NBFCs handle lending, asset finance, investments, borrower documentation, repayments, collections, and regulatory reporting. Regular audit reviews are important to maintain compliance, financial accuracy, and operational control.
An NBFC Audit Checklist helps auditors review key areas, including statutory compliance, RBI requirements, loan documentation, KYC records, asset classification, provisioning, branch controls, and fraud risk.
A proper NBFC internal audit checklist also helps identify gaps, reduce risk, and ensure timely corrective action. This blog covers the major areas to include in an NBFC audit checklist, including statutory compliance, financial verification, loan review, operational controls, and management reporting.
NBFC Audit Checklist for Compliance, Statutory Review, and Risk Control
An NBFC audit is important for assessing whether a Non-Banking Financial Company complies with regulatory requirements, maintains proper financial records, and manages operational risks effectively. Since NBFCs deal with lending, investments, borrower documentation, repayments, and recovery processes, a structured audit helps identify gaps before they become serious compliance or business issues.
A well-prepared NBFC Audit Checklist helps auditors systematically review statutory compliance, loan files, internal controls, branch operations, fraud risks, and management reporting. It also helps the audit team maintain consistency across branches and business units.
This blog covers a practical NBFC internal audit checklist for compliance, statutory review, financial verification, and risk control.
Statutory and Regulatory Compliance Checklist for NBFCs
Statutory and regulatory compliance is one of the key areas of an NBFC audit. The auditor must check whether the NBFC is following applicable RBI guidelines, Companies Act requirements, KYC norms, asset classification rules, provisioning norms, and reporting obligations.
A Checklist for the statutory audit of NBFC should include the review of registration documents, RBI returns, board approvals, policies, statutory registers, audit reports, and compliance certificates. The auditor should also verify whether regulatory submissions are completed within the required timelines.
The checklist for a statutory audit should generally cover:
- RBI registration and Certificate of Registration validity
- Compliance with applicable RBI Master Directions
- Filing of statutory and regulatory returns
- Board-approved policies for lending, recovery, KYC, and risk management
- Compliance with Companies Act requirements
- Review of audit observations
- Verification of KYC, AML, and fair practices code compliance
- Customer grievance redressal review
- Asset classification and provisioning compliance
- Documentation of board and committee approvals
A structured statutory review helps NBFCs reduce compliance risk and maintain better governance.
Financial, Investment, and Loan Verification Checklist for NBFC Audit
The financial and loan verification process is a key part of the NBFC audit checklist. Since lending and investment activities directly affect the NBFC's financial position, auditors must verify that all transactions are properly approved, recorded, classified, and monitored.
- Loan Sanction and Approval Review
The auditor should verify whether loans are sanctioned in accordance with the approved credit policy. This includes checking loan applications, approval notes, credit appraisal documents, borrower eligibility, repayment capacity, and sanction terms. The audit should confirm that proper authority has approved the loan and that any deviations are clearly documented and approved.
- Borrower KYC and Documentation Check
Borrower KYC is a critical part of the NBFC audit process. The auditor should check whether identity proof, address proof, PAN, income documents, bank statements, photographs, and other required documents are collected and verified. The audit should also check whether KYC documents are updated as per the required timelines and whether high-risk customers are properly identified.
- Loan Agreement and Repayment Terms Verification
The auditor should review loan agreements to confirm that interest rates, repayment schedules, tenure, processing fees, penal charges, and other terms are clearly mentioned. The repayment terms should match the sanctioned terms and system records. Any mismatch between the agreement, the sanction letter, and the loan management system should be reported as an audit observation.
- Investment and Securities Verification
NBFCs may hold investments in securities, bonds, mutual funds, or other instruments. The auditor should verify whether investments are made in accordance with the approved investment policy. The review should include investment approvals, valuation, income recognition, accounting treatment, and supporting documents. Physical or demat securities should also be verified wherever applicable.
- Asset Classification and NPA Review
Asset classification is a major area in NBFC audits. The auditor should check whether loan accounts are correctly classified as standard, overdue, sub-standard, doubtful, or loss assets in accordance with applicable RBI norms. NPA identification should be reviewed carefully to ensure there is no delay or incorrect classification. Any account showing repayment stress should be highlighted for management attention.
- Provisioning and Income Recognition Check
The auditor should verify whether provisioning is done correctly based on asset classification. Income recognition should also be reviewed to ensure that interest income is not wrongly booked on non-performing assets. This part of the NBFC Audit Checklist helps confirm that the financial statements accurately reflect the company’s loan portfolio and risk exposure.
- Related Party and Group Exposure Review
The auditor should review related-party transactions and group exposure to ensure they are properly approved, disclosed, and within permitted limits. This includes checking loans, investments, guarantees, advances, or other financial arrangements involving group companies, directors, promoters, or connected parties.
Operational Controls and Risk Management Checklist for NBFCs
Operational controls help an NBFC manage daily activities across branches, departments, field teams, and central operations. A strong NBFC internal audit checklist should cover internal controls, loan processing, branch activities, collateral checks, fraud monitoring, and corrective action tracking.
- Internal Control System Review
The auditor should assess whether the NBFC has proper internal controls for loan processing, cash handling, document storage, approvals, disbursement, collections, and reporting. The audit should also check whether duties are properly separated and whether key activities are reviewed by authorised personnel.
- Security and Collateral Verification
For secured loans, auditors should verify whether collateral details are properly recorded and supported by valid documents. This may include property papers, vehicle documents, hypothecation records, valuation reports, insurance documents, and security creation records. The audit should check whether the collateral value is sufficient and whether security documents are safely maintained.
- Hire Purchase and Asset Finance Review
For hire purchase or asset finance loans, the auditor should verify asset details, copies of invoices, ownership documents, insurance, repayment status, and repossession records, if applicable. The audit should also confirm whether financed assets are being used for the stated purpose and whether field verification has been completed.
- Branch and Field Audit Controls
Branch and field audits help identify operational gaps at the ground level. The auditor should review cash handling, customer interaction records, loan documents, collection practices, field visit reports, and branch-level registers. For NBFCs with multiple branches, a standard audit checklist helps maintain uniform review quality across all locations.
- Fraud Risk and Exception Monitoring
Fraud risk monitoring is an important part of the NBFC audit checklist. The auditor should review unusual transactions, repeated policy deviations, fake documents, duplicate borrowers, suspicious repayments, and abnormal collection patterns. Exception reports should be reviewed regularly to identify early warning signs and reduce financial loss.
- Audit Observation Tracking
Audit observations should not remain only in reports. The auditor should check whether previous audit findings are tracked, assigned to responsible teams, and closed within defined timelines. The checklist should include observation status, risk rating, department response, corrective action, and evidence of closure.
- Management Reporting and Corrective Action
Audit findings should be reported to management in a clear and structured format. High-risk observations should be escalated immediately. The audit team should also review whether corrective actions are implemented and whether repeated observations decrease over time. This helps improve governance and operational control across the NBFC.
A well-structured NBFC Audit Checklist helps auditors systematically review compliance, statutory requirements, financial records, loan documentation, branch controls, and risk areas.
For NBFCs, audit is not just about checking documents. It helps improve control, reduce risk, maintain regulatory discipline, and support better decision-making. By using a clear checklist for the statutory audit of NBFCs along with an internal audit checklist, NBFCs can strengthen compliance and improve operational efficiency across all branches and functions.
Use Audit360 NBFC Audit Software to manage audits, compliance, and corrective actions.
.svg){kind=small}