Skip to main content

Audit · bank branch audit

Bank branch audit: empanelment and the audit process.

How ICAI empanelment for bank branch auditors works, what a bank branch audit actually covers, and the compressed timeline every empanelled firm has to plan around. Written for practicing CAs and CA-Final students.

  • Reviewed July 2026
  • 7 min read
  • CA Anil Agarwal & the TatvaBooks team

What is a bank branch audit?

A bank branch audit is a statutory audit of an individual branch of a bank — most commonly a public sector bank — conducted by a Chartered Accountant firm empanelled for the purpose, as part of the bank's overall annual statutory audit. Unlike a company statutory audit, the branch auditor doesn't get to choose the client: appointment flows through the ICAI–RBI bank branch audit empanelment system, and the audit itself covers a narrower, more specialised scope centred on advances quality, income recognition and asset classification.

For most practicing CAs, bank branch audit work is seasonal — concentrated in the weeks after 31 March each year — and is often one of the first significant assurance engagements a young partner or qualified assistant leads independently.

The empanelment process, in plain language

Empanelment is renewed every year, not once. Broadly, the cycle runs like this:

Stage When (typically) What happens
Empanelment application Usually opens soon after the ICAI financial-year-end circular, on the ICAI empanelment portal Firm/partner data, experience points and category are filled online; the portal auto-computes eligibility for bank-branch-audit categories based on your inputs.
Bank Branch Auditors' Panel (BBAP) finalisation ICAI forwards the consolidated panel to RBI / individual banks RBI has moved this exercise largely to bank-driven selection from the ICAI panel in recent years — confirm the current mechanism for the year you're empanelling.
Bank selection & appointment letters Typically a few months before year-end, ahead of the audit season Public sector banks generally select branch auditors from the ICAI panel per RBI's extant guidelines on rotation, cooling-off and firm-category eligibility.
Audit season — field work Concentrated in the weeks immediately after 31 March Very short window: branch closing, statutory audit of the branch financials, and LFAR are usually all expected inside the same engagement period.
LFAR & closing certificates Submitted along with or shortly after the branch audit report Format and specific certificates required are prescribed by RBI/the bank each year — always use the current year's LFAR format issued by the bank, not last year's.

Your category on the panel (broadly linked to firm constitution, number of full-time partners, and points earned from continuing professional experience including prior bank audit exposure) determines which class of branches — small, medium, or large — you're eligible for. The exact category definitions, point weightages and application dates change from year to year in ICAI's empanelment circular, so always verify the current criteria and dates on the ICAI empanelment portal and RBI's latest guidelines before you apply — don't rely on a previous cycle's numbers.

What a bank branch audit actually covers

The scope is narrower than a typical statutory audit but far deeper in specific areas — advances above all. A typical engagement covers:

Area What's tested
Advances Sanction terms compliance, documentation, security/valuation, renewal/review status, drawing power computation, interest application, stock/book-debt statements.
NPA classification & provisioning Asset classification per RBI's Income Recognition and Asset Classification (IRAC) norms — standard, sub-standard, doubtful, loss — and whether provisioning matches the classification and any restructuring flags.
Income leakage Interest, processing fees and other charges correctly and completely recognised; reversal of income on accounts turning NPA.
Deposits & other liabilities Interest provisioning, dormant/inoperative account controls, unclaimed deposits, TDS on interest where applicable.
Statutory & other compliances Cash retention limits, KYC/AML sampling, fixed asset and cash verification, revenue leakage checklist items specific to the bank's audit programme.
LFAR (Long Form Audit Report) A structured questionnaire-style report — separate from the main audit report — covering assets, liabilities, credit appraisal, frauds, and general internal-control observations at the branch, in the format the bank prescribes for that year.

NPA classification and provisioning is usually where the audit earns its fee. RBI's Income Recognition and Asset Classification (IRAC) norms fix classification largely by objective triggers — most importantly, how many days an account has been overdue — so the auditor's job is to independently test the branch's own classification against those triggers, not simply accept the branch's system output. Where classification is wrong, income recognised on that account and the provisioning held against it are both wrong, so a single missed NPA can flow through several numbers in the branch return at once.

The LFAR (Long Form Audit Report) is submitted in addition to the audit opinion on the branch financials. It is a structured, largely questionnaire-format report addressing credit appraisal quality, documentation gaps, fraud indicators and general control observations — a format RBI and the bank prescribe afresh each year, so use the current cycle's LFAR proforma rather than a prior year's.

Worked example: a single advance account

A branch has a cash-credit account with a sanctioned limit of ₹50,00,000. On the audit date, the outstanding balance is ₹48,00,000 and the account has been continuously overdue (interest not serviced) for more than the period that triggers sub-standard classification under IRAC norms — say, past the 90-day threshold. The branch's system still shows it as "standard."

  • Reclassification: the auditor reclassifies the account from standard to sub-standard.
  • Provisioning impact: a standard advance typically carries a small general provision (illustratively 0.40%, i.e. ₹19,200 on ₹48,00,000); a sub-standard advance requires a materially higher provision rate (illustratively 15% on the secured portion, i.e. ₹7,20,000 if fully secured) — a swing of roughly ₹7,00,800 in additional provisioning the auditor must report.
  • Income reversal: any interest already recognised as income after the account became a non-performing asset must be reversed out of the branch's income for the period, not just adjusted going forward.

The provisioning percentages above are illustrative to show the mechanics only — always apply the exact IRAC provisioning rates and classification triggers current for the audit year, from RBI's master circular/directions in force at that date.

Practical notes for a practicing CA

  • Plan the sample before the branch closes. The field-work window after 31 March is short; deciding your advances sample, LFAR document list and cash/fixed-asset verification approach in advance is what makes the timeline workable.
  • Don't accept the branch's own NPA flagging at face value. Independently recompute days-past-due and check for restructuring, evergreening (fresh disbursement used to service old dues) and technical adhoc sanctions that mask an overdue account.
  • Cross-check drawing power against the latest stock/book-debt statement — a stale statement inflating drawing power is one of the most common branch-audit findings.
  • Read the current year's LFAR format carefully before starting field work — questions, thresholds and certificates requested do shift year to year.
  • Rotation and cooling-off rules apply to branch auditor appointments; confirm your firm isn't within a cooling-off period for a particular bank before accepting an appointment.
  • Document everything contemporaneously. Given the compressed timeline, working papers written up after the fact are where quality-review findings usually originate.

Frequently asked questions

How do I get empanelled as a bank branch auditor?
You (or your firm) register and update your data every year on the ICAI empanelment portal, typically in the window ICAI announces after the financial year-end. The portal computes your eligible category based on firm constitution, partners' experience, and points assigned to bank-audit experience. ICAI then forwards the consolidated panel to RBI/banks, who select auditors from it for the coming audit season. Category cut-offs and the exact application window move slightly each year — check the ICAI empanelment circular for the current cycle before you rely on last year's dates.
What is the difference between the statutory branch audit and the LFAR?
The statutory branch audit results in an audit report and opinion on the branch's financial statements, similar in spirit to any statutory audit. The Long Form Audit Report (LFAR) is an additional, more granular questionnaire-format report the auditor submits separately, covering areas like advances quality, credit appraisal process, frauds, and specific control weaknesses the bank and RBI want visibility into beyond the standard audit opinion. Most bank branch audit engagements require both.
How is NPA classification checked during a branch audit?
The auditor tests whether each advance account has been classified — standard, sub-standard, doubtful or loss — strictly per RBI's Income Recognition and Asset Classification (IRAC) norms based on days-past-due and other prescribed triggers, independent of what the branch's own system shows. Provisioning is then tested against the classification. This is usually the single area that draws the most audit time and the most branch-manager pushback in a bank branch audit, since it directly affects the branch's (and bank's) reported profit.
How long does a typical bank branch audit take?
It varies with branch size and advances portfolio, but the field-work window is famously tight — often just a handful of working days concentrated right after the financial year closes, because the bank needs branch-level results consolidated fast for its own statutory audit and results announcement. Planning your sampling and document requests before the branch closes for the year, rather than after, is what makes the timeline workable.
Can a CA in practice do bank branch audits without an existing bank client?
Yes — that's the point of the empanelment system. You don't need a pre-existing relationship with a bank; empanelment with ICAI makes your firm visible for selection by any participating bank for that audit season. Selection depends on your category, rotation/cooling-off rules the bank applies, and the bank's own allotment process, not on a prior mandate.

Built for practicing CAs

Run your practice's client books on one platform.

TatvaBooks gives your firm one place to manage client books, GST and compliance — while you focus on the audit work that actually needs your judgement.