IS audit and RBI IT compliance for NBFCs
Know where you stand before the auditor, the Audit Committee or the RBI asks.
We review how your systems are governed and controlled: who can access what, how changes are approved, how data is protected, whether you could recover from an outage, and how your IT vendors are managed. For NBFCs, we test against the RBI's Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices. You get a findings register your Audit Committee can act on, with every finding referenced, risk-rated, evidenced and paired with a practical fix.
| Ref | Finding | Risk |
|---|---|---|
| AC-04 | Shared admin login on loan management systemAccess management | High |
| LG-02 | Database changes not logged for 90 daysAudit trail | High |
| BC-01 | DR restore last tested 14 months agoBCP and DR | Medium |
| CS-07 | TLS 1.0 still enabled on customer portalCybersecurity | Medium |
| IT-03 | Change approvals recorded on WhatsAppIT controls | Low |
What the RBI expects, in brief
The RBI issued the Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices on 7 November 2023, and it has applied since 1 April 2024. Among NBFCs, it covers those in the Top, Upper and Middle Layers under the Scale-Based Regulation framework (NBFC-Core Investment Companies are excluded), along with banks, credit information companies and all-India financial institutions.
Among other things, it expects:
- Board-level oversight: an IT Strategy Committee of at least three directors, chaired by an independent director with substantial IT expertise, meeting at least quarterly; and an IT Steering Committee of senior IT and business leaders, also meeting at least quarterly.
- Policies reviewed at least annually: IT, information security, cyber security and business continuity.
- A senior, independent CISO who does not report to the head of IT.
- Controlled access: access only for valid business needs, privileged activity logged and reviewed, and multi-factor authentication for privileged users of critical systems based on risk.
- Tested resilience: recovery objectives defined for critical systems, regular backup restoration tests, and DR drills for critical systems at least every six months.
- Vulnerability testing: vulnerability assessments at least every six months and penetration tests at least every twelve months for critical and customer-facing systems.
- Vendor risk management proportionate to risk, alongside the separate Master Direction on Outsourcing of IT Services (effective 1 October 2023).
- A risk-based IS audit programme overseen by the Audit Committee of the Board, under an IS Audit Policy reviewed at least annually. External auditors may be used where internal skills are lacking.
This is a summary for orientation, not legal advice. Read our full guide to the Master Direction →
What we audit
1. Audit planning and scope
We agree the entities, systems, locations and period in scope, the frameworks to test against (the IT governance Master Direction, the IT outsourcing Master Direction, your own policies), and who on your side owns each area. Scope follows risk: core lending or loan management systems, customer-facing apps, the data centre and DR site, and material IT vendors come first.
You receive: an audit plan and a document request list before fieldwork starts.
2. IT governance and controls
Board and committee structure, terms of reference and meeting records; IT strategy and its link to business plans; policy approvals and review dates; roles of the head of IT and the CISO; and IT risk management, including the IT risk section of your risk management policy.
3. Access management
User access to critical systems reconciled against HR records; joiner, mover and leaver processes; privileged accounts and how their activity is logged and reviewed; multi-factor authentication; shared and generic IDs; and periodic access reviews. Read: Access management and IT controls for NBFCs
4. Information security and cybersecurity
Security policy and its implementation; encryption of data at rest and in transit; patch and change management; end-of-support software; vulnerability assessment and penetration testing cadence and remediation; security monitoring and the security operations centre; and cyber incident response, including notification of CERT-In and the RBI as required.
5. Audit trails and logging
Whether critical applications record who did what and when, whether logs are monitored, protected from tampering and retained under a defined policy, and whether anyone actually reviews them.
6. Backup and recovery
Backup scope and frequency, protection of backups from unauthorised access, and evidence of periodic restoration tests, not just successful backup jobs.
7. Business continuity and disaster recovery
Recovery time and recovery point objectives for critical systems, and whether DR meets them. We look at how often DR drills run and what they cover, and at evidence of running operations from the DR site. We check whether DC and DR configurations and patches match, and whether issues from the last drill were fixed and retested. Read: BCP and DR testing for NBFCs
8. Vendor and outsourcing risk
Your IT outsourcing policy, materiality assessments, due diligence, contract clauses (audit rights, data location in India, incident reporting, exit), concentration risk, cloud arrangements and exit plans for material providers. Read: IT outsourcing and vendor risk for NBFCs
9. Audit evidence and documentation
Every test is backed by evidence: screenshots, system reports, configuration exports, logs, minutes or interviews. That evidence is referenced in our working papers, so a finding can be traced to its proof. Read: Preparing evidence for an IS audit
10. Findings register and recommendations
Each finding records the reference, the area, what we found, the evidence, the risk rating (high, medium or low) with reasons, the control or requirement it relates to, and a recommended fix your IT team can implement.
11. Final report and remediation follow-up
A report for the Audit Committee of the Board with an executive summary, the findings register and management's responses. When you're ready, we run a follow-up review to confirm that closed findings are actually closed before the next audit cycle.
How an IS audit with Orgits runs
- Scope: systems, entities, period, framework, owners.
- Collect evidence: policies, configurations, access lists, logs, minutes and interviews.
- Test controls: each control checked for design, and for whether it actually operated during the period.
- Discuss draft findings with system owners, so facts are agreed before ratings are final.
- Report: findings register, risk ratings, recommendations and management responses.
- Remediate: your team, or ours if you choose, closes the findings.
- Re-validate: a follow-up review before the next cycle.
What makes our IS audits different
- Auditors who also build. Our recommendations are written by people who implement systems, so they're specific enough for your IT team to act on.
- Help to fix, if you want it. We can close technical findings ourselves (access controls, logging, backups, cloud configuration) or work alongside your vendor.
- Independence handled openly. If we built or run a system in scope, we say so up front, so your Audit Committee can decide whether a separate auditor should cover it.
- CA-led leadership. Our IS Auditor, CA Sahil Goyal, is a chartered accountant.
What an IS audit is not
An IS audit gives an independent view of your controls at a point in time and over the period tested. It does not guarantee regulatory compliance, prevent an RBI inspection finding, or replace your management's responsibility for IT risk. Regulatory interpretations should be confirmed with your compliance and legal advisers.
Who we work with
- NBFCs in the Middle, Upper and Top Layers preparing for an annual IS audit or an RBI inspection.
- Fintechs and lending platforms that serve as technology or sourcing partners to regulated entities, and are asked to evidence their controls.
- Businesses outside RBI regulation that want an independent view of their IT risk.
An IS audit is an independent assessment of your controls at a point in time. It doesn't guarantee regulatory compliance.
This is general information, not legal, tax or audit advice. Requirements change. Check the current text of the regulation and speak to your adviser before acting.
Frequently asked questions
[1]Does the Master Direction apply to our NBFC?
It applies to NBFCs in the Top, Upper and Middle Layers. NBFC-Core Investment Companies are excluded, and Base Layer NBFCs are not among the entities listed. Check your classification with your compliance team. If you're in the Base Layer, an IS audit is still good practice, and some of your partners may ask for one.
[2]How often should we have an IS audit?
The Master Direction requires a risk-based IS audit programme under an IS Audit Policy approved by your Audit Committee, rather than setting a single fixed frequency. Your policy should define the periodicity for each area, usually more often for critical systems.
[3]Do you only audit systems you built?
No. Most of our audits cover systems built and run by other vendors or in-house teams. Where we did build a system in scope, we say so up front so you can decide whether a separate auditor is needed for independence.
[4]Can you help fix what the audit finds?
Yes. Because we also build and host software, we can close technical findings ourselves, or work alongside your existing vendor.
[5]What do you need from us?
A named coordinator, access to system owners, and the documents on our request list: policies, committee minutes, user lists, configuration reports, DR drill records, vendor contracts and the previous audit report. See our evidence guide.
[6]Is a cybersecurity audit the same as an IS audit?
No. A cybersecurity audit or VAPT tests technical security. An IS audit covers governance, controls, continuity and vendors as well, and uses VAPT results as evidence.
[7]How long does an IS audit take, and what does it cost?
Both depend on the number of systems, locations and vendors in scope. We quote a fixed fee after agreeing the scope.
Preparing for an IS audit?
Talk to our audit team about scope, evidence and timelines.