NEW REPORTING NORMS IN LFAR AND OTHER CERTIFICATIONS – 2021

NEW REPORTING NORMS IN LFAR AND OTHER CERTIFICATIONS - 2021 P.M.VEERAMANI, FCA , RGN PRICE & CO

BANK AUDIT -2021 – COVERAGE New Formats of Branch LFAR New reporting requirement for PSB – Internal Financial Controls Annexure to audit appointment letter – specific certificates

LONG FORM AUDIT REPORT

REVISED LFAR The format of LFAR have been revised: Annex I for Statutory Central Auditors (SCA) Annex II for Branch Auditors An Appendix as part of Annex II for the specialized branches and Annex III on Large / Irregular / Critical accounts for branch auditors. The old LFAR format and other instructions of 2002 have been repealed.

REVISED LFAR – REASONS FOR REVISION Last format was prescribed in 2002 - 19 years before , when: Banking transactions and record keeping done manually to a large extent Risk management not as big a focus area as it is now. Formats to keep up with the times, address the requirements of technology-driven new-age banking systems and do away with some questions that are no longer relevant.

BANKING – CURRENT SCENARIO Digital banking, Core banking systems and Risk management Mountain of non-performing assets, partly a result of weak credit assessment

REVISED LFAR – WHOLE BANK Objectives The overall objective of the Long Form Audit Report (LFAR) should be to identify and assess the gaps and vulnerable areas in the business operations, risk management, compliance and the efficacy of internal audit and provide an independent opinion on the same to the Board of the bank and provide their observations.

REVISED LFAR – BRANCHES Objectives The overall objective of the branch audit should be to have transaction testing and provide inputs to the Statutory central Auditors on adequacy of implementation of various policy and regulatory requirements, including efficacy of the system and assurance functions (risk management, compliance and internal audit) at branch level.

REVISED LFAR – BRANCHES Objectives Where threshold is prescribed : the transaction detailing needs to be seen and commented upon. Below the threshold: the system and processes should be checked and commented upon.

REVISED LFAR – BRANCHES Objectives Adverse comments LFAR : To consider whether a qualification in their main report is necessary. Every adverse comment in the LFAR would not necessarily result in a qualification in the main report. In deciding whether a qualification in the main report is necessary, the auditors should use their professional judgment in the facts and circumstances of each case.

REVISED LFAR - BRANCHES 1. CASH 2. BALANCE WITH BANKS, RBI ETC 3. MONEY AT CALL AND SHORT NOTICE 4. INVESTMENTS

GENERAL INSTRUCTIONS – ADVANCES LARGE ADVANCES : Outstanding amount is in excess of 10% of outstanding aggregate balance of fund based and non-fund based advances of the branch or Rs.10 crores, whichever is less. EXTENT OF VERIFICATION : The transaction audit/account specific details to be seen and commented, BELOW THRESHOLD : The process needs to be checked and commented upon. ESCALATION : Advances with significant adverse features, needing attention of the management /

LARGE ADVANCES List of Advances Accounts examined for Audit Account Number, Account Name, Balance as at Year end (Funded), Balance as at Year end (Non Funded), Total. % of TOTAL ADVANCE examined by SBA

ADVANCES – NEW AREAS Have you come across cases of quick mortality in accounts, where the facility became non-performing within a period of 12 months from the date of first sanction? Details of such accounts may be provided in following manner: Account No. Account Name Balance as at year end Take over Policy / Due diligence – compliance Quick mortality accounts are defined as bank accounts, which become NPA within one year of original sanction or first disbursement, and in case of housing loan within one year from the date of commencement of installment, whichever is later.

ADVANCES – NEW AREAS Whether applicable interest rate is correctly fed into the system? Whether the interest rate is reviewed periodically as per the guidelines applicable to floating rate loans linked to MCLR (Marginal cost of funds Lending Rate)? / EBLR (External Benchmark Lending Rate)? – Last circular dated 4.9.2019 The interest rate under external benchmark shall be reset at least once in three months. All floating rate rupee loans sanctioned and renewed w.e.f. April 1, 2016 shall be priced with reference to the Marginal Cost of Funds based Lending Rate (MCLR) which will be the internal benchmark for such purposes subject to the provisions contained in paragraph 7 of this Master Direction.

ADVANCES – NEW AREAS Have you come across cases of frequent renewal / rollover of short-term loans? If yes, give the details of such accounts Observation should not be inconsistent with accounts identified as NPA Whether Correct and valid credit rating from accredited agencies correctly fed into the system A rating scale could consist of 9 levels, of which levels 1 to 5 represent various grades of acceptable credit risk and levels 6 to 9 represent various grades of unacceptable credit risk associated with an exposure.(Guidance note on credit risk management by RBI)

BRANCH LFAR - ADVANCES Did the bank provide loans to companies for buy-back of shares/securities? RBI Master circular on Loans and Advances – Statutory and Other Restrictions- 2nd July 2007 1.4 Restrictions on Credit to Companies for Buy-back of their Securities In terms of Section 77A(1) of the Companies Act, 1956, companies are permitted to purchase their own shares or other specified securities out of their free reserves, or securities premium account, or the proceeds of any shares or other specified securities, subject to compliance of various conditions specified in the Companies (Amendment) Act, 1999 . Therefore, banks should not provide loans to companies for buy-back of shares/securities. Section 68 of Companies Act , 2013 has same provisions

BRANCH LFAR - ADVANCES Details of: cases where stock audit was required but was not conducted where stock audit was conducted but no action was taken on adverse features

BRANCH LFAR – Due Diligence Does the branch have on its record, a due diligence report in the form and manner required by the Reserve Bank of India in respect of advances under consortium and multiple banking arrangements Give the list of accounts where such certificate/report is not obtained or not available on record. (In case, the branch is not the lead bank, copy of certificate/report should be obtained from lead bank for review and record)

BRANCH LFAR – Due Diligence Reserve Bank of India Notification no. DBOD. NO. BP.BC.110/08.12.001/2008-09 dated 10.2.2009 “Please refer to Paragraph 2(iii) of our circular RBI/2008-09/183/DBOD.No.BP.BC.46 /08.12 .001/2008-09 dated September 19, 2008 on the captioned subject. 2. In terms of Paragraph 2(iii) of the above circular, in order to strengthen the information sharing system among banks in respect of the borrowers enjoying credit facilities from multiple banks, the banks are required to obtain regular certification by a professional, preferably a Company Secretary, regarding compliance of various statutory prescriptions that are in vogue, as per specimen given in Annex III to the above circular. 3. In this context it is clarified that in addition to Company Secretaries, banks can also accept the certification by a Chartered Accountants & Cost Accountants. Further, on the basis of suggestions received from Indian Banks Association, Annex III – Part I & Part II (copy enclosed) has also been modified.” Format of report in ICSI Guidance note on Diligence reports for Banks – 25

BRANCH LFAR – Red Flagged Accounts Whether the branch has any red-flagged account? If yes, whether any deviations were observed related to compliance of bank's policy related with Red Flag Accounts? RBI/2014-15/590 DBS.CO.CFMC.BC.No.007/23.04.001/2014-15 May 7, 2015 – Framework for dealing with Loan Frauds The concept of a Red Flagged Account (RFA) is being introduced in the current framework as an important step in fraud risk control. A RFA is one where a suspicion of fraudulent activity is thrown up by the presence of one or more Early Warning Signals (EWS). These signals in a loan account should immediately put the bank on alert regarding a weakness or wrong doing which may ultimately turn out to be fraudulent. A bank cannot afford to ignore such EWS but must instead use them as a trigger to launch a detailed investigation into a RFA.

BRANCH LFAR – Red Flagged Accounts An illustrative list of some EWS is given for the guidance of banks in Appendix I to this circular. ( about 45 instances ) The EWS compiled by a bank would form the basis for classifying an account as a RFA. (exception reports ) Threshold for EWS and RFA is an exposure of Rs.500 million or more (Rs.50 Cr) at the level of a bank irrespective of the lending arrangement. The modalities for monitoring of loan frauds below Rs.500 million

BRANCH LFAR – Red Flagged Accounts 3.4 Role of Auditors: During the course of the audit, auditors may come across instances where the transactions in the account or the documents point to the possibility of fraudulent transactions in the account. In such a situation, the auditor may immediately bring it to the notice of the top management and if necessary to the Audit Committee of the Board (ACB) for appropriate action. Banks will take a call on whether an account in which EWS are observed should be classified as a RFA or not. This exercise should be completed as soon as possible and in any case within a month of the EWS being noticed. Banks may carry out any further investigations within specified time lines and at the end of this time line, which cannot be more than six months, banks would either lift the RFA status or classify the account as a fraud. Same time lines would apply in case of consortium and multiple lending arrangements also

BRANCH LFAR Comment on adverse features considered significant in top 5 standard large advances and which need management's attention. Is the branch prompt in ensuring execution of decrees obtained for recovery from the defaulting borrowers? Give Age-wise analysis of decrees obtained and pending execution

BRANCH LFAR Whether the branch is following the system of classifying the account into SMA-0, SMA-1, and SMA-2. Whether the auditor disagrees with the branch classification of advances into standard (Including SMA0, SMA-1, SMA-2) / sub-standard / doubtful / loss assets, the details of such advances with reasons should be given.

BRANCH LFAR - Restructuring a) Whether the branch has reported accounts restructured or rephased during the year to Controlling Authority of the bank? b) Whether the RBI Guidelines for restructuring on all such cases have been followed. c) Whether the branch complies with the regulatory stance for resolution of stressed assets, including the compliance with board approved policies in this regard, tracking/reporting of defaults for resolution purposes among others

BRANCH LFAR - IBC Whether there are any accounts wherein process under IBC is mandated but not initiated by the branch? Whether there are any borrowers at the branch against whom the process of IBC is initiated by any of the creditors including bank? If yes, provide the list of such accounts and comment on the adequacy of provision made thereto?

BRANCH LFAR - IBC In order to file IBC application u/s 7 of IBC Act, the following three conditions are required to be fulfilled; the related debt or liability should be covered under financial debt as defined u/s 5(8) of IBC which means any debt which is disbursed against the consideration for the time value of money i.e. interest and includes other as described in above section, and There has been a default in discharging of the above liability, and Amount of such default should be Rs. 1 Cr (revised limit – notification dated 24.3.2020)

BRANCH LFAR – RETAIL LOANS In cases where documents are held at centralized processing centres / office, whether the auditor has received the relevant documents as asked by them on test check basis and satisfied themselves. Report the exceptions, if any

BRANCH LFAR – SUSPENSE/SUNDRY ASSETS Details of outstanding entries in excess of 90 days may be obtained from the branch and the reasons for delay in adjusting the entries may be ascertained. Are there items, which in your opinion are not recoverable and would require a provision/write-off? If so, give details. Are there any intangible items under this head e.g. losses not provided / pending investigation? ( claims paid ?)

BRANCH LFAR - DEPOSITS Does the bank have a system of identification of dormant/ inoperative accounts and internal controls with regard to operations in such accounts? Have you come across instances where the guidelines laid down in this regard have not been followed? If yes, give details thereof. As per paragraph 24.2 (ix) of the Master Circular no 59/2015-16 on ‘Customer Services in Banks’ dated 01 July, 2 015 , a savings as well as current account should be treated as inoperative / dormant if there are no transactions in the account for over a period of two years. The accounts which have not been operated upon over a period of two years should be segregated and maintained in separate ledgers

BRANCH LFAR- DEPOSITS Whether the scheme of automatic renewal of deposits apply to FCNR(B) deposits Where such deposits have been renewed , whether the branch has satisfied itself as to the NON-RESIDENT status of the depositor NR status shall be under FEMA , which is different from Income tax Whether the renewal is made as per APPLICABLE REGULATORY GUIDELINES and original receipts / soft copy have been despatched

BRANCH LFAR – MINIMUM BALANCE Is the branch complying with the regulations on minimum balance requirement and levy of charges on non-maintenance of minimum balance in individual savings accounts? RBI circular dated 20.11.2014 on Levy of penal charges for non-maintenance of minimum balance in savings accounts notify customer through mail/ sms /letter and give one month time from the same if minimum balance is not restored, charges can be levied after intimating depositor Penal charges to be proportionate to the extent of short fall Penal charges should be reasonable in line with average cost of services to be ensured that the account does not turn –ve consequent to the levy

BRANCH AUDIT REPORTS Books and Records Details of software / systems (manual or otherwise) used at the branch which are not integrated with CBS Any adverse feature in IS audit having an impact on branch accounts Prompt generation and expeditious clearance of entries in exception reports generated

BRANCH LFAR - RECORDS Whether the bank has laid down procedures for manual intervention to system generated data and proper authentication of the related transactions arising there from along with proper audit trail of manual intervention has been obtained.

BRANCH LFAR – FRAUDS/KYC/AML Furnish particulars of: (i) Frauds detected/classified but confirmation of reporting to RBI not available on record at branch. (ii) Whether any suspected or likely fraud cases are reported by branch to higher office during the year? If yes, provide the details thereof related to status of investigation (iii) In respect of fraud, based on your overall observation, please provide your comments on the potential risk areas which might lead to perpetuation of

BRANCH LFAR – FRAUDS/KYC/AML (iv) Whether the system of Early Warning Framework is working effectively and, as required, the early warning signals form the basis for classifying an account as RFA. Whether the branch has adequate systems and processes, as required, to ensure adherence to KYC/AML guidelines towards prevention of money laundering and terrorist financing Whether the branch followed the KYC/AML guidelines based on the test check carried out by the branch

BRANCH LFAR – FRAUDS/KYC/AML Page 612 – Exposure draft to Guidance Note on Bank Audit 2021 13.26 Reserve Bank of India vide its master Direction dated February 25, 2016 and updated up to April 20, 2020 on “Know Your Customer (KYC) norms/Anti-Money Laundering (AML) standards/Combating Financing of Terrorism (CFT)/Obligation of banks and financial institutions under PMLA, 2002” has laid down certain guidelines to prevent banks from being used, intentionally or unintentionally, by criminal elements for money laundering or terrorist financing activities. The guidelines prescribed in this circular, popularly known as KYC guidelines, also enable banks to know/understand their customers and their financial dealings better which in turn help them manage their risks prudently. 13.27 These guidelines contain detailed requirements for banks in respect of customer acceptance policy, customer identification

BRANCH LFAR – FOREIGN EXHANGE Are there any material adverse features pointed out in the reports of concurrent auditors, internal auditors and/ or the Reserve Bank of India’s inspection report which continue to persist in relation to NRE/ NRO/ FCNR-B/ EEFC/ RFC and other similar deposits accounts. If so, furnish the particulars of such adverse features. Whether instructions / guidelines followed and if not list the irregularities observed in areas of : advances, export bills, bills for collection and any other area of FE operations

REVISED LFAR - CONCERNS Long Form Audit Report gets EVEN Longer ; So does the increased responsibilities for auditors. SBA/CSA becomes a specialized area requiring separate skill sets Most Banks moving to web based reporting for LFAR and hence will have to be completed at the branch itself. ICAI mandating seeking of several details from branches – practical difficulties RBI guidelines are freely available in RBI website. Branches may be required to follow internal guidelines which are mostly available in the intranet which would be based on RBI guidelines Can you still take shelter under “Limited time for auditors”- Both Whole Bank and branches ?

AUDIT REPORT- NEW REQUIREMENT

NEW REPORTING REQUIREMENT Whether the bank has adequate internal financial control systems in place and the operating effectiveness of such controls ( compliance deferred to year ended 31.3.2021 vide RBI letter dated 19.5.2020) Section 143(3)(i) of Companies Act : Whether the company has adequate [internal financial controls with reference to financial statements] in place and the operating effectiveness of such controls [] substituted for ‘internal financial control system’ by the

NEW REPORTING REQUIREMENT (IFC contd.) Whether “internal financial control systems” & “internal financial controls with reference to financial statements” are the same ? Explanation to section 134(5)(e) under Companies Act , 2013 – Under Directors Responsibility Statement For the purpose of this clause , the term ‘internal financial controls’ means the policies and procedure adopted by the company for ensuring the orderly and efficient conduct of its business , including adherence to company’s policies , the safeguarding of its assets, the prevention and detection of frauds and errors, the accuracy and completeness of the accounting records, and the timely preparation of reliable financial information’

NEW REPORTING REQUIREMENT (IFC contd ) ICAI report on IFC - Meaning of Internal Financial Controls Over Financial Reporting A company's internal financial control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles

ICAI - Technical Guide Applicability to SBAs The branches that are required to be covered for reporting on IFCoFR will be determined and scoped in by the SCAs. It is not necessary that all the branches of the Bank are covered for reporting on IFCoFR since the controls operating at the branches will be common controls that are designed centrally at the Bank and operated at the branches.

ICAI – Technical Guide Appendix II Extract of RBI Clarification to PSBs on SCAs Reporting Requirements on IFCoFR 2. In line with substitution of words “Internal Financial Control System” in Section 143(3)(i) of the Companies Act, 2013, by the words “Internal Financial Controls with reference to Financial Statements” as per the clause 43(ii) of Companies Amendment Act, 2017, the reporting requirement at Para 2(v) of the said letter stands modified to ‘Whether the bank has adequate Internal Financial Controls with reference to Financial Statements and the operating effectiveness of such controls’.

ICAI – Technical Guide Appendix VI A. Illustrative Audit Report by the SBA when a branch is not scoped in for audit of IFCoFR B. Illustrative Audit Report by the SBA when a branch is scoped in for audit of IFCoFR ANNEXURE “A” TO THE INDEPENDENT AUDITOR’S REPORT (Referred to in paragraph under ‘Report on Other Legal and Regulatory Requirements’ section of our report of even date) Report on the Operating Effectiveness of Internal Financial Controls Over Financial Reporting as required by the Reserve Bank of India (the “RBI”) Letter DOS.ARG.No.6270/08.91.001/201920 dated March 17, 2020 (as amended) . (the “RBI communication”) Similar to Companies Act report

CERTIFICATIONS

CERTIFICATES TO BE ISSUED As many as nearly 40 Certificates to be issued covering various subsidy, interest subvention , priority sector lending, lending to sensitive sectors, utilization and end use certificate for various government schemes Auditor needs go through in detail RBI circular as well internal bank circulars in this regard , which these days are mostly available in the intranet ICAI guidance note also carries most of the RBI circulars

Format of Covering Report for various Certificates issued by SBAs Page 722-723 - Exposure draft on Guidance Note to Bank Audit -2021 Introduction . Management Responsibility Auditors Responsibility Opinion Restrictions of use

Format of Covering Report for various Certificates issued by SBAs Page 722-723 - Exposure draft on Guidance Note to Bank Audit -2021 Introduction : The accompanying Statement contains various certificates issued by us during the Statutory Audit of [Name of the Branch] [Branch Code] of [Name of the Bank] for the Financial year 2020 – 2021, listed in Annexure [Name], which we have initialled for identification purposes only. Opinion :Based on our examination as above, and the information and explanations given to us, we report that the Statement in Annexure [Name] is in agreement with the books of account and other records of [Name of the Branch] [Branch Code] of [Name of the Bank] for the Financial year 2020 – 2021 as produced to us for our examination, and the information thereof is prepared, in all material respects, in accordance with the applicable criteria.

CERTIFICATES TO BE ISSUED RBI circular dated 17.7.2019 – Unauthorised operation of Internal / Office accounts – Illustrative list of items that could be considered as falling under the circular Bank/Branch has complied with the RBI guidelines issued for opening, review, monitoring and reconciliation of internal/office accounts and for that standard operating procedure is in place

AUDIT CHALLENGES Need for updating RBI circulars – RBI circular dated 17.7.2019 – Unauthorised operation of Internal / Office accounts – Illustrative list of items that could be considered as falling under the circular RBI/2014-15/590 DBS.CO.CFMC.BC.No.007/23.04.001/2014-15 - May 7, 2015 – Appendix I lists 45 illustrative cases which could be considered as Early Warning Signals Both these are generally covered under exception reports at branches

AUDIT CHALLENGES RBI circular restricting use of current accounts when cash credit facility is enjoyed with another bank – potential area of fraud – Review of transactions may be required if such current account exist prima facie RBI circular on automated identification of NPA and switching to daily identification of NPA- implementation there of Auditors can request branches to give access to CRLIC database for details of exposures with other banks for major customers in each branch- RBI in SSM minutes have asked auditors to use this facility

AUDIT CHALLENGES New models of advances like micro financing through POOL accounts – Buy out of retail loans from NBFC Already flagged by RBI in case of all banks that SOP is not adequate Advances through Retail centres, Credit Card dues Transactions in Pre Paid Instruments

CONCLUSION Bank Audit turning out to be more “skilled assignment” needing experience, exposure and taking judgmental decisions on EWS/Potential Frauds Applying illustrative cases in RBI circulars to accounts may require detailed review of branch exception reports Ensuring compliance with ICAI Guidance Note holds the KEY ! Guidelines for remote audit likely to continue Look out for ICAI directions Branch audit though reducing in quantity but will look for more qualitative report NO REVISION OF BRANCH AUDIT FEE SINCE 2013 ?

Hope the session does not leave you .