BRANCH AUDIT in CEICAI

1

• BANK AUDIT in
• COMPUTERISED ENVIRONMENT
• THE OTHER SIDE OF AUDIT

2
Over the next 40 min
3
Effect of Computerisation

• Processing is Concentrated
• Audit Trails may be Undermined
• Human Judgment is bypassed
• Data are stored in Device-Oriented rather than
  Human-Oriented forms
• Invisible Data
• Stored data are Erasable
• Data are stored in a Compressed form
• Stored data are relatively accessible
• Computer Equipment is Powerful but Complex and
  Vulnerable

4
Effect of Computerisation

• Does computerisation help banks
• BASEL II Norms
• SOX Act/Clause 49
• ERM
• In prevention and early detection of frauds
  Broadly speaking there are (a) frauds in
  non-credit areas and (b) frauds in credit areas.

5
Effect of Computerisation

• In non-credit areas, frauds relate mainly to
  fraudulent encashment of cheques, withdrawal
  slips, refund orders, demand drafts, bankers
  cheques, misappropriation, as also fraudulent
  transactions entered by the banks staff in the
  branch books. Computerised systems will help in
  prevention, as also early detection, of frauds
  which will save banks precious funds

6
Effect of Computerisation
   
RISK
Br. Computer   Ar. not computer expert
Br. Manual Ar. May or may not computer expert
Br. Comp. Ar. Comp. expert
7
Over the next 30 min
8

• Where do we Start.
• As per AAS 8 20

9
Extent of Computerisation

• Partial Branch Automation (PBA)
• Total Branch Automation(TBA)
• Core Banking Solution(CBS)

Does it Mean that everything is computerised??
10
At a Glance-
11
SCOPE

• Coverage in Bank Branch Audit
• LFAR
• JILANI GHOSH COMMITTEE
• NPA Analysis
• Miscellaneous Issues

12
LFAR

• ADVANCES
• DOCUMENTS
• REVENUE
• MASTER FILE
• OPERATIONS

SECURITY
BACK UP
GENERAL ISSUES
13
LFAR -ADVANCES

• Changes in Interest Rates- to be given effect

14
LFAR -ADVANCES

• Master File
• Checking of the Parameters
• Interest Rate
• Drawing Power
• Penal Int
• SI
• Stock Statement submission ( some software )

Who Creates and who is authorised ( done by
sample )
15
OPERATIONS

• Whether all accounts (Opening Closing) are duly
  authorised.
• Whether all the GL accounts codes authorised by
  H.O. and are in existence in the system?
• Whether Beginning of the Day and End of the Day
  register maintained? Whether Time is properly
  entered and time and date are normal and during
  office hours only?

16
OPERATIONS

• Whether the Account Master and balance cannot be
  modified /amended /altered except by the
  authorised personnel?
• Whether the records of errors arising during
  daily operations are reported? And how they are
  rectified?
• Whether dummy accounts created using master
  creation still exist in the Branch
• A sample verification of SDRs / FDRs should be
  carried out to ascertain whether lien is marked
  on such deposit receipts in the system.

17
LFAR -SECURITY

• Physical Controls
• Logical Controls
• Environmental Controls

C
I
A
18
Lets Get Physical !!!
19
Environmental Controls

• What about man made Environmental problems??

20
Logical Controls-User ID-KAUN
21
Logical Controls
22
Logical Controls
PASSWORD-

• ISSUEUsers should change their passwords
  periodically.
• shud be inbuilt within the software so no need
  of checking, and it shud not accept previously
  used password
• ISSUE Sharing of password.
• Declaration to be taken
• Cross Verifying with attendance register and
  Access Log

23
PASSWORDS

• ISSUE Important passwords like DBA, Branch
  Managers are kept in sealed cover with Branch
  Manager
• -Checked by Physical Verification

24
LFAR-Security
OUTPUT CONTROLS-

• Hard Copy Print Out- Normally Ignored
• Screen Saver/Automatic Log Off
• Reports are signed Normally Ignored

25
LFAR-BACK UP

• Most Imp Issue
• Qualification
• A simple activity ignored

26
LFAR-BACK UP
27
LFAR-Done Miss this!!!

• Have the figures, as at the year-end, in the
  control and subsidiary records been reconciled?

• Balance reports e.g. GL Consistency report
  should be verified for balancing of books. And
  for those heads, which are not made live,
  balancing should still be verified with the help
  of balance books.

28

• JILANI GHOSH COMMITTEE

29
GHOSH COMMITTEE RECOMMENDATIONS

• Suggestion from preventive vigilance angle in
  computer installations.

• Activities of vendors to be monitored adequately,
  user IDs of retired / transferred staff, multiple
  user IDs should be controlled etc.

30
GHOSH COMMITTEE RECOMMENDATIONS

• Various tests to be carried out to ensure that
  EDP applications have resulted in consistent and
  reliable system for inputting, processing and
  generation of output of data.

• Manual calculations or black box checking by
  input of a dummy data.

31
MISCELLANEOUS

• Generally the software for D2K statement is
  different than the banking software and the data
  is to be manually fed, at least partially, into
  the same.

• Schedule of Advances (D2K statement or CA-19 in
  some banks), where categorization of advances
  into performing and non-performing, into secured
  and unsecured, into priority and non-priority
  etc. is done

32

• NPA ANALYSIS

33
NPA ANALYSIS-

• Issues
• Is the classification correct
• Is the calculation correct
• Is the provisioning correct
• Is the revenue charged on such accounts

34

• How do we check
• Going thru each account or sample
• Applying Various criteria of classification
• Relying on information provided by Branch

35
NPA ANALYSIS

• How Computerisation can help
• If it is in built in the software at the master
  level which is difficult
• So what shud we do to save time

36
NPA ANALYSIS

• Import the files in excel ( PBA,TBA)
• Convert the files in required format (Delimit)
• Apply Vlook up to match data
• Apply Filter,Sort,Mathematical Functions

Possible in EMI A/C,Term Loan
37

• MISCELLANEOUS ISSUES
• Exception Reporting
• Registers
• Miscellaneous Issues

38
Exception Report

• Debit /Credit balance change
• Maturity record deleted
• Inactive accounts reactivated
• Excess allowed over limit
• Debits to Income head accounts
• Overdue bills and bills returned
• Withdrawal against clearings
• Deposits accounts debit balance
• Temp O/D beyond sanction limit
• Standing instruction failed in day

39
REGISTERS-Our Tool

• User id register
• Floppy register
• Checksum register
• Software problem register
• Machine breakdown

40
REGISTERS

• Asset register containing details of hardware
• Manuals, guidelines
• Media stock movement register
• Hardware /software Register
• Parameter updation register

41
Miscellaneous
42
Is this the END.
43

• IT IS THE START !!!

• Comment that IS Audit should be conducted
• Comment that Conversion Audit should be conducted