Concurrent, Operational & Process Audit: Where It Goes Wrong
The failures on Concurrent, Operational & Process Audit repeat, which means they are avoidable if you know what to watch. The questions below are the ones raised most often in practice; the full scope of the service is on the Concurrent, Operational & Process Audit page.
How is PNPC's operational audit report structured?
Our reports are structured around risk-rated findings — each observation is classified by severity (typically high/medium/low, or a similar risk grading), accompanied by the root cause, the potential financial or operational impact, a specific recommendation, and a management response with an agreed target closure date. This differs from a narrative-style report that simply lists observations without prioritisation — a risk-rated structure lets the Audit Committee or Board focus limited attention on what matters most first.
In practice: An operational audit report made up of many pages of undifferentiated observations leaves management unsure what to act on first. A report the Board will not act on is not adding value, regardless of how thorough the fieldwork was.
How does PNPC handle multi-location operational audits?
For businesses with multiple branches, warehouses, or plants, we design a rotational or risk-based coverage plan — auditing every location over a defined cycle (annually or across a 2-year rotation, depending on risk) rather than only ever auditing head office or the largest location. High-risk or historically problematic locations are prioritised for more frequent coverage. Findings are consolidated across locations to identify whether an issue is a single-site lapse or a systemic gap in the SOP or training that repeats across the network.
In practice: A finding that repeats identically at four out of six branches is a process design or training issue, not four unrelated local failures — and needs a head-office-level fix, not four separate local corrective actions. We flag this distinction explicitly in multi-location reports.
What is a Risk Based Internal Audit (RBIA) framework, and does it apply to us?
Risk Based Internal Audit is the framework mandated by RBI for banks and, in a scaled form, applicable to certain categories of NBFCs, requiring the internal audit function to prioritise audit coverage and frequency according to a documented risk assessment of each business area, rather than auditing everything with equal intensity. For a non-RBI-regulated company, RBIA is not a mandatory framework by name, but its underlying principle — risk-based rather than uniform audit coverage — is the same approach PNPC applies when designing an operational audit plan for any client, RBI-regulated or not.
In practice: We borrow the RBIA principle of risk-weighting audit frequency for all our operational audit clients, not just banks and NBFCs — it is simply good audit-resource allocation, regardless of whether a regulator formally mandates it for a given entity.
What is the ICAI's role in governing these audits?
The Institute of Chartered Accountants of India (ICAI) issues the Standards on Internal Audit (SIA), a series of standards covering planning, risk assessment, documentation, reporting, and quality control for internal audit engagements — including the operational and process audit work that typically forms part of an internal audit programme. ICAI has been rolling out mandatory compliance with the SIAs in a phased manner — starting with internal audit engagements for listed companies and progressively extending to other companies — for every ICAI member conducting an internal audit, regardless of whether internal audit is a statutory requirement for that particular entity under Section 138. PNPC applies the same disciplined SIA-based methodology to voluntary, management-commissioned operational and process audits as well, rather than using a lighter, non-standard approach for non-mandatory engagements.
In practice: Applying the same rigour to voluntary engagements as to statutory ones is a deliberate choice on our part — clients who commission a 'lighter' voluntary audit still deserve findings they can actually rely on, not a diluted version of the real methodology.
Does an operational audit review IT systems and cybersecurity controls too?
A standard operational or process audit typically covers system-embedded process controls relevant to the function in scope — for example, whether the ERP enforces segregation of duties between purchase requisition, approval, and payment. It is not, by default, a full IT general controls (ITGC) audit or a cybersecurity/penetration-testing engagement, which are specialised assessments requiring different expertise and are scoped separately. Where a client's risk profile calls for it, PNPC scopes a dedicated IT controls review alongside the operational audit rather than folding a specialist exercise into a general process review superficially.
In practice: We are explicit with clients about this boundary — a general operational audit finding that 'IT access controls need review' is a flag to commission a proper IT controls assessment, not a substitute for one.
Do NBFCs need concurrent audit, or only banks?
Concurrent audit in its full, branch-level form under the RBI Master Direction has historically been most directly associated with scheduled commercial banks. For NBFCs, RBI's regulatory framework instead centres on the Risk Based Internal Audit (RBIA) requirement, applicable to specified categories and sizes of NBFCs, which mandates a structured, risk-prioritised internal audit function rather than the identical concurrent-audit branch-coverage model used for banks. The precise applicability depends on the NBFC's asset size classification and current RBI directions, which PNPC confirms against the client's specific classification at engagement scoping rather than assuming uniform applicability across all NBFCs.
In practice: NBFC regulatory classification (base layer, middle layer, upper layer under RBI's scale-based regulatory framework) has a direct bearing on which internal audit obligations apply — we always confirm current classification and the correspondingly applicable requirement before scoping, since it materially changes the engagement design.
How does PNPC coordinate an operational audit with our statutory auditor, if they are a different firm?
Where PNPC performs the internal/operational audit and a different firm serves as statutory auditor, we coordinate through the Audit Committee — sharing relevant operational audit findings that could have financial statement implications (such as inventory discrepancies, revenue recognition process weaknesses, or control gaps around related party transactions) so the statutory auditor can factor them into their own risk assessment and audit approach, subject to the client's consent and the Audit Committee's coordination protocol.
In practice: Good coordination between internal and statutory auditors, facilitated by the Audit Committee, generally makes both audits more efficient and reduces duplicated fieldwork requests to the same department heads — we proactively suggest this coordination model to clients where the two roles sit with different firms.
Where this sits in the wider engagement
Concurrent, Operational & Process Audit rarely arrives on its own. The statutory basis and the current requirements are set out on the Concurrent, Operational & Process Audit service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Concurrent, Operational & Process Audit we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.