Bank Statutory Audit 2026: Process, Scope & LFAR Guide

You're studying for the Certified Accounting and Audit Professional (CAAP) exam. And one of the weightiest topics on your syllabus is the bank statutory audit process. This isn't just theoretical knowledge—it's the backbone of banking regulation. And understanding it will earn you both exam marks. Credibility in your audit role.

In this guide. We'll unpack the entire statutory audit journey for banks in 2026: from the auditor's scope. Responsibilities.

Through IRAC norms and provisioning rules. To the feared Long Form Audit Report (LFAR). By the end.

You'll know exactly what an auditor looks for. How asset classification works. And why the LFAR matters so much to regulators.

What Is Bank Statutory Audit? Scope and Statutory Basis

A bank statutory audit process is the mandatory external examination of a bank's books. Accounts, and internal controls. It's not optional—it's mandated under Section 30 of the Banking Regulation Act.

1949, and overseen by RBI guidelines. Your role as an auditor is to give the regulator. Depositors.

And shareholders assurance that the bank's financial statements are true. Fair, and comply with law.

The scope is vast. You're not just ticking off income and expenses. You're verifying:

• Advance transactions and loan disbursals (see our detailed module on Audit Aspects of Advances Part 1)
• Deposit mobilisation and borrowings and deposits authenticity
• Asset classification under IRAC norms
• Provisioning adequacy for non-performing assets
• Compliance with Ind AS 109 for Expected Credit Loss (ECL)
• Capital adequacy ratios (CRAR)
• Off-balance sheet liabilities and contingencies
• Fraud detection and reporting to RBI

Understanding the full CAAP syllabus helps you see how each piece fits. The statutory audit is your framework; everything else cascades from it.

RBI's Master Circular on audit norms (available on rbi.org.in) sets the tone. As an auditor, you're the bridge between management and the regulator. Your opinion carries weight. That's why precision matters.

IRAC Norms and Asset Classification in Statutory Audit

IRAC stands for Income Recognition, Asset Classification, and Provisioning. It's the auditor's roadmap for determining. Loans are healthy and which are stressed. You'll encounter IRAC norms every single day in your audit work—and certainly in the CAAP exam.

Income Recognition means you must verify that interest income is only recorded when the bank has a reasonable expectation of collecting it. For Standard assets (low risk), banks recognise income on an accrual basis. The moment a loan slips past 90 days of default. You stop accruing income. That's the law.

Asset Classification puts loans into buckets:

• Standard: Less than 90 days overdue. Low risk, full income recognition.
• Sub-Standard: 90 days to 2 years overdue. The bank must make a 15% general provision and stop accruing income.
• Doubtful: Overdue for more than 2 years. Provisioning depends on the realisable value of security. No income accrual.
• Loss: Essentially bad. Full 100% provision or write-off. Zero income recognition.

Our article on IRAC norms and NPA classification dives deeper into the mechanics. During your audit, you'll inspect loan files, check dates of default, and verify that management has classified assets correctly. Any misclassification is a red flag for the auditor to highlight.

IRAC compliance is non-negotiable. RBI expects you, as the auditor, to validate it independently. Don't rely on management's classification alone—dig into the data.

Provisioning Norms and Expected Credit Loss (Ind AS 109)

Provisioning is the bank's safety buffer. It's the money set aside today to cover losses tomorrow. As an auditor.

Your job is to verify that the bank has provisioned enough—neither too much nor too little. This is where Ind AS 109. Expected Credit Loss (ECL) come into play.

Under the old rules. Banks used a fixed percentage based on asset classification. A Sub-Standard asset got 15% provision. Doubtful got 25–100% depending on security, and Loss got 100%. Simple, but crude.

Ind AS 109 flips this. It requires banks to compute Expected Credit Loss—a forward-looking estimate of what the bank might actually lose. You multiply the Probability of Default (PD) by the Loss Given Default (LGD) by the Exposure at Default (EAD). This is more sophisticated, more realistic, and frankly, more demanding on auditors.

Your audit checklist for provisioning includes:

• Verifying the ECL model's inputs (PD, LGD, EAD data)
• Testing the bank's classification of loans into Stage 1 (low risk). Stage 2 (increased risk), and Stage 3 (default)
• Validating that macro-economic factors are factored in (inflation, GDP growth, unemployment)
• Ensuring consistency with prior periods
• Checking disclosure in financial statements

Our deep-dive on Ind AS 109 and Expected Credit Loss explains the model step-by-step. And for a comprehensive view of provisioning rules across IRAC buckets, see IRAC Provisioning Norms. The exam will test your ability to marry IRAC classification with Ind AS 109 ECL. Master both.

Capital Adequacy (CRAR) and Off-Balance Sheet Audit

Capital Adequacy Ratio (CRAR) is one of the most critical numbers in banking. It tells you whether the bank has enough capital to absorb losses. RBI prescribes a minimum CRAR of 9% (Tier I + Tier II capital as a percentage of risk-weighted assets). Banks aiming for stability often target 12%–15%.

Your audit of CRAR involves:

• Verifying Tier I Capital: Paid-up capital, reserves, retained earnings. These are the bank's permanent resources.
• Verifying Tier II Capital: Subordinated debt, revaluation reserves, general provisions. These are quasi-permanent.
• Computing Risk-Weighted Assets (RWA): Different loan types carry different weights. A home loan (low risk) might have 35% weight. While an unsecured personal loan (higher risk) might have 100%. You multiply the exposure by the weight. Sum it all up, and divide total capital by RWA.
• Checking RWA computation: This is where errors creep in. Off-balance sheet items—guarantees. Letters of credit, forex forwards—also attract risk weights. Miss one, and your CRAR is wrong.

Off-Balance Sheet Liabilities are contingent obligations. The bank has given a guarantee. Issued an LC, or entered a derivative contract.

If the counterparty defaults, the bank might have to pay. These aren't loans on the books, but they carry credit risk. As an auditor.

You must identify and quantify them. Assign risk weights, and ensure they're disclosed in notes to accounts.

CRAR audit requires precision. One misclassified loan can swing your capital adequacy assessment. Take your time. Cross-check with the general ledger, and never assume management's numbers are correct.

Long Form Audit Report (LFAR) and Fraud Detection

The Long Form Audit Report (LFAR) is the auditor's narrative to RBI. It's not the short opinion you see at the front of annual reports. It's a detailed, bank-by-bank assessment of financial health, compliance, and risks. The LFAR typically runs 50–100 pages. Covers everything from asset quality to governance.

Our guides on Long Form Audit Report and the class modules on LFAR of Head Office and LFAR of Bank Branches are essential reading. The LFAR structure includes:

• Executive Summary: Overview of the bank's financial position.
• Asset Quality: Detailed discussion of NPA trends, provisions, recoveries, restructuring activity.
• Profitability and Efficiency: Interest margins, cost-to-income ratio, return on assets.
• Liquidity and Funding: Deposit trends, borrowing sources, liquidity coverage ratio.
• Capital Adequacy: CRAR computation, capital plans, regulatory compliance.
• Governance and Compliance: Board effectiveness, internal controls, regulatory breaches, money laundering risks.
• Fraud and Irregularities: Any fraud detected, regulatory disclosures, investigative findings.

Fraud Detection is a statutory obligation. You must test transactions for authenticity. Check for forged documents, verify collateral, and watch for cash misappropriation.

If you detect fraud. You must report it to the Audit Committee. RBI within a set timeframe (usually 15–30 days).

Failing to report is itself a breach of your duty.

The Scope, Statutory Provision & Compliance class covers your legal obligations in detail. Fraud detection isn't a side task—it's core to your audit mandate. Stay alert, trust your gut, and document everything.

Related Video Classes

PDF Study Notes & Cheat Sheets

Frequently Asked Questions

Final Word

The bank statutory audit process is the guardian of banking stability. You now understand its scope—from IRAC classification to Ind AS 109 provisioning. From CRAR computation to LFAR disclosures.

And from fraud detection to off-balance sheet verification. This knowledge isn't just for your CAAP exam. It's your toolkit for a career in banking audits.

Take time to watch the specialist videos—especially Scope, Statutory Provision & Compliance to solidify your understanding of your legal duties, and Standalone Financial Statements to see how all these audit findings fold into the final numbers. Your CAAP success hinges on mastery of these foundational concepts. Start today, stay methodical, and you'll cross the finish line with flying colours.

For more on bank statutory audit process. See the official IIBF circulars. Our chapter-wise free notes on iibf.store.

Source: Indian Institute of Banking & Finance — iibf.org.in

For more on “bank statutory audit process”, explore our free mock tests and chapter notes on iibf.store.

Bookmark this page — we keep our “bank statutory audit process” guidance current as IIBF revises its rules.

Still researching “bank statutory audit process”? Always confirm the latest position on the official IIBF site first.

Practise exam-style questions on “bank statutory audit process” free on iibf.store to lock in the concept.