The Risk-Based Internal Audit (RBIA) framework has been mandated by the Reserve Bank of India (RBI) for all deposit-taking Housing Finance Companies (HFCs), irrespective of their size, and for non-deposit-taking HFCs with asset size of ₹5,000 crore and above.

According to RBI, these entities must put an RBIA framework in place by June 30, 2022. The RBI had mandated an RBIA framework for non-banking finance companies in February 2021 in the backdrop of the troubles at Dewan Housing Finance Corporation Ltd and Reliance Home Finance. HFCs, which are also NBFCs, have now been brought under the ambit of this framework. According to the RBI, an independent and effective internal audit function presents vital assurance to the financial entity’s board and its senior management regarding the quality and effectiveness of the entity’s internal control, risk management, and governance framework. The internal audit function is needed to broadly assess and contribute to the overall development of the entity’s governance, risk management, and control processes using a systematic and disciplined approach. Thus the RBIA function is an integral part of solid corporate governance and can be considered as the third line of defense with management and risk management & compliance being the first two. The fundamental necessities for a robust internal audit function include adequate authority, proper stature, independence, adequate resources, and professional competence.

The RBI mandated the RBIA framework on February 3, 2021, for all deposit-taking NBFCs, irrespective of their size; all non-deposit taking NBFCs including the Core Investment Companies having an asset size of ₹5,000 crores or higher, and all Urban Co-operative Banks (UCBs) having an asset size of ₹500 crores or higher. The before-mentioned Supervised Entities must implement the RBIA framework by March 31, 2022.