Standards on Auditing for Bank Audits: SA-Wise CAAP Guide

Every statutory branch auditor signs off under one common rule book: the standards on auditing for bank audits issued by the ICAI, read along with RBI instructions and the bank's own year-end closing circular. Candidates preparing for the Certified Accounting and Audit Professional (CAAP) paper are regularly tested on which SA governs which step — planning, materiality, evidence, documentation, fraud, going concern and the wording of the final report. This guide walks through the SAs that actually get used at a bank branch, explains where the branch auditor's responsibility ends and the central statutory auditor's begins, and gives you a table, five practice MCQs and four FAQs to lock the numbering into memory.

📘 What the Standards on Auditing Require in a Bank Audit

SA 200 sets the frame for everything else. It requires the auditor to obtain reasonable assurance that the financial statements as a whole are free from material misstatement, to exercise professional judgement and to maintain professional scepticism throughout. "Reasonable assurance" is a high level of assurance, not an absolute one — a point examiners love, because candidates frequently write that the auditor guarantees the accounts are correct. He does not. SA 200 also makes compliance with the SAs mandatory: an auditor may not claim compliance in the report unless every SA relevant to the engagement has been complied with.

In a bank, the framework has an extra layer. Above the SAs sit the Banking Regulation Act, the Third Schedule format for the balance sheet and profit and loss account, RBI master directions on income recognition, asset classification and provisioning, and the appointing bank's closing instructions. The SAs tell you how to audit; the RBI framework tells you what the correct accounting answer is. Before you touch a single voucher, it helps to revise the basics of bank audit and the various types of audits in banks, because the SAs apply differently to a statutory audit than to an internal or a concurrent audit in banks, which is a management function and not an audit under the SAs at all.

The table below maps the SAs most often examined in CAAP to the point in a bank audit where they bite, and shows whether a branch-level auditor applies them directly or only feeds inputs to the central statutory auditors.

🎯 Risk Assessment, Fraud and Materiality: SA 315, SA 240 and SA 320

SA 315 requires the auditor to identify and assess the risks of material misstatement through an understanding of the entity, its environment, the applicable financial reporting framework and the entity's system of internal control. At a branch, that understanding is practical rather than theoretical: what is the branch's advances mix, is it a specialised retail or forex branch, how centralised is the core banking system, which entries can the branch pass on its own and which are system-driven from the head office. Risk is then assessed at the assertion level, and the auditor designs responses under SA 330 that are proportionate to that assessment. A branch with a large, seasoned agricultural portfolio carries a very different misstatement risk profile from one dominated by salary overdrafts.

SA 240 layers fraud risk on top. The auditor must presume that risks of fraud exist in revenue recognition and must evaluate management override of controls as a significant risk in every engagement. In banking, the classic pressure points are evergreening of accounts to defer NPA classification, unapplied or wrongly applied interest, suspense and sundry entries left unreconciled, and staff-related accommodation. The auditor's duty is to plan for the risk and report suspicions, not to conduct an investigation — a full investigation is the terrain of a forensic audit in banks, which is commissioned separately once red flags surface.

SA 320 governs materiality. The auditor sets an overall materiality using a benchmark appropriate to the entity and a percentage based on professional judgement, then sets performance materiality below it so that the aggregate of uncorrected and undetected misstatements is unlikely to exceed overall materiality. In a bank group audit, branch materiality is normally communicated downward by the principal auditor rather than computed independently by each branch auditor. Benchmarks and percentages are matters of judgement revised engagement by engagement, so quote the principle in the exam, not a hard percentage.

💡 Exam Tip: Materiality is revised during the audit if new information changes the auditor's earlier judgement — for example, when actual results differ sharply from the figures used at planning stage.

🔎 Audit Evidence, Confirmations and Written Representations

SA 500 requires sufficient appropriate audit evidence: sufficiency is the measure of quantity, appropriateness the measure of relevance and reliability. Reliability rises when evidence is obtained from independent external sources, when it is generated under effective controls, when it is obtained directly by the auditor, and when it exists in documentary rather than oral form. That single hierarchy answers a large share of CAAP evidence questions. A system-generated interest computation tested by the auditor is stronger evidence than a manager's oral explanation of it.

SA 505 covers external confirmations and is directly relevant at a branch — balance confirmations from borrowers, confirmations of inter-bank and nostro balances, and confirmations of securities held with third parties. The auditor must retain control over the confirmation requests and the responses; a confirmation routed through and returned by branch staff has lost the independence that gave it value. Where management refuses to allow a confirmation request, the auditor evaluates the reason, considers the implication for risk assessment and performs alternative procedures. Reconciliation work sits close by, so revise the mechanics of the bank reconciliation statement before you attempt evidence questions on outstanding entries.

SA 530 permits sampling, whether statistical or non-statistical, provided the population is appropriate and the results are projected sensibly to the population. SA 520 analytical procedures are efficient in banks because the data is dense and comparable: yield on advances, cost of deposits and the movement in interest income against average balances all throw up exceptions quickly, which is why a working knowledge of the classification of income and expenditure pays off. Where transactions are denominated in foreign currency, evidence requirements tighten further, as covered in our note on the audit of foreign exchange transactions in banks.

SA 580 requires written representations from management, including that management has fulfilled its responsibility for the preparation of the financial statements and has provided the auditor with all relevant information. Representations are necessary audit evidence, but they are never sufficient on their own for the matters they cover, and they do not reduce the auditor's other work. SA 230 then requires the file to be documented so that an experienced auditor with no previous connection to the engagement can understand the nature, timing and extent of procedures performed, the results, and the significant judgements reached.

⚠️ Common Mistake: Treating a management representation letter as a substitute for verification. If the only evidence for a balance is management's word, the auditor has an unresolved scope issue, not evidence.

📝 Reporting: SA 700, SA 701, SA 705 and Going Concern under SA 570

SA 700 governs the form and content of the auditor's report — the opinion paragraph first, followed by the basis for opinion, going concern where relevant, key audit matters where applicable, management's and those charged with governance's responsibilities, and the auditor's responsibilities. SA 705 handles modifications. The choice of modification turns on two questions: is the matter a misstatement or an inability to obtain sufficient appropriate audit evidence, and is its effect material but not pervasive, or material and pervasive. Material but not pervasive misstatement gives a qualified opinion; material and pervasive gives an adverse opinion. Material but not pervasive scope limitation gives a qualified opinion; material and pervasive scope limitation gives a disclaimer. SA 706 covers Emphasis of Matter and Other Matter paragraphs, which highlight without modifying the opinion.

SA 701 requires the communication of key audit matters — those matters that, in the auditor's professional judgement, were of most significance in the audit of the current period's financial statements. KAM applies to audits of complete sets of general purpose financial statements of listed entities and where otherwise required or voluntarily undertaken. For a listed bank, expected credit or provisioning judgements, valuation of the investment book and IT-dependent controls are typical KAMs. A branch auditor does not report KAM; the central statutory auditors do, drawing partly on branch memoranda. KAM is never a substitute for a modified opinion or for a going concern disclosure.

SA 570 requires the auditor to evaluate management's assessment of the entity's ability to continue as a going concern and to conclude whether a material uncertainty exists. For a bank, this is a whole-entity judgement driven by capital adequacy, liquidity, deposit stability and regulatory action such as prompt corrective action — never a branch-level conclusion. Related insolvency judgement matters for borrower accounts under audit, since resolution routes such as the pre-packaged insolvency resolution process affect recoverability estimates and the adequacy of provisions the auditor is testing. Under SA 600, the central statutory auditor uses the work of branch auditors and remains responsible for the opinion on the bank's financial statements as a whole.

📌 Remember: Pervasiveness decides between qualified and adverse or disclaimer. Materiality decides whether the opinion is modified at all.

🧠 Practice MCQs: Standards on Auditing in Bank Audits

Want chapter-wise mock tests with 100+ MCQs? Start practising free →

❓ Frequently Asked Questions

Learn the SA numbers as a workflow rather than a list — SA 200 sets the objective, SA 315 and SA 320 shape the plan, SA 500 to SA 580 gather and document evidence, and SA 570 to SA 705 decide what the report finally says. Pair this with the fundamentals in accounting: an introduction, browse more notes on the Certified Accounting and Audit Professional tag hub, and then test yourself on the full syllabus with our CAIIB and certification course material.

Source and further reading: ICAI and the Indian Institute of Banking & Finance.