that a clean audit opinion alone might never reveal.

On fraud reporting, auditors must stay alert to red flags such as diversion of funds, fictitious accounts and circular transactions. Banks classify and report frauds to the RBI through the prescribed Fraud Monitoring Returns, and large exposures attract reporting on a Red Flagged Account basis through the Central Repository of Information on Large Credits (CRILC). Layered on top, under Section 143(12) of the Companies Act 2013, an auditor who has reason to believe a fraud is being committed must report it to the Audit Committee or Board, and above the prescribed threshold, escalate it to the Central Government.

Mastering the LFAR structure and the fraud reporting timelines is essential for scoring well, since these connect the technical audit to its statutory consequences. Build the surrounding context with our detailed guides on the statutory bank audit and LFAR for CAAP and on IRAC and provisioning norms for banks.

A practical study plan for the CAAP audit paper

Knowing the bank audit essentials is one thing; recalling them accurately in a timed paper is another. The following four-week plan turns the topics above into reliable marks.

1. Week 1, framework: map statutory, concurrent, internal and RBI inspection layers, and write one-line scope-and-periodicity contrasts from memory.
2. Week 2, IRAC and provisioning: drill the 90-day NPA trigger, the four classification buckets and the full provisioning ladder until the percentages are automatic.
3. Week 3, ECL: internalise PD, LGD and EAD and the three-stage model, then practise comparing ECL against IRAC in a short written answer.
4. Week 4, LFAR and fraud, plus revision: lock the LFAR coverage areas and the Section 143(12) and CRILC reporting routes, then sit full-length papers under time.

Anchor every week with active recall rather than passive reading. Rotate timed sets from the full IIBF mock test library and browse the complete set of exam guides on the CAAP blog to fill any gaps you discover.

Common mistakes candidates make

• Booking interest on an NPA on accrual: income on an NPA is recognised only when actually realised, never on accrual.
• Confusing the secured and unsecured split: doubtful-asset provisioning treats the unsecured portion at 100% and ages the secured portion separately, so mixing them is a classic error.
• Treating ECL as just renamed IRAC: ECL is forward-looking and staged, whereas IRAC applies fixed backward-looking percentages; examiners reward the contrast.
• Quoting exact rates as eternal truths: percentages and thresholds change, so always tie your answer to the current RBI prudential norms and the latest IIBF material.
• Underestimating the LFAR: students who skip the questionnaire areas and fraud timelines surrender easy, high-value marks.

Frequently Asked Questions

When does a bank advance become a Non Performing Asset?

Broadly, a term loan becomes a Non Performing Asset when interest or principal stays overdue for more than 90 days. A cash credit or overdraft is treated as an NPA when the account remains out of order beyond 90 days, and a bill is treated likewise when it stays overdue beyond 90 days. Always confirm the exact triggers against the current RBI Master Circular on prudential norms.

What is the difference between statutory and concurrent audit of banks?

Statutory audit is an annual, opinion-based audit by RBI-approved auditors that certifies the true and fair view of the financial statements. Concurrent audit is a continuous, transaction-level examination at high-risk branches that focuses on internal controls and the early detection of irregularities. The two are complementary rather than substitutes.

How does Ind AS 109 ECL differ from IRAC provisioning?

IRAC provisioning is rule-based and backward-looking, applying fixed percentages by asset classification. Ind AS 109 instead uses a forward-looking Expected Credit Loss model with three stages, estimating losses from probability of default, loss given default and exposure at default, combined with macroeconomic factors. As a result, ECL is generally more conservative and more responsive to changing credit risk.

What is the Long Form Audit Report (LFAR)?

The LFAR is a detailed, questionnaire-based report that bank auditors submit over and above the main audit report. It covers internal controls, the quality and documentation of advances, inter-branch and suspense reconciliation, and KYC compliance. Its purpose is to help management and the RBI identify systemic weaknesses that a clean audit opinion might not reveal.

What are an auditor's fraud reporting duties in a bank?

Auditors must watch for red flags such as diversion of funds, fictitious accounts and circular transactions. Banks report frauds to the RBI through Fraud Monitoring Returns, and large credits are flagged via the CRILC. Separately, under Section 143(12) of the Companies Act 2013, an auditor who reasonably believes a fraud is occurring must report it to the Audit Committee or Board, and above the threshold, to the Central Government.

How should I revise provisioning percentages for the CAAP exam?

Treat the percentages as a ladder that rises with deterioration, and revise them through active recall rather than re-reading. Short, frequent drills, including matching exercises and timed mock questions, embed the ratios far better than long passive sessions. Crucially, always re-verify the current rates against the latest RBI prudential norms before the exam.

Conclusion

Bank audit essentials reward candidates who can move smoothly from prudential theory to ledger-level verification, across statutory and concurrent audit, the IRAC norms, the provisioning ladder, Ind AS 109 ECL staging, the LFAR and fraud reporting. Learn each rule together with the entry it forces and the error it prevents, and the CAAP audit paper stops feeling like memorisation and starts feeling like reasoning.

Lock these essentials in with timed practice and steady revision, and keep one eye on current notifications, because the figures move even when the principles do not. You can always cross-check the source framework on the official IIBF website. Stay consistent, and the Certified Accounting and Audit Professional paper is well within your reach in 2026.

Related Guides