top of page

Policy for Internal Audit. (Corporate Governance)

1. Introduction and Objectives

This Internal Audit Policy establishes the foundational framework for the Internal Audit (IA) function at SFT Finance as it commences operational activities. Acting as the "Third Line of Defence," the IA function provides independent, objective assurance and consulting services designed to add value and improve the organization’s operations.

This policy is strictly aligned with the latest Reserve Bank of India (RBI) guidelines for Non-Banking Financial Companies (NBFCs) and is structured to scale dynamically from operational launch through steady-state growth.

Primary Objectives:

  • Validate the design and operational effectiveness of internal controls across financial, operational, and IT domains prior to and immediately following the market launch.

  • Ensure strict adherence to RBI regulations, statutory laws, and Board-approved policies.

  • Provide the Audit Committee of the Board (ACB) with independent assurance regarding emerging risk exposures and the efficacy of mitigation strategies.

 

2. Scope of Internal Audit

The scope of the internal audit encompasses all activities, functions, and processes of the NBFC. For the initial launch phase and Year 1, the scope specifically includes, but is not limited to:

  • Core Operations: Loan origination, credit underwriting, documentation, disbursements, and early-stage collections.

  • Technology & Cybersecurity: Foundational IT infrastructure, access controls, data privacy, digital onboarding platforms, and business continuity planning.

  • Third-Party & Outsourcing: Oversight of critical outsourced activities, vendor partnerships, and service level agreements (SLAs) established for operations.

  • Regulatory Compliance: KYC/AML adherence, regulatory reporting, and statutory filings.

 

3. Governance, Independence, and Authority

To ensure unbiased and objective oversight, the Internal Audit function shall operate with absolute independence from the daily operations it audits.

  • Reporting Structure: The Head of Internal Audit (HIA) shall report functionally to the ACB and administratively to the Managing Director & CEO.

  • Unrestricted Access: The IA team and authorized external audit partners possess unrestricted, read-only access to all organizational systems, records, physical properties, and personnel necessary to execute their duties.

  • Audit Committee Composition:

    • The ACB shall comprise a minimum of three members, including at least two Independent Directors, in accordance with RBI mandates.

    • The ACB shall be chaired by an Independent Director possessing expertise in finance and risk management.

    • The Committee shall meet at least quarterly to review audit findings, risk ratings, and management's corrective actions.

 

4. Risk-Based Internal Audit (RBIA) Framework

The organization shall adopt a Risk-Based Internal Audit (RBIA) approach from Day 1 to ensure audit resources are deployed where they add the most value.

  • Risk Assessment: The HIA shall conduct a continuous risk assessment of all auditable entities, assigning baseline risk ratings (High, Medium, Low) based on potential financial, operational, and regulatory impacts.

  • Data-Driven Auditing: The IA function will utilize Computer-Assisted Audit Techniques (CAATs) and data analytics to monitor portfolio health and flag anomalies.

  • Dynamic Planning: The Annual Audit Plan shall remain fluid during the first year of operations, allowing the ACB to pivot audit focus based on early operational indicators and emerging risks.

 

5. Phased Audit Calendar

Given the nascent stage of the NBFC, the audit cycle is phased to support successful operational scaling and risk mitigation:

Phase / Frequency

Key Focus Areas

Primary Objective

Pre-Launch & Month 1

IT Systems, InfoSec, Vendor Contracts, Onboarding Workflows, Initial KYC checks.

Validate system readiness, access controls, and basic regulatory compliance before volume scaling.

Quarterly Audits

Loan disbursements, credit appraisals, early-stage collections, AML compliance.

Identify early operational bottlenecks and prevent high-risk exposures.

Half-Yearly Audits

Financial provisioning, regulatory reporting (XBRL/Returns), HR policies.

Ensure financial integrity and absolute regulatory adherence.

Annual Audits

Enterprise Risk Management framework, corporate governance, Board policy reviews.

Comprehensive health check and strategic alignment for the subsequent financial year.

 

6. Resourcing and Co-Sourcing Guidelines

To optimize expertise and operational efficiency during the foundational phase, the NBFC may adopt a co-sourced audit model.

  • Execution: Core governance and oversight remain with the internal HIA. Specialized execution (e.g., in-depth IT and Cybersecurity audits) may be outsourced to qualified external firms.

  • Compliance & Confidentiality: All external audit partners must be approved by the ACB, bound by strict non-disclosure agreements (NDAs), and remain fully compliant with RBI’s outsourcing directives for NBFCs.

 

7. Roles, Responsibilities, and Resolution Timelines

Effective audit resolution requires a coordinated effort between the IA function and operational management.

  • Head of Internal Audit (HIA): Responsible for developing the RBIA plan, overseeing co-sourced partners, executing audits, and delivering independent quarterly reports to the ACB.

  • Operational Management / Process Owners: Required to actively engage with the audit process. Management must provide documented responses and Corrective Action Plans (CAP) within 15 days of receiving a draft audit report.

  • Issue Resolution (SLAs): * All identified findings must be fully remediated within 90 days.

    • Any delays in the remediation of "Critical" or "High-Risk" findings will trigger an automatic escalation to the MD & CEO and the ACB for immediate intervention.

 

8. Policy Review and Continuous Improvement

As the NBFC scales its operations and product offerings, this policy will be reviewed dynamically. The ACB shall formally review and approve this policy at least annually. Updates will be incorporated to align with new RBI circulars, emerging market risks, technological advancements, and the expanding operational footprint of the organization.

Policy Approval

By signing below, the Board of Directors and Executive Management approve this foundational Internal Audit Policy, authorizing the Head of Internal Audit to immediately initiate pre-launch compliance and operational health checks.

 

​

bottom of page