Statutory Branch Auditing of Banks: Using CBS Reports

Regulatory Mandate & Revised LFAR Framework

Statutory auditors of banks evaluate adherence of laws and regulations and policies / procedures / guidelines of the banks. RBI’s new directions on financial statements preparation and presentation vide circular DOR.ACC.REC.No.45/21.04.018/2021-22 dated August 30, 2021 fosters stringent financial reporting discipline amongst banks and enhance auditors’ responsibilities of evaluations of relevant controls. Long Form Audit Report (LFAR) provides a detailed analytical view of such adherence in banks’ systems and processes. Particularly, new LFAR provides auditors an opportunity to report on more financial and operational controls and also provides a best basis to approach the statutory branch auditing.

In current exceptions-based CBS control environment, audit evidences are preserved in the form of audit exceptions. Banks have their customized exceptions handing systems and analytical reports based on their MIS needs and legal/regulatory requirements. Article attempts to delve upon such audit exceptions / system generated analytical reports crucial for branch auditing that would help auditors meet their statutory audit obligations effectively.

Currently, in public sector banks, following CBS applications are used:

Audit Exceptions / System Generated Reports Architecture:

Various audit exceptions/ system generated reports and their nomenclature and software menus are not uniform across the CBS environments and across the banks. In addition to the menu-driven CBS reports, different customized monitoring / exception handling systems are being followed by the banks and various audit exceptions/ monitoring reports are available on their specialized exceptions handling / monitoring portals. For example,

• Finacle Environment: Generally reports are menu-driven, however, various monitoring/ exceptions/ analytical reports have been customized and are on specialized portals. For example, in Bank of Baroda, most monitoring reports relevant for LFAR are available on CEMU (Centralized Exception Monitoring Unit) portal. In Punjab National Bank, such reports have been customized on MIS portals. In Union Bank of India, large number of such reports are available on credit monitoring and credit compliance (CMCC) portal.
• B@NCS Environment: Generally, for all daily exceptions / analytical reports, an ‘All in One’ daily folder is created and placed on users’ desktop.
• Flexcube Environment: Such exceptions/ analytical reports are largely available as periodical reports (e.g. daily, monthly, quarterly) for monitoring purposes.

Word of Care for Branch Auditors:

• It is quite possible that exact menu / nomenclature of the report might be different than mentioned here. Therefore, it is strongly suggested that auditors should check with the bank for CBS application used and obtain the relevant reports available in the CBS environment.
• While using Finacle 10 generally ‘H’ is prefixed with the menu. Of the menu options mentioned above, some might work in DC (Finacle Core) environment while others may work in DR environment. In ‘SEARCH’ menu, any report, which is not specified in the menu list, could be searched by putting key words in search field.
• In B@NCS: TL = Term Loan, DL = Demand Loan, A&S = Accounts and Services, L = Long, E = Enquiry.

Conclusion

While using such audit exceptions / system generated reports, auditors need to apply heightened professional skepticism. Some of the reports might need no further validation/ confirmation, while many of the system generated reports posing risk of manual intervention, need further validation by the auditors for their completeness and correctness such as, NPA, SMA, restructuring, stock statements pending, reviews /renewals overdue and inspections overdue reports. No standard and exhaustive list of menus/ reports could be provided here and cannot be a panacea for auditing of all bank branches. Overall, above are some of the generally available various audit exceptions/ system generated CBS reports providing a basis for auditing could work as a beginner’ guide.