Expert verified
TL;DR Summary:
Statutory audits are mandatory for all Indian commercial banks and follow strict RBI rules; auditors must meet eligibility, rotation, and reporting norms, including the detailed LFAR. The audit focuses heavily on advances/NPAs, IRAC compliance, investments, fraud checks, and regulatory adherence to ensure accurate financial reporting.
Auditing a bank is a different animal from auditing a normal company. The numbers are bigger, the rules are tighter, and the Reserve Bank of India is watching closely the whole way through. If you want to understand how a bank statutory audit actually works in India — who does it, what they look at, and why bad loans get so much attention — this guide walks you through it in plain language.
Is Statutory Audit Mandatory for Banks in India?
| Quick answerYes, statutory audit is mandatory for all commercial banks under the Banking Regulation Act, 1949 and RBI guidelines. |
There’s no opting out. Every commercial bank in India has its accounts audited every year by independent Chartered Accountants, and the whole process is tightly controlled by the RBI — from who is allowed to do the audit, to how long they can stay, to exactly what they must report on. Banks also fall under the Companies Act (or their own governing statute, for public sector banks), but the RBI’s rules are what really shape a bank audit and make it stricter than an ordinary one.
RBI Guidelines on Bank Statutory Audit (2026)
The RBI doesn’t just leave banks to pick any auditor they like. In April 2021 it issued a detailed set of guidelines covering the appointment of statutory auditors for commercial banks, co-operative banks and NBFCs, and those rules still govern bank audits today. The aim was simple: better audit quality and fewer nasty surprises, after some high-profile financial failures shook confidence in the system.
A bank audit usually happens at two levels. Statutory branch audits cover individual branches — typically the larger or higher-risk ones — while the central statutory audit pulls everything together at the head office and gives the opinion on the bank’s overall financial statements. The branch findings feed upward into that final bank-level view.
H2 Appointment of Bank Statutory Auditors: RBI Eligibility & Rotation
This is where bank audits stand apart most clearly. A company normally picks its own auditor at the AGM. A bank can’t just do that — the RBI sits in the middle. Here are the key rules from the 2021 guidelines:
• Prior RBI approval. Banks must get the RBI’s approval before appointing or reappointing their statutory auditors, every year.
• Three-year tenure. An audit firm is appointed for a continuous term of three years, subject to staying eligible throughout.
• Six-year cooling-off. After finishing (or even partly serving) that term, the firm can’t be reappointed to the same bank for six years. This forced rotation is meant to keep auditors independent and prevent cosy long-term relationships.
• Joint audit for big entities. Where the entity’s asset size is ₹15,000 crore or more, the audit must be done jointly by at least two firms — and those firms can’t share partners or belong to the same network.
• Limits on how many banks one firm can take. A single firm can audit a maximum of four commercial banks in a year, with sub-limits on public sector banks, to spread the work and avoid overload.
• Eligibility and independence checks. Firms must meet minimum size and experience criteria and must not be under any debarment by NFRA, ICAI, RBI or other regulators. A firm doing concurrent audit at a bank generally has to wait out a one-year cooling-off before it can become that bank’s statutory auditor.
H2 Long Form Audit Report (LFAR): What It Covers
Here’s something you won’t find in an ordinary company audit. On top of the usual audit report, bank auditors must also prepare a Long Form Audit Report, or LFAR. It’s a detailed, questionnaire-style report in a format the RBI lays down, and it’s one of the things that makes bank auditing so distinctive.
The RBI overhauled the LFAR format a few years ago, with the revised version applying from the 2020-21 audit year onwards. The update reflected how much bigger and more complex banking had become, and it sharpened the focus on credit, asset quality and fraud. There are separate LFAR formats for different levels — branch, head office, and the central statutory auditor — so the reporting builds up layer by layer.
Broadly, the LFAR asks the auditor to comment on things like:
• Cash, balances with the RBI and other banks, and money at call
• Investments — how they’re bought, sold, valued and classified
• Advances — loan appraisal, documentation, and whether bad loans are correctly classified
• Asset quality and the systems used to spot and track problem loans
• Other assets, deposits, and contingent liabilities like guarantees
• Frauds detected, and the action taken on the previous year’s LFAR points
The completed LFAR doesn’t just sit with the bank. A copy goes to the RBI’s supervision team, and the rule is that it should reach them within 60 days of the auditors submitting it. So the LFAR is genuinely a supervisory tool, not just internal paperwork.
H2 NPA and Provisioning Audit: Key Focus Areas
If there’s one area that gets the most scrutiny in a bank audit, it’s bad loans — what the industry calls non-performing assets, or NPAs. This is where auditors spend a huge chunk of their time, because getting it wrong can hide real losses and overstate a bank’s health.
The rulebook here is the RBI’s IRAC norms — Income Recognition, Asset Classification and Provisioning. In plain terms, here’s what auditors are checking:
• When a loan turns bad. Broadly, a loan becomes an NPA when the borrower hasn’t serviced the interest or instalment due for more than 90 days. Auditors test whether the bank’s system is actually catching that on time, rather than quietly leaving overdue accounts marked as healthy.
• Correct classification. Once an account is an NPA, it gets graded — sub-standard, doubtful, or loss — depending on how long it’s been bad. Each grade carries different consequences, so the classification has to be right.
• Stopping the income. Banks can’t keep booking interest income on a loan that’s gone bad. Once an account is an NPA, interest already taken to income but not actually received has to be reversed. Auditors check this carefully, because it directly affects reported profit.
• Enough provisioning. For every bad loan, the bank must set aside a provision — a cushion against the expected loss. The RBI sets minimum provisioning levels for each category, and these rise the longer a loan stays bad. The auditor’s job is to confirm the bank has provided at least the required amount.
When a branch auditor spots a misclassification or a shortfall — say a loan that should be sub-standard but is still marked standard — they raise it through a Memorandum of Changes (MOC). That correction then flows up into the bank-level accounts. It’s a small phrase, but the MOC is often where the real money in a bank audit gets found.
H2 Concurrent Audit vs Statutory Audit in Banking
People mix these two up all the time, so it’s worth being clear. They’re not the same thing and they don’t do the same job.
| Statutory Audit | Concurrent Audit | |
| Purpose | Annual opinion on whether the bank’s financial statements are true and fair | Ongoing, near-real-time check on day-to-day transactions and compliance |
| Timing | Once a year, at year-end | Continuous — typically monthly or quarterly, as transactions happen |
| Focus | Financial statements, IRAC, LFAR, overall accuracy | Operational compliance with bank policy and RBI rules at the branch |
| Reports to | Shareholders, and the RBI | The bank’s own management / controlling office |
In short: concurrent audit is the regular health monitoring that runs through the year inside higher-risk branches, while statutory audit is the formal annual exam that produces the audited financial statements. Different people usually do each, and the statutory auditor will actually review concurrent audit findings as part of their work.
| PKC Bank and NBFC Audit ServicesBank and NBFC audits demand specialist knowledge of RBI norms, IRAC classification and LFAR reporting. PKC’s team brings exactly that.Talk to us today — call +91 91761 00095 or book your FREE 30-minute consultation. |
H2 So What Does a Bank Statutory Audit Actually Cover?
Pulling it together, a bank statutory audit goes well beyond ticking the numbers. The auditor examines advances and loan documentation, tests how bad loans are identified and provided for, reviews investments and how they’re valued, checks cash and inter-bank balances, looks at deposits and guarantees, watches for fraud, and confirms the bank is following RBI directions throughout. All of that gets distilled into two things: the main audit report with the auditor’s opinion, and the LFAR that goes to the regulator. It’s detailed, it’s high-stakes, and it’s a genuinely specialised field.
H2 Frequently Asked Questions
Is statutory audit mandatory for banks in India?
Yes. Statutory audit is mandatory for all commercial banks in India under the Banking Regulation Act, 1949 and RBI guidelines. Every commercial bank’s accounts are audited each year by independent Chartered Accountants, and the RBI controls who can be appointed and how. There’s no exemption based on size or profit.
What is LFAR in banking audit?
LFAR stands for Long Form Audit Report. It’s a detailed, questionnaire-style report that bank auditors must prepare in addition to the normal audit report, in a format prescribed by the RBI. It covers areas like advances, investments, asset quality, frauds and compliance, and a copy goes to the RBI’s supervision team — usually within 60 days of submission. The format was revised effective from the 2020-21 audit year.
Who appoints bank statutory auditors?
Bank statutory auditors are appointed by the bank, but only with the prior approval of the Reserve Bank of India, which banks must seek every year. Under the RBI’s 2021 guidelines, a firm serves a three-year term, then can’t return to the same bank for six years. Where the entity has assets of ₹15,000 crore or more, at least two firms must audit jointly.
What does a bank statutory audit cover?
A bank statutory audit covers advances and loan documentation, the identification and provisioning of bad loans under the RBI’s IRAC norms, investments and their valuation, cash and inter-bank balances, deposits, contingent liabilities like guarantees, fraud detection, and overall compliance with RBI directions. The results go into the main audit report and the Long Form Audit Report.
How PKC Can Help
PKC Management Consulting is a mid-tier firm with a dedicated team that understands the specific demands of bank and NBFC audits — RBI guidelines, IRAC classification, provisioning, and LFAR reporting. Whether you’re a bank branch, an NBFC, or a finance business trying to stay on the right side of the RBI, we bring the regulatory know-how and the practical, business-minded approach to go with it. If you need an audit team that genuinely speaks the language of banking regulation, that’s us.
Your dream business is just a click away. Book a FREE 30-minute consultation.
Call us: +91 91761 00095
Disclaimer: This blog is for general information only and is not legal, audit or regulatory advice. RBI guidelines, IRAC norms and LFAR formats are detailed and change over time. Please refer to the latest RBI circulars and ICAI guidance, or speak to a qualified professional, for your specific situation.
