Bank Audit Basics: Concurrent Audit, Statutory Branch Audit and RBI's Checks

Ask a newly qualified CA what bank audit work involves and the answer often collapses into one vague idea: checking a branch's books once a year. In practice, it is layered into at least three distinct functions that run on different timelines, report to different people, and test different things. Concurrent audit runs continuously and looks at transactions close to when they happen. Statutory branch audit is an annual exercise ending in a formal opinion on the branch's financial statements. And underneath both, RBI sets the rules that shape what these audits must check, while also running its own supervisory inspection that sits entirely outside a CA's engagement. Mixing these up, treating a concurrent audit finding as if it carries the weight of a statutory opinion, or assuming RBI has already verified something the branch auditor is expected to test independently, is one of the more common early mistakes in this area of practice.

Concurrent Audit: A Running Check, Not a Year-End Opinion

Concurrent audit functions as an extension of a bank's own internal control system rather than an independent audit in the usual sense. It is commissioned by the bank itself, typically through its audit committee, and the auditor, whether an external CA firm or the bank's own retired officials depending on the bank's policy, reviews transactions at high-risk and high-value locations close to the time they occur, not after the year has closed. RBI expects this coverage to reach a substantial share of a bank's total advances and deposits, weighted heavily toward large corporate branches, treasury and forex operations, and centralised processing units, the kind of locations where a single override or lapse can move significant money quickly. The output is not an opinion on the financial statements. It is a steady stream of exceptions and observations reported up to branch management and the audit committee, built to catch a control breakdown within weeks rather than let it sit undiscovered until the next annual audit.

Statutory Branch Audit: The Annual True and Fair Opinion

Statutory branch audit is the exercise most CAs actually picture when they hear the phrase 'bank audit.' It runs once a year, tied to the financial year-end, and produces a formal opinion on whether the branch's financial statements are true and fair, feeding into the bank's overall accounts audited by its statutory central auditors. For public sector banks, appointment runs through a structured empanelment and allotment process rather than a branch simply engaging a familiar firm, with branches selected largely by the size of their advances so audit effort concentrates where the exposure actually sits. The scope goes well past signing off a trial balance: branch auditors verify income recognition and asset classification under RBI's IRAC norms, test provisioning on non-performing accounts, check lending and documentation compliance, and typically furnish additional structured commentary on advances, deposits and housekeeping alongside the main report. A branch can look clean on the numbers and still fail on classification, if an account that has technically slipped into overdue status was never reclassified and provided for correctly.

Where RBI's Own Supervision Fits In

It helps to keep a third layer separate in your head. RBI supervises banks directly, through its own examiners and its risk-based supervision framework, entirely independent of any CA engagement. That inspection looks at the bank's overall risk profile, governance and compliance culture, and it is not something a branch auditor participates in or should assume has already covered their own scope. What RBI does hand to the CA is a detailed rulebook, the IRAC norms for classifying advances, fraud and KYC reporting formats, and specific certificates on matters like sensitive-sector lending, that both concurrent and statutory auditors are expected to apply within their own work. Confusing the two carries a real risk: a branch auditor who assumes a control point is 'already checked at the head office level' can skip a verification that was genuinely their own job, not RBI's.

What a CA Doing Bank Audit Work Should Actually Focus On

• Read the specific allotment or engagement letter closely, since concurrent and branch audit scopes are set by the bank's own policy and RBI's circulars, not by habits carried over from a non-banking client
• Treat IRAC asset classification as the single highest-risk area in a branch audit, since a wrongly classified account understates provisioning and can distort the entire branch result
• In concurrent audit, prioritise the fraud-prone areas RBI specifically calls out, cash handling, large or unusual credit sanctions, and forex and treasury transactions, ahead of routine, low-risk activity
• Never assume RBI's own inspection has already covered a control point, branch and concurrent auditors are expected to test independently rather than lean on RBI's supervisory findings as a substitute
• Keep working papers detailed enough to support classification and provisioning conclusions specifically, since these are exactly the areas most likely to be questioned in a peer review or a later RBI reference

None of these three functions substitutes for the other two. A bank with a strong concurrent audit function can still fail its statutory audit if asset classification is wrong, and a clean statutory opinion says nothing about whether RBI's supervisory team is comfortable with the bank's broader risk culture. Treating bank audit as one undifferentiated task is what leads to the most avoidable gaps, so the first useful habit for any CA entering this space is learning to ask, for every finding, which of the three functions it actually belongs to.