NBFC internal audit directions 2026: a guide for credit teams

Who is covered

Para 3 of the Directions lists four groups.

The Directions use NBFC as a collective term for all of these entities. In this piece, covered NBFC carries the same meaning. Everything below applies only to them.

Para 44 repeals the existing internal audit instructions for these NBFCs, as communicated in circular DoS.CO.PPG.66/11.01.005/2026-27 of the same date. Read that circular to see exactly what was repealed. Under para 45, action taken or started under the repealed instructions stays governed by them.

What the Directions require

The wording varies, so the table keeps the verb the Directions use. Where a para mixes verbs, the table shows the one attached to that requirement.

Chapter IV covers the Head of Internal Audit (HIA).

• Tenure: a reasonably long period, preferably at least three years, except where audit is a specialised function run by career internal auditors (para 41).
• Reporting: directly to the Board, ACB, MD & CEO or a Whole Time Director (WTD) (para 42).
• Safeguard: where the MD & CEO or a WTD is the reporting authority, the ACB or Board reviews the HIA’s appraisal, the Board accepts it, and the ACB or Board meets the HIA at least once a quarter without senior management (para 42).
• Separation: no reporting relationship with business verticals and no business targets (para 43).

Why it matters for credit teams

Audit’s view goes beyond the file. Paras 18 and 25 of the Directions cover control evaluation and portfolio-level risk as well as transactions. A clean sample may not settle the question if the control behind it is weak.

Your history feeds audit’s priorities. Para 31 lists ten parameters for the risk assessment. They include previous audit reports and compliance, changes in key personnel, volume and complexity, time since the last audit, and performance variations from budget.

Audit should hear about changes. Para 23 says audit should be kept informed of all developments, including new products, changes in reporting lines and accounting changes. As working practice, tell audit early about a product launch or a credit process change.

Risk and audit stay separate. Under para 19, the Risk Management function should focus on identifying, measuring, monitoring and managing risks, developing risk policies and procedures, and using risk management models. RBIA makes its own independent assessment. Para 13 requires the policy to demarcate the two roles, so a risk team’s rating does not replace audit’s.

Credit staff may be affected directly. Para 8 lets the Board examine whether staff with specialised knowledge should serve at least one stint in Internal Audit. The para does not name credit, and it depends on each Board’s decision.

By role, as general working practice:

Worked example, made-up numbers

First, the scope test, using para 3 of the Directions.

Next, NBFC A builds the Risk Audit Matrix that para 32 says an NBFC may prepare, based on magnitude and frequency. The Directions set no numeric bands, so these are invented. Magnitude is high at ₹1,000 crore and above, medium from ₹200 crore to below ₹1,000 crore, and low below ₹200 crore. Frequency is high at 10 or more exceptions per 100 files sampled, medium at 5 to 9, and low below 5.

How to read it:

• MSME sanctions in Zone A get first attention.
• Personal loan exceptions rose from 5 to 9 per 100 since the last cycle. The priority stays 5th, but para 29 also asks for the basis of the trend, so audit records it as increasing.
• Staff loans are not among the para 32 priorities, but they remain in the risk assessment under para 26. They also cannot stay out of audit beyond the maximum period in NBFC A’s policy, which para 14 says the policy should set.

Pitfalls

• Treating every verb as the same. The Directions use shall, should and may, and para 41 says preferably. Do not cite a may or a preferably as a hard rule. Under para 47, RBI’s interpretation is final, so take doubts to compliance.
• Assuming the Directions set your limits. Closure timelines, the low-risk exclusion period and risk bands are not given as numbers. They vary by institution, so check your own policy.
• Assuming all NBFCs are covered. Non-deposit-taking entities below ₹5,000 crore are not in the para 3 list. The Directions do not define asset size or a test date, and para 4 points to other RBI and statutory definitions. Confirm your status with compliance.
• Reading low risk as no audit. Paras 14 and 26 keep low-risk areas in the frame.
• Leaving closure to audit. Audit monitors compliance (para 36), but senior management must ensure action is taken (para 9).
• Giving a contract expert ownership of the report. Ownership rests with regular Internal Audit functionaries in all cases (para 39).

Checklist

• Confirmed with compliance whether the entity falls in para 3
• Read circular DoS.CO.PPG.66/11.01.005/2026-27 for what was repealed
• Know the maximum low-risk exclusion period and closure timelines in your own policy
• Listed pending high and medium risk paras for your area, with owners and dates
• Looked for repeat observations and fixed the process behind them
• Told audit about new products and changes in reporting lines
• Kept the risk team’s ratings distinct from audit’s independent assessment
• Raised with compliance any sign that the HIA carries business targets, or that audit staff pay is linked to the business lines they audit