The Reserve Bank of India on Friday extended the risk-based internal audit (RBIA) system to certain housing finance companies (HFCs) in a bid to enhance the quality and effectiveness of their audits.

In February this year, the banking regulator had issued a circular mandating the RBIA framework for all deposit taking non-banking finance companies (NBFCs), all non-deposit taking NBFCs with an asset size of Rs 5,000 crore and above and all urban co-operative banks (UCBs) having an asset size of Rs 500 crore and above.

On Friday, the RBI included HFCs to this list. The provisions will apply to all deposit-taking HFCs, irrespective of their size. It will also cover all non-deposit-taking HFCs with an asset size of Rs 5,000 crore and above, the central bank added. These HFCs have been asked to put in place an RBIA framework by June 30, 2022.

According to the central bank, an effective RBIA is an audit methodology that links an organisation’s overall risk management framework and provides an assurance to the board of directors and the senior management on the quality and effectiveness of its internal controls, risk management and governance-related systems and processes.

In the February circular, it added that the essential requirements for a robust internal audit function include sufficient authority, proper stature, independence, adequate resources and professional competence.

As part of the norms, the central bank has said that the audit committee of the board or the board itself will have to approve an RBIA plan to determine the priorities of the internal audit function based on the level and direction of risk as consistent with the entity’s goals.

The risk assessment of business and other functions of the organisation should at least be conducted on an annual basis.

RBI has also said that every activity or location, including the risk management and compliance functions, shall be subjected to risk assessment by the RBIA. ``The senior management is responsible for ensuring adherence to the internal audit policy guidelines as approved by the Board and development of an effective internal control function that identifies, measures, monitors and reports all risks faced. It shall ensure that appropriate action is taken on the internal audit findings within given timelines and status on closure of audit reports is placed before the ACB/Board’’, it added.