The Reserve Bank of India (RBI) on July 31, 2026, issued the Reserve Bank of India (Small Finance Banks - Internal Audit Function) Directions, 2026.
The following has been stated: -
•This RBI notification sets out the Reserve Bank of India (Small Finance Banks - Internal Audit Function) Directions, 2026, which took effect on July 31, 2026, to establish a robust Risk-Based Internal Audit (RBIA) framework across all Small Finance Banks.
•Under these directions, bank Boards and Audit Committees must approve well-defined RBIA policies, risk assessment methodologies, and annual audit plans to ensure strong risk management and control oversight.
•The framework mandates functional independence for the Internal Audit Department, prohibiting performance-linked remuneration tied to business lines and forbidding the complete outsourcing of internal audit functions.
•It introduces a standardized risk matrix to evaluate inherent business and control risks, dictating audit frequency and requiring 100% transaction testing for areas categorized under high or extremely high risk.
•Additionally, the rules dictate that the Head of Internal Audit must be a senior executive appointed for a minimum three-year tenure, reporting directly to the Board or Audit Committee to ensure objective, uncompromised reporting.
These Directions shall come into effect immediately upon issuance.
The detailed directions are given in the document below.
[Notification No.: RBI/DoS/2026-27/422 DoS.CO.PPG.16/11.01.005/2026-27]
