Responsibility of Central Auditor vis-à-vis Branch Auditor in fully computerised bank :
Banks, which have high level of computerisation and centralisation, equally have a high level of decentralisation of processes and underlying
activities, e.g., in case of advances, the credit processing and accounting are centralised but at the same time there could be separate teams carrying out various parts of credit processing and day-to-day monitoring at the central level; and each team is aware of the specific part of activity only. The central auditor’s biggest challenge is to first get acquainted with all the decentralised processes and activities and then to co-ordinate with the relevant persons for the required information. Normally, the central auditor uses the work of an expert for reviewing the computerisation processes and systems, especially in case of core banking system. The findings and reservations, if any, of an expert should be communicated to the other joint auditors. Similarly, the central auditor may consider necessary to communicate the findings and reservations, if any, of an expert to branch auditors to review certain specific aspects at the branch level. This will not only aid in enhancing the control review process of an audit but also enable the central auditor as well as the branch auditors to formulate their audit methodology and sampling techniques.
It may also be noted that foreign banks in India are largely guided by global policies, processes and systems (including IT systems) with some level
of customisations to meet the local requirements. In some foreign banks, even the IT systems (hubs, servers, etc.) and monitoring thereof (periodic system audit, etc.) are centralised in other countries and no country-specific-process documentation and periodic validations are prescribed by that foreign bank. Therefore, the local IT teams may at the time of an audit not be in a position to explain the basic configuration of accounting systems and how the local requirements are in-built in the global systems. In some other banks, the primary accounting records are maintained as per global reporting standards and the local financial statements are extracted from those records. Further, the scope of internal auditors and system auditors, etc., is decided on the global basis rather than on country basis. Such high level of globalisation poses big challenge for the local auditors and they have to largely rely on the past consistent globally accepted practices and then to base their audit opinion on explanations and representations coupled with test of controls and substantive checking to the extent possible. Of course these banks are also required to adhere to the guidelines of the RBI with regard to computerisation and the checks and controls around it.
Generally, the branch auditors do not have access to the overall IT policy, processes, controls and accounting procedures implemented by the
bank. Moreover, the branch auditors confront following practical issues at fully computerised branches:
Accounting manual, entries, calculations and framework is built in computerised accounting systems.
Critical IT and manual controls are centralised at HO level.
Limited access to periodical MIS and exception reports generated by the system.
Documentation of critical processes performed for accounting and book keeping (IT and Manual).
Access to primary records and entry level transactions.
Audit sampling.
Hard copies of transactions.
Independent IT Audit at branches, etc.
The overall review of IT environment and of the computerised accounting system has to be taken up at central level. The management plays a more proactive role to ensure that the computerised accounting systems are working properly and effectively. It is for the central auditor to review whether
the management is performing this role effectively. The roles and responsibilities of bank, the central auditor and the branch auditors can be
enumerated as under.