Testing ECL staging documentation means testing, for a sample of loans spanning each stage, whether the entity's own staging criteria were correctly applied to that loan's facts and whether a documented trigger exists for every movement between stages — Stage 1 for loans with no significant increase in credit risk since origination, Stage 2 for loans where that increase has occurred but the loan is not yet credit-impaired, and Stage 3 for loans that are credit-impaired. The arithmetic of the expected credit loss computation within each stage is a separate, later step; staging is tested first because it determines which loss computation — twelve-month or lifetime — applies at all.
Why staging is where the audit risk concentrates
A non-bank lender's provisioning policy typically sets quantitative backstops — days past due, a specified change in internal risk grade — and qualitative triggers — restructuring, a covenant breach, adverse news about the borrower. The quantitative backstops are easy to recompute. The qualitative triggers are where entities understate provisions, because moving a loan to Stage 2 or 3 on qualitative grounds alone requires management to act on information it would sometimes rather not act on.
The testing sequence
- 01Obtain the entity's board-approved ECL policy and its staging criteria in fullThe days-past-due backstops used for the rebuttable presumption of significant increase in credit risk at 30 days and credit-impairment at 90 days, any internal rebuttal of those presumptions, and every qualitative trigger defined.
- 02Recompute the days-past-due staging for the full loan bookThis is a mechanical recomputation against the repayment schedule and collection records and should be done for the whole population, not a sample, since the data and the rule are both available in full.
- 03Test any rebuttal of the 30-day or 90-day presumptionWhere the entity has rebutted the presumption that 30 days past due signals a significant increase in credit risk, or that 90 days signals credit impairment, obtain the entity's reasonable and supportable evidence for the rebuttal and test it for each loan or portfolio it is applied to, not as a blanket policy statement.
- 04Select a sample of loans for the qualitative triggers and trace the trigger to source evidenceRestructured loans, loans under a one-time settlement, loans to borrowers under the same group as another defaulted borrower, and loans flagged in collection or legal records as under dispute. For each, confirm the stage assigned reflects what the trigger evidence shows, not what the days-past-due counter alone shows.
- 05Test loans that moved stage during the year specifically, in both directionsA loan that moved from Stage 2 back to Stage 1 should have a documented basis for the improvement, consistent with the entity's cure-period policy; a loan that should have moved to Stage 2 or 3 but did not is the more common and more consequential miss.
- 06Test restructured and rescheduled accounts for continued elevated stagingA loan restructured during the year typically carries evidence of financial difficulty and should not return to Stage 1 immediately on restructuring; test the cure period the entity applies before any such loan is downgraded back.
- 07Cross-check staging against other indicators available in the fileLitigation status, SMA classification under RBI's income recognition norms where applicable, and any loans flagged in internal audit or risk committee reports — a mismatch between those sources and the ECL stage assigned is a red flag worth investigating on its own.
| Stage | Trigger | Evidence expected |
|---|---|---|
| Stage 1 | No significant increase in credit risk since origination | Days past due within the backstop, no qualitative trigger present |
| Stage 2 | Significant increase in credit risk, not yet impaired | Days past due beyond 30 (unless rebutted), or a documented qualitative trigger |
| Stage 3 | Credit-impaired | Days past due beyond 90 (unless rebutted), default or restructuring evidence |
A borrower group where one entity has defaulted and a related entity within the same group has not yet missed a payment is a classic understated-staging scenario. Test whether the entity's policy actually considers group-level credit risk contagion, not just the payment record of the individual borrower entity.
How we think about this
The days-past-due recomputation is deterministic and should cover the whole book. Whether a qualitative trigger exists for a specific borrower, and whether a rebuttal of the standard presumptions is reasonable and supportable, is a credit judgement, and testing it means reading the borrower's actual file, not re-running the policy document against a counter.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Audit documentationInd AS 109 ECL model in practice — testing expected credit lossThe ECL number on the balance sheet is a model output. The audit work is entirely about whether the stage allocation and the inputs feeding that model actually hold up.
- Related parties & disclosuresNBFC statutory audit: what's different from a normal company auditThe Companies Act audit is the floor, not the audit. NPA classification, ECL provisioning and RBI returns are where an NBFC audit actually differs.
- Revenue, receivables & cut-offAuditing bad debts and the provision for doubtful debtsThe expected credit loss model at a practical level, how it compares to ageing-based provisioning, testing management's assumptions, and the write-off authorisation trail.
- Audit workflow & automationSA 540: auditing accounting estimates, where judgment replaces a verifiable numberAn estimate can't be vouched to a source document the way an invoice can. SA 540 is about what replaces vouching when there's no single right answer to check against.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.