Bank Branch Statutory Audit — IRAC & LFAR: The Process, Start to Finish
The mechanics of Bank Branch Statutory Audit — IRAC & LFAR are what clients ask about once they have decided to proceed. The questions below are the ones raised most often in practice; the full scope of the service is on the Bank Branch Statutory Audit — IRAC & LFAR page.
How does a CA firm get appointed as a bank branch auditor?
For public sector banks, appointment flows through the annual RBI empanelment process, administered in coordination with ICAI, where eligible CA firms apply and are categorised by partner strength and experience. Banks then allot specific branches to empanelled firms, generally communicated closer to the financial year-end. For private sector and cooperative banks, appointment is typically made directly by the bank's board or audit committee, following the bank's own selection process, without going through the RBI panel route.
In practice: We advise firms on positioning their empanelment application accurately — category misdeclaration or incomplete documentation is a common, avoidable reason for a weaker allotment or rejection.
What is the Long Form Audit Report (LFAR) and why does it matter so much?
The LFAR is a structured, RBI-prescribed questionnaire that the branch statutory auditor completes in addition to the standard audit report. It covers areas such as asset quality, credit appraisal and sanctioning process adherence, adequacy of security documentation, housekeeping (reconciliation of suspense and sundry accounts), and general internal control observations. It is a key input for the bank's own management and for RBI's supervisory assessment of the branch, and it is reviewed by the bank's Central Statutory Auditors when consolidating branch-level reports into the bank's overall financial statements.
In practice: A templated, generic LFAR response is one of the most common quality criticisms of branch auditors' work. We draft every LFAR response with specific evidence from that branch's testing — not boilerplate language reused across branches.
What are IRAC norms and how central are they to the audit?
IRAC stands for Income Recognition, Asset Classification and Provisioning — the RBI framework that governs how every advance account must be classified (Standard, Special Mention Account, Sub-Standard, Doubtful, or Loss) based primarily on the number of days the account remains overdue, and the provisioning percentage required for each classification. IRAC testing is the technical core of a branch audit — it directly determines the bank's reported Gross and Net NPA figures and provisioning charge.
In practice: We independently recompute overdue days from the account's own statement rather than relying on the branch's system-generated classification flag — system flags can lag behind actual account conduct, especially around restructured or moratorium accounts.
How long does a branch audit typically take?
The time available for a public sector bank branch audit is compressed and depends on the bank, the branch's category (based on advances portfolio size and business volume), and the number of accounts requiring sampling; confirm the current schedule with the bank. The exact deadline is set by the bank's head office to fit its own financial statement consolidation timeline after the financial year-end.
In practice: The compressed window is the defining operational challenge of branch audit. We plan team allocation, partner availability, and sampling strategy well before the branch visit begins, precisely because there is no slack once the audit window opens.
How are advances accounts selected for testing — is it every account or a sample?
RBI prescribes minimum sampling norms for advances testing based on the branch's category and the number/value of outstanding accounts — larger and higher-risk branches require broader coverage. Within that mandatory minimum, the auditor should apply professional judgment to add risk-based selections: large exposures, restructured accounts, accounts with frequent excess drawings over sanctioned limits, and any accounts flagged in the previous year's LFAR or internal audit.
In practice: A purely mechanical minimum-sample approach can miss risk concentration in a handful of large accounts that matter disproportionately to the branch's asset quality picture. We always layer risk-based selection on top of the mandatory minimum.
What is a concurrent audit and how is it different from statutory branch audit?
Concurrent audit is an ongoing, near-real-time review of a branch's day-to-day transactions and internal controls, conducted monthly or quarterly throughout the year, distinct from the once-a-year statutory branch audit. It is appointed separately by the bank (often through a different empanelled list) and reports to bank management on a more frequent cycle, focused on catching control lapses and irregularities as they occur rather than certifying year-end financial statements.
In practice: Firms sometimes assume statutory branch audit empanelment automatically covers concurrent audit eligibility — it typically does not; each carries its own appointment process with the bank.
What is a Special Mention Account (SMA) and why does it matter in branch audit?
SMA is an early-warning classification RBI requires banks to apply to standard accounts showing signs of stress before they slip into NPA — commonly tiered as SMA-0, SMA-1, and SMA-2 based on the extent of overdue days, well before the account crosses the threshold for Sub-Standard classification. Reviewing SMA-tagged accounts carefully during branch audit gives an early signal of accounts at risk of slipping into NPA in the near term, and is a standard part of advances testing and LFAR commentary.
In practice: SMA-2 accounts nearing the NPA threshold at year-end deserve particular scrutiny — a small classification delay of even a few days around the balance sheet date can change the reported asset quality picture materially for that account.
How does restructuring or a moratorium on a loan affect NPA classification during audit?
A restructured account or one that has been granted a moratorium under RBI's applicable framework requires the auditor to verify that the restructuring was sanctioned through the bank's proper approval process, that any regulatory conditions attached to the restructuring were met, and that the account's classification (and any provisioning consequence of the restructuring itself) was applied correctly per RBI's specific norms for restructured assets, which can differ from the standard overdue-day-based classification.
In practice: Restructured accounts are consistently one of the more judgment-intensive areas of branch audit — we review the specific RBI circular or framework under which each restructuring was sanctioned before accepting the branch's classification.
How does PNPC manage multiple branch allotments across the same tight audit season?
Firms empanelled with multiple banks, or allotted several branches by the same bank, routinely face overlapping audit windows in the weeks after financial year-end. PNPC structures its audit teams and partner oversight for exactly this scenario — parallel branch coverage with a dedicated engagement lead for each branch and partner-level review built into the schedule, rather than a single team serially working through branches at the cost of depth or deadline compliance.
In practice: We plan staffing for the audit season months in advance, as soon as empanelment status and likely allotment volume are known — not after allotment letters start arriving, by which point the compressed window has already begun.
Where this sits in the wider engagement
Bank Branch Statutory Audit — IRAC & LFAR rarely arrives on its own. The statutory basis and the current requirements are set out on the Bank Branch Statutory Audit — IRAC & LFAR service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Bank Branch Statutory Audit — IRAC & LFAR we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.