The Reserve Bank of India has released a draft framework for bank control and assurance functions that aims to simplify rules and boost governance. According to The Economic Times, the new guidelines will be effective from January 1, 2027, providing banks with a clear timeline for implementation. This framework represents a significant step forward in the RBI's efforts to enhance banking sector governance and risk management capabilities.
The framework builds upon the existing Risk-based Internal Audit (RBIA) approach that the RBI was planning to require banks to implement. As reported by The Hindu BusinessLine, this framework will focus on fraud-prone areas, emerging vulnerabilities, and the effectiveness of remedial actions. The RBIA will extend to system and process audits of critical functions, scrutiny of anti-money laundering and related compliance frameworks, and assessment of risks arising from new or evolving business lines. The new draft framework is expected to strengthen these existing requirements and provide clearer implementation guidelines.
Unlike traditional compliance-oriented audits, RBIA aligns audit activities with regulated entities' risk management frameworks and strategic objectives. As reported by The Hindu BusinessLine, the aim is to provide independent assurance on whether material risks are being managed effectively and in line with the entity's risk appetite. The RBI emphasized that risk management and compliance functions shall be subject to regular internal audit, with banks required to develop and maintain a Quality Assurance and Improvement Program (QAIP) covering all aspects of Compliance and Internal Audit Functions. The draft framework is expected to provide more detailed guidance on achieving this strategic alignment across all control functions.
According to the RBI guidelines, banks shall establish risk management, compliance and internal audit functions commensurate with their size, complexity and risk/business profile. As reported by The Hindu BusinessLine, these functions must be headed by a Chief Risk Officer (CRO), Chief Compliance Officer (CCO) and Head of Internal Audit (HIA) respectively. For banks in groups comprising more than one financial entity, there may be a Group Chief Risk Officer (GCRO) and Group Chief Compliance Officer (GCCO) responsible for group-level risk oversight and coordination. The draft framework is expected to provide clearer guidelines on organizational structure and reporting lines for these critical functions.
The RBI mandates that banks shall have policies for each of the three control functions - Risk Management, Compliance and Internal Audit - clearly articulating objectives, roles and responsibilities of each function. As reported by The Hindu BusinessLine, as part of the overall corporate governance framework, the Board is responsible for overseeing the control functions and must set the 'tone at the top' to ensure these functions are adequately resourced and maintain their independence. The draft framework is expected to provide more detailed guidance on board oversight responsibilities and the establishment of effective governance structures.
