Credit, Operational & IT Risk Reviews — What to Get Right Before You Start
A bank's or NBFC's credit book, its day-to-day operations, and its technology stack are three separate places where the same organisation can quietly build up risk it does not fully see — until a loan portfolio deteriorates faster than provisioning anticipated, a process breakdown lets a control gap through, or a system outage exposes a dependency nobody had mapped. Credit, Operational & IT Risk Reviews bring structured, evidence-based assessment to all three domains — calibrated to RBI's supervisory expectations for banks and NBFCs, and to the operational and technology risk exposure that increasingly matters for any sizeable corporate, not just regulated financial entities. At PNPC Global, we have been reviewing credit books, testing operational controls, and assessing IT risk postures since 1986.
What This Actually Covers
Credit, Operational & IT Risk Reviews are a combined but distinct set of assurance and advisory engagements that assess three of the most material risk categories facing banks, NBFCs, and increasingly any credit-extending or technology-dependent corporate. Credit risk review examines the quality of an entity's lending or credit-extension book — appraisal standards, exposure concentration, collateral valuation, provisioning adequacy under Ind AS 109's Expected Credit Loss (ECL) model or RBI's Income Recognition and Asset Classification (IRAC) norms, and early-warning signal effectiveness — to answer whether the credit portfolio's stated risk profile matches its actual risk profile. Operational risk review examines the people, process, and system failures that can cause direct or indirect loss — inadequate segregation of duties, process breakdowns, transaction processing errors, internal fraud vulnerability, and third-party/vendor dependency risk — following the Basel Committee's operational risk taxonomy that RBI has adopted for regulated entities and that is increasingly used as good practice by non-regulated corporates as well.
For the full scope, current process and what PNPC includes, see the dedicated Credit, Operational & IT Risk Reviews service page.
Is This Relevant to Your Business?
- NBFC crossing into the Middle Layer or Upper Layer under RBI's Scale Based Regulation framework, triggering enhanced risk management, IT governance, and Risk Management Committee obligations
- Bank or NBFC preparing for an RBI supervisory inspection, or responding to observations already raised by RBI on credit appraisal, provisioning, or IT governance practices
- Rising NPA levels, deteriorating asset quality, or a Board/Audit Committee that wants an independent view on whether provisioning under Ind AS 109 ECL or IRAC norms genuinely reflects the credit book's risk
- A recent operational loss event — a processing error, an internal fraud, a vendor failure — that has prompted the organisation to ask what other operational control gaps exist beyond the one that surfaced
Before You Assume You Need This
- A confirmed fraud has already occurred and the organisation needs to determine what happened, who was involved, and the financial impact — that calls for a targeted forensic investigation, not a broad risk review
- The organisation's need is a full Enterprise Risk Management framework spanning strategic, financial, compliance, and reputational risk categories, of which credit/operational/IT risk are only a subset — an ERM engagement is the better starting point, with these three reviews as a subsequent deeper dive
- The immediate requirement is statutory Internal Financial Controls (IFC) testing for the annual audit under Section 143(3)(i) of the Companies Act — that is a defined, narrower scope tied to financial reporting controls specifically, though it overlaps with operational risk review methodology
Common Questions
What exactly do Credit, Operational & IT Risk Reviews cover, in plain terms?
Three related but distinct questions. Credit risk review asks: is the loan/credit book actually as healthy as it appears, and is provisioning adequate for the risk actually present? Operational risk review asks: where could a process, people, or control failure cause a direct financial or reputational loss, and are those gaps currently open? IT risk review asks: is the technology environment — access controls, data security, system resilience — adequately protected, governed, and compliant with current data protection law? PNPC scopes these individually or together depending on your regulatory status and specific concern.
Is this review mandatory for our organisation, or is it discretionary?
For banks and NBFCs, elements of this review are effectively mandatory through RBI's supervisory framework: NBFCs in the Middle and Upper Layers under the Scale Based Regulation framework must meet enhanced risk management and IT governance requirements, and RBI's IT Governance, Risk, Controls and Assurance Practices Master Direction applies directly to banks and Middle/Upper Layer NBFCs. For a non-regulated corporate, there is no single statute mandating this exact review, but a material trade-credit book, significant process dependencies, or meaningful IT/data exposure make it a genuinely prudent, increasingly expected practice — particularly given DPDP Act, 2023 obligations that apply regardless of sector.
What is RBI's Scale Based Regulation (SBR) framework and how does it affect our review scope?
SBR, effective from October 2022, classifies NBFCs into four layers — Base, Middle, Upper, and Top — based on size, activity, and perceived riskiness, with progressively more stringent governance, risk management, and capital requirements at each higher layer. Upper Layer NBFCs face requirements closer to those applicable to banks, including mandatory Board-level Risk Management Committee constitution, more rigorous IT governance, and enhanced disclosure. The layer your NBFC currently sits in — and how close it is to crossing into the next layer — directly determines how rigorous a credit, operational, and IT risk review needs to be, and how soon.
Getting This Right From the Start
A risk review that only checks whether a policy exists tells you nothing about whether your credit book, your operations, or your systems are actually safe. Talk to PNPC Global about a review that tests what actually happens — and gives your Board and your regulator a remediation plan they can trust.
PNPC Global has advised Chennai, Bangalore and Hyderabad businesses since 1986. Explore the full Risk Advisory practice for related services, or go straight to the Credit, Operational & IT Risk Reviews page for specifics.
Specific rates, fees, thresholds and deadlines are set by the relevant authority and change over time — this article deliberately does not quote figures that could go stale. Confirm current numbers directly with PNPC or the official source before you act.