An NBFC statutory audit differs from a normal company audit in three specific areas that a generic audit plan does not cover at all: classification of loan assets into performance buckets under RBI's prudential norms, computation of expected credit loss provisioning under Ind AS 109 (which for most NBFCs now runs in parallel with, and is expected to be at least as conservative as, the RBI's own provisioning floor), and a set of periodic regulatory returns filed with the RBI that the statutory auditor is often asked to verify or certify. Everything else — revenue, expenses, related parties, fixed assets — is tested the same way as any other company.
Asset classification: the NBFC-specific layer
RBI's Scale Based Regulation framework and the Master Direction on NBFCs require classification of every loan asset into standard, sub-standard, doubtful and loss categories based on days-past-due. This classification is independent of the accounting entries in the books — a loan that looks current in the ledger can still be overdue under the regulatory ageing definition if a scheduled instalment was missed.
- 01Obtain the loan-level ageing report, not a summaryClassification is an asset-by-asset exercise. A portfolio-level NPA percentage from management is not sufficient audit evidence; the auditor needs to recompute or test the days-past-due bucket for a sample of accounts directly from the underlying repayment schedule.
- 02Reconcile the ageing system to the loan management systemMany NBFCs run classification off a separate collections or loan-servicing system that is not the general ledger. Confirm the two are reconciled as of the reporting date, not as of some earlier cut.
- 03Test restructured and rescheduled accounts separatelyRestructuring resets or defers the ageing clock under specific RBI conditions. Test that restructured accounts actually meet those conditions rather than being reclassified to standard on management's assertion alone.
- 04Check the staging used for Ind AS 109, not just the RBI bucketInd AS 109 stages (1, 2, 3) use a significant-increase-in-credit-risk test that does not map one-to-one onto the RBI's four-bucket classification. An account can be RBI-standard and still be Ind AS stage 2 if risk has deteriorated.
Provisioning: two frameworks running at once
Non-banking financial companies that follow Ind AS compute expected credit loss provisions under Ind AS 109, built on probability of default, loss given default and exposure at default, usually derived from historical roll-rate or vintage analysis. Separately, RBI's prudential norms prescribe a minimum provisioning floor by asset classification bucket. The auditor's job is to confirm the Ind AS 109 provision is not lower than the regulatory floor for each bucket, and to test the ECL model's inputs and assumptions, not just recompute the arithmetic.
| Input | What to check |
|---|---|
| Historical default data | Length of the data window used, and whether it reflects a cycle the current portfolio resembles |
| Macroeconomic overlay | Whether management adjusted model output for current conditions, and the basis for the adjustment |
| Stage transfer logic | Whether the significant-increase-in-credit-risk threshold is applied consistently across the portfolio, not overridden selectively |
| Write-off policy | Whether write-offs are being used to understate the provision rather than being recognised as a genuine loss |
A management override that moves an account from stage 3 back to stage 1 without a documented, consistently-applied cure criterion is one of the more common ways NBFC provisioning gets understated. Test the override population specifically, not just the model.
RBI returns
NBFCs file periodic returns with the RBI covering capital adequacy, asset-liability management, exposure norms and more, depending on their layer under the Scale Based Regulation framework. The statutory auditor is frequently engaged separately, or under the same engagement letter, to verify specific returns such as the NBS series or the capital adequacy return. Treat this as a distinct deliverable with its own sign-off, not an incidental by-product of the financial statement audit — the figures in a return can differ from the financial statements where the return uses a different basis of computation.
Regulatory requirement
The specific returns applicable, their periodicity and the layer-based thresholds are set by RBI circulars and Master Directions that are revised fairly often. Confirm the current applicable framework for the specific NBFC's layer before planning the audit.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Revenue, receivables & cut-offInd AS 109: financial instruments and the expected credit loss modelThe old model waited for a loss to be incurred before providing for it. ECL is built the opposite way — provide for the loss you expect, before it happens.
- Related parties & disclosuresRelated-party transaction testing under AS 18 / Ind AS 24Testing related-party transactions means proving the population is complete before checking what management already disclosed.
- Audit workflow & automationThe statutory audit workflow, from evidence collection to sign-offAn engagement end to end: acceptance through to sign-off, with where the time actually goes and the four points at which engagements reliably stall.
- Audit workflow & automationSA 540: auditing accounting estimates, where judgment replaces a verifiable numberAn estimate can't be vouched to a source document the way an invoice can. SA 540 is about what replaces vouching when there's no single right answer to check against.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.