RBI master-direction · 31 Jul 2026
RBI/DoS/2026-27/464 DoS.CO.PPG.58/11.01.005/2026-27 July 31, 2026 Reserve Bank of India (Non-Banking Financial Companies - Internal Audit Function) Directions, 2026 Table of Contents Introduction Chapter I - Preliminary A. Short Title and Commencement B. Applicability C. Definitions Chapter II - Governance and Oversigh…
RBI/DoS/2026-27/464 DoS.CO.PPG.58/11.01.005/2026-27 July 31, 2026
Reserve Bank of India (Non-Banking Financial Companies - Internal Audit Function) Directions, 2026
Table of Contents
Introduction Chapter I - Preliminary A. Short Title and Commencement B. Applicability C. Definitions Chapter II - Governance and Oversight A. Role of the Board B. Role of the Senior Management Chapter III - Risk-Based Internal Audit Framework A. Policy on Internal Audit B. Objectives and Scope C. Authority, Stature, and Independence D. Risk Assessment E. Audit Plan F. Monitoring of Compliance G. Outsourcing Chapter IV - Head of Internal Audit A. Authority, Stature, and Independence B. Tenure C. Reporting Line Chapter V - Repeal and Other Provisions A. Repeal and Saving B. Application of Other Laws Not barred C. Interpretations
Introduction
An independent and effective Internal Audit function is integral to sound corporate governance in Non-Banking Financial Companies and provides assurance to the Board and senior management on the adequacy and effectiveness of internal controls, risk management, and governance. Given the commonality of risks faced by Non-Banking Financial Companies, there is a need for harmonised Internal Audit systems and processes based on uniform guiding principles. Risk-Based Internal Audit (RBIA) framework, as the third line of defence, is intended to strengthen the effectiveness of Internal Audit systems and processes in Non-Banking Financial Companies.
In exercise of the powers conferred by Sections 45-JA, 45-L, 45-M and 45-MA of the Reserve Bank of India Act, 1934, Section 6 of the Factoring Regulation Act, 2011 and Sections 29-A, 30-A, and 32 of the National Housing Bank Act, 1987, and all other provisions / laws enabling the Reserve Bank of India (‘RBI’) in this regard, RBI being satisfied that it is necessary and expedient in the public interest so to do, hereby, issues Directions hereinafter specified.
Chapter I - Preliminary
A. Short Title and Commencement
These Directions shall be called the Reserve Bank of India (Non-Banking Financial Companies - Internal Audit Function) Directions, 2026.
These Directions shall come into effect immediately upon issuance.
B. Applicability
C. Definitions
Chapter II - Governance and Oversight
A. Role of the Board
The Board / Audit Committee of Board (ACB) of the NBFC shall be primarily responsible for overseeing the Internal Audit function. It shall approve a RBIA plan to determine the priorities of the Internal Audit function based on the level and direction of risk, consistent with the NBFC’s goals.
The Board / ACB shall review the performance of RBIA. The Board / ACB should formulate and maintain a quality assurance and improvement program that covers all aspects of the Internal Audit function. The quality assurance program may include assessment of the Internal Audit function at least once a year for adherence to the Internal Audit policy, objectives, and expected outcomes.
The Board / ACB shall promote the use of new audit tools / new technologies for reducing the extent of manual monitoring / transaction testing / compliance monitoring.
The Board should prescribe a minimum period of service for staff in the Internal Audit function except for those NBFCs where the Internal Audit function is a specialised function and managed by career internal auditors. The Board may also examine the feasibility of prescribing at least one stint of service in the Internal Audit function for those staff possessing specialised knowledge useful for the audit function, but who are posted in other areas, so as to have adequate skills for the staff in the Internal Audit function.
B. Role of the Senior Management
The senior management is responsible for ensuring adherence to the Internal Audit Policy as approved by the Board and development of an effective internal control function that identifies, measures, monitors, and reports all risks faced. It shall ensure that appropriate action is taken on the Internal Audit findings within given timelines and status on closure of audit reports is placed before the Board / ACB.
The senior management shall be responsible for establishing a comprehensive and independent Internal Audit function which should promote accountability and transparency. It shall ensure that the Internal Audit function is adequately staffed with skilled personnel of right aptitude and attitude who are periodically trained to update their knowledge, skill, and competencies.
The senior management shall, based on inputs from all forms of audit, present a consolidated position of major risks faced by the NBFC at least annually to the Board / ACB.
Chapter III - Risk-Based Internal Audit Framework
A. Policy on Internal Audit
The Risk-Based Internal Audit (RBIA) Framework relies broadly on a well-defined policy for Internal Audit, functional independence with sufficient standing, effective channels of communication and adequate audit resources with sufficient professional competence.
The Board approved policy shall clearly document the purpose, authority, and responsibility of the internal audit activity, with a clear demarcation of the role and expectations from Risk Management function and Risk Based Internal Audit function. The policy should be consistent with the size and nature of the business undertaken, the complexity of operations and should factor in the key attributes of Internal Audit function relating to independence, objectivity, professional ethics, and accountability.
The policy should also lay down the maximum time period beyond which even the low-risk business activities / locations would not remain excluded for audit.
The policy should be reviewed periodically and disseminated widely within the organisation.
B. Objectives and Scope
RBIA as an effective audit methodology should link the NBFC's overall risk management framework and provide assurance to the Board and the senior management on the quality and effectiveness of the NBFC’s internal controls, risk management, and governance related systems and processes.
The Internal Audit function should assess and contribute to the overall improvement of the NBFC’s governance, risk management, and control processes using a systematic and disciplined approach. It should work on the basis of established policies and procedures as approved by the Board / ACB.
RBIA, in addition to selective transaction testing, shall include an evaluation of the risk management systems and control procedures in various areas of operations, which will also help in anticipating areas of potential risks and mitigating such risks.
While the Risk Management function should focus on identification, measurement, monitoring, and management of risks, development of risk policies and procedures, and use of risk management models, RBIA should undertake an independent risk assessment for the purpose of formulating a risk-based audit plan which considers the inherent business risks emanating from an activity / location and the effectiveness of the control systems for monitoring such inherent risks.
The Internal Audit function should assess and make appropriate recommendations to improve the governance processes on business decision making, risk management and control; promote appropriate ethics and values within the NBFC; and ensure effective performance management and staff accountability.
