Bank Audit & IRAC Norms: Provisioning & LFAR for IIBF 2026

Bank audit and IRAC norms form the backbone of the IIBF Certified Accounting and Audit Professional (CAAP) paper, and few topics decide more marks. A bank's published accounts are only as trustworthy as the audit behind them, and that audit turns on one specialised discipline: how a bank recognises bad loans, classifies its assets and provides for the losses it expects to absorb. Get these prudential rules right and you control the highest-yield section of the syllabus.

This guide rebuilds the subject from first principles. We trace the Income Recognition and Asset Classification (IRAC) framework, decode provisioning and the move to expected credit loss, map every layer of the bank audit structure, and unpack the Long Form Audit Report. By the end you will not just recognise the terms; you will be able to classify a real account and reason through a case study under exam pressure.

What Bank Audit and IRAC Norms Mean

Bank audit and IRAC norms together describe how an auditor verifies that a bank has recognised income honestly, classified its loan book correctly and set aside enough capital against probable losses. A rigorous bank audit is precisely what gives depositors, regulators and investors confidence in the numbers a bank reports.

Banking is audited differently from any other business because banking accounting follows prudential rules unique to the sector. The recognition of bad loans, and the provisioning that follows, does not rely on management optimism; it follows hard, rule-based timelines. That is why the CAAP examiner treats this area as a core competency rather than a side topic.

IRAC Norms and Asset Classification

The heart of bank audit is the Income Recognition and Asset Classification (IRAC) framework. Under it, a loan becomes a Non-Performing Asset (NPA) when interest or principal remains overdue for more than 90 days. The moment an account is classified as an NPA, the bank must stop recognising interest income on an accrual basis and may book it only on actual recovery, a prudential safeguard against inflating profits with uncollectable interest.

NPAs are then graded by the length and severity of default. Memorising these timelines precisely is non-negotiable, because they are near-certain exam questions:

• A sub-standard asset is one that has remained an NPA for up to twelve months.
• A doubtful asset has stayed sub-standard beyond twelve months.
• A loss asset is identified as uncollectable, where the loss has been recognised but the amount not yet written off.

Before an account even reaches NPA status, Special Mention Accounts (SMA-0, SMA-1 and SMA-2) flag early stress, giving the bank a chance to act. For the exam, expect to be handed an account with a default history and asked to classify it, so drill these progressions until they are automatic. You can practise exactly these classification scenarios with our IIBF bank audit practice tests.

Provisioning and the Ind AS 109 ECL Shift

Provisioning is the cushion a bank sets aside against expected loan losses, and it rises in step with the severity of classification. Standard assets attract only a small general provision; sub-standard assets attract a higher percentage, with an additional charge for unsecured exposures; doubtful assets attract escalating provisions on the secured portion based on how long they have remained doubtful, plus full provision on the unsecured portion; and loss assets require full provisioning. The exact percentages follow the latest released RBI master direction, so always confirm the current figures against the official notification before the exam.

Auditors verify that provisioning is computed correctly, because under-provisioning quietly overstates both profit and capital. The bigger structural theme, however, is the move to the Expected Credit Loss (ECL) model under Ind AS 109, which requires banks to provide for losses on a forward-looking basis rather than only after a default has occurred.

The ECL approach classifies exposures into stages and estimates losses using three building blocks you must know cold: probability of default (PD), loss given default (LGD) and exposure at default (EAD). The table below contrasts the two regimes the examiner loves to compare.

The single most testable idea here is the conceptual shift from the incurred-loss approach to the expected-loss approach. Reinforce the provisioning vocabulary with our audit terms match game, which turns dry definitions into fast recall.

The Bank Audit Framework

Bank audit operates through several layers, and the exam expects you to match each layer to its purpose and frequency. Understanding how they fit together is as important as memorising any single definition.

• Statutory audit is conducted by external auditors appointed with RBI approval, who express an opinion on the truth and fairness of the financial statements.
• Concurrent audit runs alongside transactions in high-risk branches and functions, checking compliance almost in real time.
• Internal audit, increasingly organised as Risk-Based Internal Audit (RBIA), independently evaluates the adequacy of controls and risk management.

Beyond these, several specialised audits target specific risk areas: the information systems audit of the bank's technology environment, the credit audit of large exposures, and the stock audit of borrowers' inventory and receivables. Auditing standards issued by the relevant professional body, together with the RBI's master directions, govern how all of these are conducted.

To see how these audit layers slot into the wider CAAP syllabus, work through the dedicated Certified Accounting and Audit Professional subject hub.

LFAR, Fraud Reporting and Disclosures

At the year end, statutory auditors submit a Long Form Audit Report (LFAR), a detailed questionnaire-based report covering the bank's assets, advances and the adequacy of its systems and controls. The LFAR supplements the main audit report and is closely reviewed by the RBI, which makes it a recurring favourite in the question paper.

Auditors also carry a positive duty to report suspected frauds they encounter during the audit, consistent with the RBI's fraud-reporting framework and applicable company law. This is not optional: spotting and escalating fraud is part of the auditor's mandate, not an afterthought.

Finally, banks must make extensive disclosures in the notes to accounts, covering NPAs, provisioning coverage, restructured advances, concentration of exposures and capital adequacy, so that stakeholders can independently assess asset quality. The Provisioning Coverage Ratio (PCR) indicates how much of the gross NPAs has been provided for, and is a quick health signal examiners like to reference. For a deeper treatment of this report, read our companion guide on the Long Form Audit Report for CAAP 2026.

A Practical Study Plan for the CAAP Audit Paper

Knowing the syllabus is not the same as scoring on it. Use a focused, active-recall plan in the run-up to your exam, and confirm the exact dates on the official IIBF notification before you finalise your timetable.

1. Lock the spine first. In your earliest sessions, fix the 90-day NPA rule, the sub-standard-to-doubtful timeline and the provisioning hierarchy until you can recite them without notes.
2. Convert theory into accounts. For every classification rule, write a one-line example of an account that triggers it. The exam tests application, so train the way you will be tested.
3. Master the ECL shift. Be able to explain PD, LGD and EAD and contrast the incurred-loss and expected-loss models in two clean sentences.
4. Map audit type to purpose. Build a quick grid of statutory, concurrent, internal and specialised audits against what each one checks and how often.
5. Take timed mocks. In the final fortnight, attempt full-length papers under exam conditions and review every wrong answer.

Anchor each study block with a quick test. Our timed bank audit mock tests and rapid-revision match games make this active-recall loop fast and almost effortless.

Common Mistakes to Avoid

Even well-prepared candidates leak marks to a handful of predictable errors. Watch for these:

• Confusing the classification timelines. Sub-standard versus doubtful turns on the twelve-month threshold; mixing these up is the most common slip.
• Forgetting the interest rule. Many candidates remember the 90-day NPA trigger but forget that interest must then move to a recovery basis.
• Treating ECL as the same as IRAC. The expected-loss model is forward-looking and modelled, not a fixed-percentage rule.
• Blurring the audit types. Concurrent, statutory and internal audits differ in timing, appointment and scope; match them deliberately.
• Mismanaging the clock. Flag a hard numerical provisioning question and return to it rather than stalling and losing momentum.

Keep a running list of easily mixed concepts, such as sub-standard versus doubtful and IRAC versus ECL, and test yourself on the distinctions until they become automatic. For the broader picture, study our guide on the bank statutory audit process and scope and the focused note on IRAC asset classification and provisioning.

Frequently Asked Questions

When does a loan become an NPA?

A loan becomes a Non-Performing Asset when interest or principal remains overdue for more than 90 days. From that point, the bank stops recognising interest on an accrual basis and books it only on actual recovery. This prevents profits from being inflated by interest that may never be collected.

How are NPAs classified under IRAC norms?

NPAs are graded into sub-standard, doubtful and loss assets. A sub-standard asset has been an NPA for up to twelve months, a doubtful asset has stayed sub-standard beyond twelve months, and a loss asset is identified as uncollectable. Each successive grade attracts higher provisioning.

What is the Ind AS 109 ECL model?

The Expected Credit Loss model requires banks to provide for losses on a forward-looking basis rather than only after a default occurs. It classifies exposures into stages and estimates losses using probability of default, loss given default and exposure at default. It replaces the older incurred-loss approach.

What is the LFAR in bank audit?

The Long Form Audit Report is a detailed, questionnaire-based report submitted by statutory auditors. It covers the bank's assets, advances and the adequacy of its systems and controls, supplementing the main audit report. The RBI reviews it closely, which makes it a high-value exam topic.

How do statutory, concurrent and internal audits differ?

Statutory audit is an annual external opinion on the truth and fairness of the accounts, given by RBI-approved auditors. Concurrent audit runs alongside transactions in high-risk areas, checking compliance almost in real time. Internal audit, often as Risk-Based Internal Audit, independently evaluates controls and risk management.

What is the Provisioning Coverage Ratio?

The Provisioning Coverage Ratio indicates the proportion of gross NPAs for which a bank has already made provisions. A higher ratio signals a stronger buffer against loan losses and better asset-quality management. Examiners use it as a quick measure of a bank's resilience.

Conclusion

Bank audit and IRAC norms reward precision above all else. Master the 90-day NPA rule, the sub-standard-to-doubtful timeline, the provisioning hierarchy, the multi-layer audit framework and the LFAR, and you will have covered the questions that decide the CAAP paper. The classification timelines and the shift from incurred loss to the Ind AS 109 expected-credit-loss model are tested in almost every session, so over-learn them and rehearse them in scenario form.

Pair this disciplined understanding with steady timed practice and you will walk into the exam genuinely confident. Verify the latest syllabus and notifications directly on the official IIBF website, then put it all into action with a final timed bank audit mock.

Related Guides