"Our internal auditor already covers it": what RBI's concurrent audit mandate for NBFCs actually requires

A lending startup crosses ₹500 crore in assets, appoints a Big Four firm as internal auditor, and assumes the audit box is ticked. Eight months later an RBI inspection team asks for the daily transaction verification register for the previous quarter. There isn't one — because an internal audit reviewing processes quarterly is not the same thing as a concurrent audit verifying transactions as they happen. The gap is not a matter of degree. It is a different function, mandated by a different instruction, with a different reporting line, and RBI treats the absence of it as a supervisory finding, not a paperwork lapse.

The confusion is understandable. Both are "audit". Both are internal to the company. Both are conducted by chartered accountants. But under the Companies Act 2013 and the RBI's NBFC framework, they answer to different masters and serve different purposes — and an NBFC that runs one thinking it satisfies the other is exposed on both fronts.

What the law actually requires

Three separate instruments create three separate obligations, and an NBFC above the relevant thresholds is subject to all three simultaneously.

Statutory audit — Section 139, Companies Act 2013. Every company, NBFC or not, must appoint a statutory auditor at its first AGM for a term of five consecutive years. For NBFCs this is now layered with the Reserve Bank of India (Non-Banking Financial Companies – Statutory Audit) Directions, 2026, issued by the Department of Supervision on 31 July 2026. These Directions consolidate what was previously scattered across the April 2021 guidelines on appointment of Statutory Central Auditors and a series of subsequent clarifications. The operative point for this discussion: a concurrent auditor of an NBFC cannot be appointed as its Statutory Central Auditor or Statutory Auditor. The roles are mutually exclusive within the same entity. The 2026 Directions also impose a one-year cooling-off between non-audit assignments — Section 144 services, internal audit, special assignments — and appointment as statutory auditor, with tax audit, interim financial audit, statutory certifications and segment reporting carved out as not ordinarily conflicting. Audit firms are capped at eight concurrent NBFC statutory-audit mandates across the RBI-regulated universe.

Internal audit — Section 138, Companies Act 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014. Applies to every listed company; to every unlisted public company with paid-up capital of ₹50 crore or more, turnover of ₹200 crore or more, outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore, or outstanding deposits of ₹25 crore or more; and to every private company with turnover of ₹200 crore or more or outstanding borrowings exceeding ₹100 crore. Most NBFCs of any scale trip the borrowings threshold immediately, because borrowing is the business. The internal auditor is appointed by the Board, and the Audit Committee — where one exists under Section 177 — determines the scope, periodicity and methodology.

Concurrent audit — the RBI supervisory framework. This is where founders lose the thread, because concurrent audit does not sit in the Companies Act at all. It originates in RBI's supervisory instructions on control and assurance functions. RBI's Scale Based Regulation framework, introduced in October 2021 and now the operating architecture for the sector, places NBFCs into Base Layer, Middle Layer, Upper Layer and Top Layer, and pegs internal control expectations to layer. NBFCs in the Middle Layer and above are required to have an independent Internal Audit function, and RBI's guidance on Risk-Based Internal Audit — extended to NBFCs and UCBs by circular dated 3 February 2021 — mandates an RBIA framework for NBFC-Middle Layer and above with effect from 31 March 2022. Concurrent audit is the transaction-level arm of that assurance architecture, and RBI has consistently expected deposit-taking and larger asset-financing NBFCs to run one over high-risk functional areas: treasury operations, large-value credit sanctions and disbursements, and branch operations where cash and collateral move.

RBI issued a Draft Circular on Harmonisation and Consolidation of Instructions on Control and Assurance Functions for NBFCs in June 2026, which is the direction of travel: a single consolidated instruction covering compliance, internal audit and concurrent audit for the sector, replacing the current patchwork. The Urban Co-operative Banks (Concurrent Audit) Directions, 2026 issued in the same period give a clear template of what a codified concurrent audit mandate looks like — daily verification, defined coverage percentages, direct reporting to the Audit Committee.

Practical implications

The difference between the two functions is not academic, and it shows up in exactly the places that hurt.

Timing. Internal audit is retrospective and periodic — quarterly or half-yearly, testing whether controls operated as designed over a past period. Concurrent audit is contemporaneous. It examines transactions at or immediately after the point of occurrence, typically on a daily or weekly cycle, with the explicit purpose of catching an error while it can still be corrected rather than reporting it after the money has left.

Coverage. Internal audit works on a risk-based sample. Concurrent audit works on defined coverage thresholds — 100% of transactions above a value trigger, 100% of treasury deals, 100% of credit sanctions above a delegated authority limit. When RBI's inspection team asks what percentage of your quarter's disbursements above ₹1 crore were independently verified within seven days of disbursement, "we sampled 15%" is not an answer.

Reporting line. Internal audit reports to the Audit Committee. Concurrent audit reports to the Audit Committee too, but with a critical difference in cadence: material findings are escalated immediately, not held for the quarterly pack. A concurrent audit report that surfaces a fraud six weeks after the auditor found it defeats the function.

Consequences of getting it wrong. Under Section 138 read with Section 450 of the Companies Act, failure to appoint an internal auditor where required attracts a penalty of ₹10,000 on the company and every officer in default, with a further ₹1,000 per day of continuing default subject to a maximum of ₹2 lakh for the company and ₹50,000 for an officer. That is the small end. The RBI end is where the real exposure sits: supervisory findings on assurance-function deficiencies feed directly into the NBFC's supervisory rating, and a poor rating constrains the ability to raise deposits, restricts branch expansion, and in serious cases attracts business restrictions under Section 45-IA of the RBI Act 1934, up to cancellation of the Certificate of Registration. Section 58B of the RBI Act provides for fines and, for wilful contraventions, imprisonment.

There is also the audit-independence trap created by the 2026 Directions. An NBFC that has been using the same firm for concurrent audit and is now considering elevating them to statutory auditor cannot do it. If the firm is currently doing internal audit or another Section 144 service, a one-year cooling-off applies before statutory appointment. Firms and NBFCs that planned rotations without reading this will find themselves scrambling at the AGM.

Step-by-step: what to do

• Determine your layer under Scale Based Regulation. Base, Middle, Upper or Top. This determines whether an independent Internal Audit function and an RBIA framework are mandatory. Document the determination with the asset-size and activity workings behind it — RBI will ask for the basis, not the conclusion.
• Run the Section 138 test independently. Check paid-up capital, turnover, outstanding bank and PFI borrowings, and deposits against the Rule 13 thresholds. An NBFC can be Base Layer under RBI and still be caught by Section 138 through the ₹100 crore borrowings limb. These are two separate tests and both must be run.
• Map your high-risk areas for concurrent coverage. Treasury and investment operations, credit sanction and disbursement above the delegated authority limit, collections and cash handling at branches, KYC and onboarding, and any function where a single employee can both initiate and approve. Write the coverage percentage and value trigger for each into the audit charter.
• Appoint the concurrent auditor by Board resolution and check the conflict matrix first. Confirm the firm is not your statutory auditor and is not proposed as one, and that no partner has an interest that breaches Section 141 disqualifications. File the Board resolution in the minutes book under Section 118 with the scope annexed.
• Fix the reporting cadence in writing. Daily or weekly verification, monthly consolidated report to the Audit Committee, immediate escalation of any material finding to the Chairman of the Audit Committee within 24 hours. Put the escalation matrix in the engagement letter, not in an email.
• Build the evidence trail. Maintain the transaction verification register, the exception log with resolution status and closure dates, and the Audit Committee minutes recording that each report was tabled and each exception followed up. Reconstruction after an inspection notice is not credible and inspectors know it.
• Review the statutory auditor appointment against the 2026 Directions before the AGM. Check the concurrent-auditor exclusion, the one-year cooling-off on non-audit services, and the firm's existing mandate count against the eight-mandate ceiling. Get written confirmation from the firm on all three.

FAQ

Is concurrent audit mandatory for every NBFC?
No. It is driven by RBI's supervisory expectations linked to your Scale Based Regulation layer, deposit-taking status and risk profile — not by a single across-the-board threshold. Base Layer non-deposit-taking NBFCs are generally outside it. Middle Layer and above, and any deposit-taking NBFC, should assume it applies to high-risk functions and document the reasoning if they conclude otherwise.

Can the same firm do our internal audit and our concurrent audit?
Practically yes, but it collapses the independence you are trying to build, and under the RBI (NBFCs – Statutory Audit) Directions, 2026 it locks that firm out of statutory audit for a year afterwards. Separate the two.

Does a concurrent auditor's report go to MCA or RBI?
Neither, in the ordinary course. It goes to the Audit Committee and management. But RBI's inspection team will ask for the reports and the exception-closure evidence during an on-site inspection, and the statutory auditor will call for them under SA 610 when evaluating the work of internal audit.

We are a Base Layer NBFC with ₹120 crore in bank borrowings. What applies?
Section 138 internal audit applies to you, because you cross the ₹100 crore borrowings threshold under Rule 13 regardless of your RBI layer. Concurrent audit is likely not mandatory, but if you have treasury operations or branch cash handling, put a limited concurrent review over those functions anyway — it is far cheaper than the fraud it prevents.

For a compliance audit of your company, visit pvtltd.co

---

See Also

• "We're private, so Ind AS doesn't apply to us": What the ₹250 crore net worth threshold actually triggers
• "It's just an internal review": what actually triggers a forensic audit and how the findings end up in an NCLT petition or an FIR
• "The CA handles the tax audit": What Form 3CD actually reports about your company