The RBI (Small Finance Banks – Internal Audit Function) Directions, 2026 provide a framework for establishing an effective Risk-Based Internal Audit (RBIA) system in Small Finance Banks (SFBs) to strengthen governance, risk management, and internal controls. Banks must implement a Board-approved Internal Audit Policy, risk assessment methodology, and Annual Audit Plan (AAP), with the Board and Audit Committee of the Board (ACB) overseeing the effectiveness, independence, and performance of the Internal Audit Function.
The RBIA framework requires banks to identify and prioritise risks based on business activities, control effectiveness, and risk assessment matrices, ensuring greater audit focus on high-risk areas. The Internal Audit Department (IAD) must remain independent from operational functions, possess adequate resources and skilled personnel, and review areas including risk management, internal controls, fraud risks, compliance, data integrity, and transaction testing. The Head of Internal Audit (HIA) must have sufficient authority, independence, and direct access to the ACB/Board or senior management.
The Directions restrict outsourcing of the Internal Audit Function, while allowing engagement of external experts where specialised skills are required under proper supervision. The Directions repeal earlier internal audit guidelines for SFBs, preserve actions taken under previous frameworks, and clarify that they operate alongside other applicable laws, with RBI’s interpretation being final and binding.
