The Reserve Bank of India (RBI) on July 31, 2026, issued the Reserve Bank of India (Commercial Banks - Internal Audit Function) Directions, 2026.
The following has been stated: -
•The Reserve Bank of India (Commercial Banks - Internal Audit Function) Directions, 2026 mandate commercial banks to adopt a Risk-Based Internal Audit (RBIA) framework.
•Bank Boards and Senior Management are required to establish strict governance oversight, approve risk policies, and maintain the functional independence of the Internal Audit Department.
•The framework requires independent risk assessments across all operational areas using a structured matrix that evaluates both inherent business risks and control risks.
•Audit scope, resource allocation, and transaction testing intensity are aligned with identified risk levels, while complete outsourcing of the internal audit function is prohibited.
•Finally, the directions specify key parameters for the Head of Internal Audit, including minimum tenure guidelines and direct reporting lines to ensure objectivity and avoid conflicts of interest.
These Directions shall come into effect immediately upon issuance.
The detailed directions are given in the document below.
[Notification No.: RBI/DoS/2026-27/413 DoS.CO.PPG.7/11.01.005/2026-27]
