Concurrent Audit in Banks: RBI Coverage, Scope and Reporting Norms

For the IIBF Certified Accounting and Audit Professional (CAAP) paper, concurrent audit in banks is the single most examinable control topic, because it is the only audit that runs alongside the transaction instead of long after it. Examiners rarely ask for a textbook definition. They ask which branches must be covered, what percentage of business the system must touch, who may be appointed, how often reports move upward, and what happens when a serious irregularity is found.

This guide organises the topic exactly the way CAAP questions are framed: coverage benchmarks and branch selection, the scope areas an auditor certifies, appointment and independence, reporting frequency and escalation, and closure of observations. It also draws the boundary lines against internal audit, risk based internal audit, statutory audit and stock audit, which is where most candidates lose marks.

🔎 What Concurrent Audit in Banks Means — and How It Differs

Concurrent audit is an examination of transactions at the time they take place, or very soon after, at the point where the transaction originates. The defining feature is timing, not depth. A statutory auditor reconstructs what happened over a completed financial year; a concurrent auditor sits inside the branch and catches an error while it is still reversible.

That timing changes the purpose. Concurrent audit is a management control, not an attestation exercise. It does not express an opinion on the truth and fairness of financial statements. Its job is to substitute for, and continuously test, the internal control system in units where the value or velocity of transactions makes annual verification useless.

Risk based internal audit works differently again: it allocates audit effort by risk score and audit frequency rather than by transaction, and reports independently to the Audit Committee of the Board. Candidates should read the risk based internal audit procedure chapter alongside this one, because RBIA rates a branch while concurrent audit watches it.

Quick comparison for the exam

🏦 Coverage and Branch Selection: What RBI Expects

RBI's long-standing benchmark is that the concurrent audit system should cover at least 50% of the advances and at least 50% of the deposits of the bank. This is a business-value test, not a branch-count test — a bank cannot claim compliance by covering a large number of tiny rural branches while leaving its metro corporate branches outside the net.

Beyond that floor, the board and the Audit Committee of the Board decide the selection criteria. In practice, selection is driven by exposure size, risk rating from the last internal audit, incidence of frauds and complaints, and the nature of business handled. A newly opened branch with aggressive growth, or one with a recent adverse audit rating, is pulled into the system even if its size alone would not justify it.

Certain units are treated as mandatory candidates regardless of size, because a single failure there is systemic rather than local:

• Treasury operations — dealing room, back office and mid-office, kept segregated
• Foreign exchange and authorised dealer branches handling trade finance
• Central processing centres, service branches and clearing hubs
• Currency chests and large cash-handling branches
• Specialised branches — corporate, industrial finance, asset recovery and NRI branches
• Data centres and centralised loan sanctioning units

The coverage list is not set once and forgotten. It is reviewed at least annually, and the bank must be able to demonstrate to inspectors why a given branch was included or dropped. Where a branch exits the system, banks usually route it into a tighter internal audit cycle rather than leaving a control vacuum.

💡 Exam Tip: If a question gives you branch-wise deposit and advance figures and asks whether coverage is adequate, test both limbs separately. Fifty percent of advances plus forty percent of deposits fails the test — the benchmark is not an average.

📋 Scope Areas the Auditor Must Cover

The scope of concurrent audit in banks is settled by the bank's board within RBI's broad framework, but the examinable core is stable across banks. Advances and documentation come first: whether sanction was within delegated authority, whether terms of sanction were complied with before disbursement, whether security documents are complete, correctly stamped and within limitation, and whether end-use was verified. Diversion of funds spotted here is what later feeds into wilful defaulters classification norms.

Income leakage is the area that pays for the audit. The auditor recomputes interest applied against the sanctioned rate, checks that processing fees, commitment charges, LC and guarantee commission, inspection charges and penal charges have been recovered, and verifies that concessions were sanctioned by a competent authority. Revenue audit and concurrent audit overlap heavily here.

Other standing scope areas include:

• KYC and AML — account opening documentation, risk categorisation, periodic updation, and reporting of cash and suspicious transactions to FIU-IND
• Deposits — interest rate application, premature closure, inoperative and dormant accounts, and unclaimed balances, covered in the audit aspects of capital, reserves and deposits chapter
• Forex — exchange rate application, outstanding export bills, overdue import remittances and FEMA compliance; see audit of foreign exchange transactions in banks
• Treasury — dealing limits, counterparty and stop-loss limits, deal slip sequencing and off-market rate deals
• High-value and exceptional transactions — large cash movements, sundry and suspense entries, office accounts, reversals and back-dated entries
• Asset classification — correctness of NPA marking and system-driven identification, plus provisioning inputs that flow into the preparation of final accounts of banks

Applied interest rates must be checked against the bank's current benchmark and spread, so keep a live reference such as the current RBI policy rates handy while working through numerical questions.

🧾 Appointment, Independence and Tenure

A bank may staff concurrent audit either with its own officers or with external chartered accountant firms, and most large banks use a mix. Where the bank's own officers are used, they must be sufficiently senior, must not be posted to a branch they previously worked in, and must report outside the branch line of command. An officer auditing transactions he could have authorised is not an auditor.

Independence is protected structurally rather than by declaration. The concurrent auditor reports to the controlling office or the internal audit department, never to the branch head being audited. The auditor has no authority to sanction, pass or reverse entries, and cannot be given operational work at the branch. The remuneration and the terms of engagement are fixed by the bank, not negotiated at the branch.

For external firms, the bank's board approves the empanelment policy, the eligibility criteria and the fee structure. Engagements are made for a defined term with a rotation policy, so that no firm audits the same branch continuously without a break — this mirrors the rotation logic applied to statutory branch auditors. Conflict checks matter: a firm that has done other assignments for a borrower of that branch should not audit that branch's advances.

The Audit Committee of the Board owns the whole arrangement. It approves the coverage list, the scope, the reporting formats and the accountability framework, and it reviews the performance of the system at least once a year. Poor-quality reporting, missed irregularities later found in inspection, or delayed submission are grounds for disengaging a firm.

A frequent exam error is to write that the concurrent auditor "rectifies" errors. He does not. He reports, follows up and verifies rectification, while corrective action stays with the branch and the controlling office.

📨 Reporting Frequency, Escalation and Closure

Reporting under concurrent audit works on a three-speed model, and this is a favourite exam question. Minor deviations that the branch can fix at once — a missing signature, an unstamped document, a wrongly applied charge — are pointed out on the spot and rectified immediately, with a note in the auditor's rough record. They do not need to travel upward if closed the same day.

Routine observations are consolidated into a periodic report, typically monthly, submitted to the controlling office in the bank's prescribed format with a compliance column. A consolidated position, including major irregularities and their rectification status, is placed before the Audit Committee of the Board at least quarterly.

The third speed is escalation. Where the auditor detects a serious irregularity — suspected fraud, unauthorised or fictitious transactions, diversion of funds, manipulation of records, or a large unauthorised exposure — reporting must be immediate and direct, bypassing the normal monthly cycle. It goes straight to the head office, the internal audit head and, where a fraud angle exists, the vigilance function, which is where a forensic audit in banks is typically triggered.

Closure is not the auditor's signature on a report. An observation stays open until the branch furnishes compliance and the auditor independently verifies it in a subsequent visit. Unrectified items are carried forward as a running list, with ageing, so that repeat and long-pending irregularities become visible to the controlling office. Persistent items also surface in the branch statutory auditor's report — see the Long Form Audit Report of bank branches chapter for how the two interact.

📌 Remember: Frequency of routine reporting is monthly to the controlling office and quarterly to the ACB; serious irregularities are reported immediately, without waiting for the periodic report.

🧠 Practice MCQs: Concurrent Audit in Banks

Want chapter-wise mock tests with 100+ MCQs? Start practising free →

Concurrent audit in banks rewards precision in the exam: know the 50/50 coverage benchmark, the mandatory units, the three reporting speeds, and the fact that the auditor reports but never rectifies. Pair this with disclosure topics such as segment reporting under AS 17 for banks to cover the reporting half of the syllabus.

Work through the full Certified Accounting and Audit Professional article series, then test yourself on the CAIIB and certificate course material before your exam date.