Bank Branch Audit- CBS Environment

It is pertinent to note that most of the banks have moved to Core Banking Solution (CBS) environment. What was earlier the prerogative of the private sector banks and large public sector banks has come down to the large co-operative banks and even smaller banks. Thus, CBS environment and technology is all pervasive affecting all stakeholders viz. depositors, borrowers, revenue authorities, regulators and the auditors too. Therefore, this information technology implication should not be seen only to report under Jilani Committee Recommendations since it is all pervasive affecting the branch auditor’s opinion in most critical manner.

In this background, the article discusses the following aspects:

• Understanding Core Banking.
• Branch auditor’s role.
• Conducting CBS branch Audit.

Understanding core banking:

Core banking is a system in which a centrally shared database supports the banking application. This server is kept at a location called the Data Centre (DC). To mitigate the risk of failure of the common server, backup site(s) are maintained at a distant location, generally in a different seismic zone. These are called Disaster Recovery Centres (DRC). There are various modes which are used to establish connectivity such as wireless network (radio frequency), VSAT (Very Small Aperture Terminal), VPN (Virtual Private Network) over the internet, cloud, etc.

Different approaches are followed in designing CBS architecture such as:

• Central Single Database.
• Branch server and Central database.
• Cluster.

However, any CBS architecture will have following major components:

• Data Base server.
• Application server.
• Web server.
• Network.
• Nodes.

Simple CBS architecture:

In order to facilitate reporting under various regulatory requirements, add-on softwares may be used by the banks. Few examples are:

• Credit risk calculation under Basel norms.
• Risk weighted assets/ capital adequacy.
• Asset classification and provisioning.
• Classification of advances–priority/non priority or sensitivity.

Branch auditor’s role

The branch auditor is not expected to be a technical expert to understand the IT system or the software and the technicalities. However, it is a fact that technology has changed the way for most of the banking operations. For example, transactions may take place from various locations, central database gets updated on real time basis and various reports are generated through backend. Similarly, there are various transactions relating to mass customers which are run at central data centre. For example, application of interest, application of service charges, etc. Thus, CBS is the neurological network of the bank; the branch auditor cannot afford to ignore the existence of the system and CBS environment.

The branch auditor needs to understand what the CBS system can do and what CBS system cannot do. CBS system can provide data, analysis through various reports and understanding about the controls built in the system. However, CBS system cannot do documentation, security or stock inspection, KYC checks, etc. Thus, the branch auditor needs to devise his audit procedures in such a way that he makes best possible use of CBS system to manage his audit risk and conduct effective audit efficiently.

The branch auditor is required to issue reports/certificates based on his audit conducted for the branch. Generally, branch auditor’s deliverables are as under:

• Branch Audit Report expressing opinion on true and fair view of branch financials taken as whole.
• Long Form Audit Report (LFAR) containing certain factual statistics and auditors opinion on certain areas.
• Tax Audit Report under Income Tax Act, 1961.
• Various certificates.

Conducting CBS branch audit

We will discuss now key aspects to be considered while conducting CBS branch audit. It is a challenge for branch auditors to complete their audit and issue reports within a week to ten days time. So striking a balance between time and resource constraints along with managing audit risk is very important.

Suggestive audit approach, the branch auditor may adopt in respect of CBS branch is as under:

• Use auditor login (read only and view only access) to obtain understanding and feel about system.
• Refer user manuals conduct enquiries to obtain better understanding.
• Explore circulars and other important documents through intranet of the bank.
• Conduct detailed review of various exception reports.
• Select appropriate sample judiciously.
• Apply substantive procedures.
• Make effective use of excel or spread sheet tools.

Broadly, the audit exercise can be divided into following four different stages:

1. Risk assessment and audit planning.
2. Control testing.
3. Applying substantive checks.
4. Compilation and issuance of report.

Important considerations and suggested audit procedures are discussed below:

Risk assessment

Risk assessment is pervasive and prevails throughout over the audit process. The branch auditor should do the initial risk assessment which will guide planning of audit work. The branch auditor may review previous statutory audit reports, internal audit reports, concurrent audit reports, inspection reports, etc. pertaining to branch including status of compliances and regularisation of irregularities pointed out in these reports. He may review randomly various exception reports.

Risk of material misstatement by and large is centered with correctness of asset classification, income recognition as per prudential norms and provisioning. In addition to these areas the branch auditor should consider element of fraud risk and branch reporting in respect of anti-money laundering. The branch auditor can make effective use of exception reports for considering fraud element with reference to early warning signals described in RBI master circular on wilful default. Thus, the auditor can assess the risk of material misstatement and identify the items/areas and extent of substantive checks.

Control testing

Branch auditor needs to evaluate overall control environment. Branch auditor should obtain reasonable assurance that the sufficient controls are in place and the controls are effective. The branch auditor should review various reports on sample basis, which the branch has submitted to its controlling offices. Similarly, the branch auditor should review of concurrent audit reports, internal audit reports or inspection reports and compliances thereof. Particularly in respect of bank branch operating under CBS environment the branch auditor should obtain and review latest Information Technology (IT) audit report conducted for the branch. He may conduct enquiries and seek compliances in respect of irregularities or gaps identified in IT audit report. This will help the branch auditor to gain fair knowledge about control environment in CBS branch and respective effectiveness and efficacy of the controls. Various controls pertaining to CBS branch, which branch auditor may consider conducting sample testing for existence and effectiveness are as under:

• Environmental controls:
  • Air conditioning AMCs.
  • Fire extinguishers.
  • Smoke and heat detectors.
  • Water seepage.
• Physical controls:
  • Entry restriction to critical areas where servers, routers are located.
• Application controls:
  • Password management history.
  • Unsuccessful login attempts.
  • Access logs.
  • Inactive user ids.
• Logical controls:
  • User id creation/deletion.
  • Mapping of user ids with roles, responsibilities and delegated authorities.
• Output controls:
  • Automatic log off.
  • Hard copies of reports whether duly signed.

Applying substantive tests

As discussed in previous paragraphs the branch auditor can decide on samples to be drawn for applying substantive testing. Under CBS environment branch auditor can make effective use of various reports available in CBS system. Some of the reports which auditor can use while conducting bank branch audit are discussed as under:

Financial Statements

• Advances disbursed by transferring to deposit accounts: The branch auditor can use aforesaid report to review fresh advances disbursed during the audit period. By applying 80:20 principle the branch auditor can select sample across various types of advances disbursed during the audit period to review documentation, scrutinise transactions, etc.
• Interest applied/ failed report for deposits: To review and verify correctness of interest expense, the branch auditor can use this report to check in case of deposit account where interest application report has thrown failure report. The branch auditor can select sample out of such deposit accounts to verify whether the error has been rectified and interest has been correctly applied. The branch auditor should enquire into the reasons for interest application error and how the issue has been resolved.
• Interest applied /failed report for advances: The branch auditor can use aforesaid report and select sample of few accounts for further verification. The branch auditor should enquire into reasons for the error reported in interest application and how the error has been sorted out and resolved. The branch auditor should perform audit procedure of recalculation of interest in respect of such advances account to test accuracy.
• Age wise and nature (head) wise classification of all office accounts: The branch auditor should use this report and review old outstanding entries under various office accounts. The branch auditor should conduct further enquires and ascertain reasons for old outstanding entries and consider whether there is possible impact on profit or loss reported in financial statement of the branch.
• Loan accounts with Zero interest rate: The branch auditor should review all the advances accounts where interest rate is zero. Further enquiries should be conducted to understand how the issue has been dealt with. The branch auditor should review the sanction documents and check the interest parameters for correctness. The branch auditor can perform audit procedure of recalculating the interest in respect of all such accounts.

There are other reports which the branch auditor can use for multiple aspects such as existence of early warning signal, correctness of account classification, charge and collection of penalties for defaults in respect of pendency of instalments, non submission of stock/book-debt statements, etc. Indicative list of such reports is as under:

• List of Loan accounts with instalments in arrears.
• CC/OD Overdrawn.
• Report of accounts not renewed/reviewed.
• Report of stock, book debt statements in arrears.
• Report on ‘Overdue Bills purchased and Bills discounted’.

Long Form Audit Report (LFAR)

The long form audit report contains various matters on which the branch auditor has to report his observations. Broadly the LFAR contains some areas where the branch auditor has to report factual information. For example, age wise analysis of pending entries in reconciliations, office accounts, etc. Using various reports available through CBS system, most of the information is readily available for the auditor to report his observations on the matters in LFAR. It is important to note that matters in LFAR provide detailed understanding of the branch. Therefore, the observations on the matters in LFAR need to be carefully considered while forming opinion on the financial statements.

Some of the reports available through CBS system which the branch auditor can use while reporting on the matters in LFAR are as under:

• Cash balance above the cash retention limit.
• Overdue stock/book-debts/ QIS statements.
• Overdue reviews /renewals of credit limits.
• Expired insurances/under-insurances of securities.
• Overdue inspection of securities.
• Overdue renewal of loan documents.
• Overdue valuations of fixed assets charged in NPA.
• TDRs where lien has been lifted.
• Loans against TDR where lien not marked.
• Accounts having sanction limit exceeding specified limit.

The branch auditor should select samples from various reports. Using his auditor login on the CBS system he can verify the items sampled.

Income Recognition and Asset Classification (IRAC)

Key aspects of bank branch audit are assurance on compliance to income recognition norms, asset classification and provisioning. While applying substantive tests or test of details the branch auditor can make effective use of reports generated from CBS system. Illustrative list of useful reports is as under:

• Transaction turnover in CC accounts.
• Standard accounts rescheduled during the year.
• Sub standard accounts restructured during the year.
• Accounts where moratorium period expired and interest flag “N”.
• Sub standard NPA upgraded during the year.
• Report on overdue instalments and interest in loan accounts.
• Accounts out of order for more than 30 days.
• Accounts where value of securities is less than drawing power.

The branch auditor can corroborate with the asset classification prepared and provided by the branch. As discussed in preceding paragraphs, Banks use software for the purpose of asset classification and provisioning. These reports are generated through these softwares centrally using central database. However, there is certain data/information which the branch has to provide, such as security value, last date of submission of stock/book-debt statement, etc. The branch auditor should verify correctness of data, information provided by the branch. Incorrect input of the information may impact on provisioning, security-wise classification and may have impact on financial statements of the branch.

Compilation and issuance of report

While compiling the various reports to be issued the auditor needs to take global review of entire audit exercise performed. The auditor should communicate and document all the major observations he has made during the audit and obtain responses of the branch management.

Useful report tags

For quick reference of readers, following is the gist of some of the reports mapped to various areas which the branch auditor can explore himself through the Finacle CBS system: