Risk-based internal audit allocates attention according to the significance of risks and the effectiveness of controls. It does not mean ignoring routine processes or auditing only areas with recent incidents. It means explaining why particular activities deserve assurance, what questions the work will answer and how the results will influence management action.
For banks and NBFCs, audit findings often remain open because the proposed remedy is vague or closure is based on a statement rather than evidence. A revised policy, a training session or a system release may be useful, but none automatically demonstrates that the underlying risk has been addressed.
A strong audit and remediation process connects risk assessment, testing, findings, corrective action and independent verification. The following approach focuses on making that chain clear and reviewable.
Define the audit universe and its boundaries
An audit universe identifies the entities, processes, systems, products and functions that may require assurance. Maintain enough detail to understand coverage without creating an unmanageable list of nearly identical units. Link important shared services and outsourced dependencies to the activities they support.
Assess risk using relevant information: business significance, regulatory exposure, transaction complexity, change, incidents, previous findings and the strength of controls. A high-volume process is not necessarily the highest risk, while a low-volume activity may have serious consequences if it fails.
RBI's internal-audit-function directions separately address commercial banks and NBFCs. [2] [3] Determine the institution's applicable obligations and scope. The audit universe should reflect the actual business and regulatory perimeter, not simply the previous year's plan.
Preserve independence and access
Internal audit needs sufficient independence to challenge management's account of control effectiveness. The Basel guidance on internal audit provides an international reference for authority, independence and access. [1] Domestic requirements and the institution's governance framework determine the specific arrangements.
Auditors need access to relevant records, systems and personnel through appropriate controls. Restricted access to sensitive data may require a secure review method, but it should not become an unexplained barrier to necessary assurance work.
Identify conflicts in assignments. An auditor who recently designed or operated a process may require safeguards or reassignment for particular work. Independence should be considered in substance, not inferred solely from a department name.
Frame the audit around answerable questions
A useful scope states what the audit will establish. For example, a regulatory-reporting review might examine population completeness, mapping governance, reconciliation, independent checking and filing evidence. Each area should connect to an identified risk.
Define the period, entities, systems and populations covered. Explain exclusions and their implications. A report that says “reporting controls were reviewed” without boundaries can be interpreted more broadly than the work supports.
Set criteria before testing. Auditors should know what effective operation looks like, based on applicable requirements and approved controls. Changing the criterion after seeing the result can weaken the fairness and consistency of the assessment.
Test both design and operation
Design testing asks whether the control can address the risk. Operating testing asks whether it was performed as intended across the relevant population and period. Evidence of one does not establish the other.
Sampling should have a reasoned basis. Consider materiality, risk, population characteristics and the purpose of the test. A small sample of easy-to-retrieve cases may not support a conclusion about the whole process. Explain limitations rather than implying comprehensive assurance.
Include exceptions, overrides and changes where they are relevant, but do not inspect only known problem cases. Routine transactions can reveal systematic weaknesses that incident-led sampling misses. Retain enough working-paper evidence for another qualified reviewer to understand the test and conclusion.
Write findings that distinguish condition and consequence
A finding should explain what was expected, what was observed, why the difference matters and what appears to have caused it. Separate factual evidence from the auditor's interpretation. Avoid dramatic language unsupported by the work.
The consequence may be actual or potential. State which it is. A missing review could create a risk of incorrect reporting even if the sample did not identify an error. Conversely, an actual misstatement should not be described merely as a hypothetical possibility.
Discuss findings with the responsible team to confirm facts and understand context. Management's response may identify additional evidence or a misunderstanding. Resolving factual differences improves the report without requiring audit to surrender its independent judgement.
A worked example: a reconciliation that did not occur
Suppose a hypothetical audit finds that a monthly reconciliation was signed but the supporting comparison was not performed. The operator explains that a system report stopped working after a release, and the team continued signing the checklist while awaiting a fix.
The finding has several dimensions: the missing comparison, the inaccurate completion evidence, the change-management dependency and the absence of escalation. A remedy consisting only of reminding staff to sign correctly would leave the main risk unresolved.
An appropriate action plan restores or replaces the reconciliation, assesses affected periods, corrects the evidence process and establishes escalation for future failures. Closure testing then checks actual operation after the fix, not merely the existence of a revised instruction.
Assign remediation to the underlying cause
Management should own corrective actions, with audit retaining an independent role in assessment and follow-up. Each action needs an accountable owner, a target date, a deliverable and a closure criterion. Complex findings may require several linked actions.
Distinguish immediate containment from permanent correction. A manual check may reduce risk while a system defect is repaired. Both activities need ownership, and the temporary measure should remain effective until the permanent solution is verified.
Avoid automatically prescribing training for every issue. Training is appropriate for a knowledge gap, but it will not correct an unavailable report, unclear authority or an incentive that rewards bypassing controls. The remedy should follow the diagnosed cause.
Make closure an evidence-based decision
A closure submission should explain what changed and provide evidence that the action was implemented. For an operating control, this usually requires evidence from actual use or an appropriate test. A release ticket alone may not establish that the intended business control works.
The verifier should assess whether the original risk has been addressed and whether new dependencies or limitations remain. If only part of the action is complete, record partial progress without closing the entire finding.
Reopening should be possible when later evidence shows the remedy did not work. Preserve the original finding, previous closure decision and new evidence. Reopening is a correction to the assurance record, not a reason to conceal the earlier conclusion.
Report overdue and recurring issues honestly
Track ageing against original and revised deadlines. Repeated extensions can indicate insufficient priority, unrealistic plans or unresolved dependencies. Management reporting should show those patterns instead of resetting the clock each time.
Separate accepted risk from completed remediation. An authorised decision to accept an internal risk does not mean the weakness was fixed, and it cannot waive an external obligation. The record should state the basis, authority, duration and monitoring of any acceptance.
Analyse recurrence across branches, products and systems. Similar findings may share a common cause that requires an enterprise response. Treating each instance as unrelated can produce many closed actions without improving the underlying process.
Distinguish assurance reliance from duplicated testing
Internal audit may consider work performed by compliance, risk teams or external specialists. Before relying on it, assess the scope, competence, objectivity, method and evidence. A report title that sounds relevant does not establish that the work answers the audit question.
Document what reliance means for the audit conclusion. If another team tested only a subset of branches or a limited period, the limitation should remain visible. Audit may still need additional work on excluded populations, significant changes or areas requiring independent judgement.
Coordination can reduce repetitive requests to business teams, but it should not blur responsibilities. Management controls, second-line monitoring and internal audit serve different purposes. A shared evidence repository can support each without turning one function's approval into another function's conclusion.
For material findings, identify who will verify closure and why that verifier is appropriate. The person who implemented the correction can explain and demonstrate it, while an independent reviewer assesses whether the evidence supports closure. Making those roles clear at the start avoids disputes when the action deadline arrives.
Prepare for inspection through ordinary evidence discipline
Inspection readiness should emerge from reliable records maintained during normal work. An institution should be able to retrieve its policies, control evidence, decisions and remediation history without reconstructing them shortly before a review.
Keep access and confidentiality appropriate. Audit records may contain customer information, legal material or security details. A structured evidence index can help reviewers locate what they need without indiscriminate distribution of sensitive files.
The strongest audit process produces findings that management can act on and closure decisions that another reviewer can verify. Risk assessment determines where to look; evidence determines what to conclude; sustained operating change determines whether remediation is complete.
PRIMARY REFERENCES
Sources & further reading
Primary-source references checked on 12 October 2026. Follow the relevant authority’s current text for applicability, amendments and commencement dates. International standards provide context and are not automatically identical to domestic requirements.