Module 6
MODULE 6: APPENDIX 2: ATM AUDIT
CHECKLIST
To be filled by participants
DutiesSegregation of
Completeness
Authorisation
Accuracy
Validity
Illustrative Control Objectives prepared based on
RBI guidelines for ATM and adapted as per COBIT
guide on Application Audit.
COBIT GUIDE ON
RBI GUIDELINES APPLICATION AUDIT
A) Frequent Breakdowns
Whether periodic visits are made by ATM Channel
Manager?
Whether monitoring of uptime is done on real-time
basis by bank?
Whether online System for enabling immediate
notification to vendor about breakdown is available?
Whether detailed servicing & replacement of system
of ATM's is done when required?
Whether system of periodic preventive maintenance
is available?
Whether corrective actions are taken on the basis of
root cause analysis?
Whether network penetration testing for ATM's is
conducted to check that they are on network or not?
B) Discrepancies in cash dispensation
Whether complaints related to cash dispensation
are resolved within 7 days or not?
1
Section 3
Whether online monitoring of ATM's having higher
dispenser problem is done by bank or not?
C) Cash-out
Whether regular monitoring and forecasting of cash
requirements is made by bank or not?
Whether ATM's are loaded with currency based on
the frequency of cash dispensation or not?
Whether cash levels are set and monitored at
intervals and when cash in the machine falls below
a pre-determined level, the vendor is informed to
replenish cash immediately or not?
Whether the message regarding non-availability of
cash in ATMs should be displayed before the
transaction is initiated by the customer either on the
screen or in any other manner or not?
D) Quality of Notes
Efforts are made to ensure that ATMs are loaded
with either newly minted or ATM fit notes?
Notes are sorted and processed on hi-tech note
sorting machines by agency custodians / vendors?
Agency custodians / vendors are imparted regular
training in this regard or not?
E) Access to grievance redressal mechanism
Whether systems are in place to provide smooth
access to grievance redressal mechanism for ATM
related complaints or not?
Whether the grievance redressal procedure is
displayed in the ATM premises or not?
Module 6
Whether bank has automated systems enabling
registration of ATM related complaint at any
branch / Call Centre by visit / call?
Whether the auto escalation of complaints is also
enabled in these systems which facilitate speedy
resolution of complaints?
F) Security measures
Care takers at offsite ATMs and sensitive locations
to discourage attempts to tamper with the ATM?
Arrangements with local police authorities for
regular beats in case of ATMs located in sensitive
areas?
Disabling cash retraction facility at ATMs as per RBI
guidelines in view of large number of frauds
committed by fraudsters taking advantage of this
facility?
Security Screen on the Machine requiring the
customer to confirm the digits entered?
Logging out of a customer in case of even a single
invalid pin?
Dip Card Readers (card is not swallowed by the
machine) pre-empt capture of data through
extraneous devices?
Analysis of complaints to identify complaint
prone ATMs and monitoring transaction at these
ATMs?
PIN entry for each and every transaction is
Mandatory?
G) Customer awareness & education measure?
Posters / notices containing safety tips on usage of
card / ATM are prominently displayed at the ATM
machines?
3
Section 3
Customers are provided with user manual / letter
along with the card at the time of card issue which
details on the safety guidelines for operating ATMs?
Customers are also imparted knowledge on safety
measures / precautions on ATM transactions
through print media and radio advertisements?
Feedback from customers through surveys/Phone
calls?
H) Others
The ATM ID may be displayed clearly in the ATM
premises to enable a customer to quote the same
while making a complaint / suggestion?
Banks are advised to make available the forms for
lodging ATM complaints within the ATM premises
and also display the name and phone number of the
officials with whom the complaint can be lodged?
Banks may make available sufficient toll-free phone
numbers for lodging complaints / reporting and
blocking lost cards to avoid delays and also attend
the requests on priority?
Local helpline numbers (city-wise / center wise)
should also be increased and should be prominently
displayed in the ATM premises / banks’ web-site?
Banks may proactively register the mobile
numbers / e-mail IDs of their customers for sending
alerts and also educate their customers to intimate
changes?
