PUNJAB NATIONAL BANK

INSPECTION AND AUDIT DIVISION HEAD OFFICE


Annexure - II

eTHIC- SOP for Risk Based

Concurrent Audit (RBCA)

INSPECTION & AUDIT DIVISION HEAD OFFICE,

PLOT NO 5, SECTOR 32, GURUGRAM 122001

Page 21 of 33
Standard Operating Procedure (SOP) for Risk Based Internal Audit (RBIA) and Risk Based Concurrent
Audit (RBCA) by IAD H.O.
“CONFIDENTIAL STRICTLY FOR INTERNAL CIRCULATION ONLY”
 PUNJAB NATIONAL BANK
INSPECTION AND AUDIT DIVISION HEAD OFFICE
Process Flow of RBCA:

S. N. Process User Level

1 Audit Assignment  ZAO Admin Maker
2 Audit Execution:  Concurrent Auditor
Area Wise Audit Observations
Account Wise Audit Observations
3 Monthly Report Release (for first two  Concurrent Auditor
months of any quarter)
4 Monthly Audit Compliance  Branch Maker
 Branch Authorizer
 Concurrent Auditor
5 Datasheet Entry  Concurrent Auditor
6 Monthly Report Closure  Concurrent Auditor
7 Draft Risk Rating (Quarterly)  Concurrent Auditor
8 Monthly Report Release (for third  Concurrent Auditor
month of the quarter)
9 Final Risk Rating (Quarterly)  ZAO Maker (PRC)
10 Quarterly Report Release  ZAO Maker (PRC)
11 Quarterly Audit Compliance  Branch Maker
 Branch Authorizer
 Concurrent Auditor
 ZAO Maker (PRC)
 ZAO Authorizer
12 Dropping of indivdual Observations  ZAO Authorizer
13 Quarterly Report Closure  ZAO Maker (PRC)
 ZAO Authorizer

Page 22 of 33
Standard Operating Procedure (SOP) for Risk Based Internal Audit (RBIA) and Risk Based Concurrent
Audit (RBCA) by IAD H.O.
“CONFIDENTIAL STRICTLY FOR INTERNAL CIRCULATION ONLY”
 PUNJAB NATIONAL BANK
INSPECTION AND AUDIT DIVISION HEAD OFFICE
Login and Module Selection in eTHIC:

Step URL/Path Remarks

Login [Link]  Login to the application by entering correct login

4:8181/PNBeTHIC credentials.
/[Link]
 The system will prompt for changing password
when you login for the first time.

Module  Select required module from :

Selection
 Risk Based Internal Audit (RBIA)
 Concurrent Audit System (RBCA)
 Offsite Surveillance System (OSS)
 Credit Audit

Audit Assignment and Change of Auditor by ZAO Admin User:

Step URL/Path Remarks

Audit Audit Audit  Select the circle and branch and click on “Assign
Assignment Assignment Audit”

 Select the concurrent auditor (team leader) and

team members, if any. In case of CA firms, the
main partner may be the team leader and the
articles may be team members. Similarly, in case
more than one ERO or existing staff are appointed
for concurrent audit of a branch, the senior most will
be the team leader and others may be added as
team members.

 The “New Accounts from date” is the date from

which audit is assigned. It will be the month/quarter
start date for all branches, unless the concurrent
audit is planned on some other date.

Page 23 of 33
Standard Operating Procedure (SOP) for Risk Based Internal Audit (RBIA) and Risk Based Concurrent
Audit (RBCA) by IAD H.O.
“CONFIDENTIAL STRICTLY FOR INTERNAL CIRCULATION ONLY”
 PUNJAB NATIONAL BANK
INSPECTION AND AUDIT DIVISION HEAD OFFICE

Change of Audit Change of  This menu is to be used in case there is a change in

Auditor Auditor the concurrent auditor for any branch

 Select the Circle Office and the auditee office

branch) and press PROCEED

 Tick the small tick box (Change button) and enter

details of new auditor in team leader and team
members, if any. Also enter the schedule from date.

Monthly Audit Process Flow:

Step URL/Path Remarks

Audit AuditAudit To record the audit observations in eTHIC, auditor

observation Execution may select any one of the following modes:

1. Area Wise Audit Observations

2. Account Wise Audit Observations

Area Wise Audit AuditAudit This menu is to be used to do irregularity based audit.
Observations Execution It consists of the following sub-menus:
Area Wise Audit
Observations j) Product based - To be used wherever total no. of
accounts is more than the checklists applicable for
individual accounts. For example, KCC accounts,
Govt. Sponsored accounts, Gold Loan Accounts,
etc.

k) Insurance Expired Accounts - To be used for

accounts where insurance of
hypothecated/mortgaged assets in accounts has
expired during the current audit month.

l) Limit Expired Accounts - To be used for accounts

whose sanction limit has expired during the current
audit month.

m) Limitation Expired Accounts - To be used for

accounts where limitation in accounts has expired
during the current audit month.

Page 24 of 33
Standard Operating Procedure (SOP) for Risk Based Internal Audit (RBIA) and Risk Based Concurrent
Audit (RBCA) by IAD H.O.
“CONFIDENTIAL STRICTLY FOR INTERNAL CIRCULATION ONLY”
 PUNJAB NATIONAL BANK
INSPECTION AND AUDIT DIVISION HEAD OFFICE
n) Operational Risk Checklists– Contains checklists
related to non credit functions and some general
credit functions.

o) NPA Accounts - To be used for sub standard

accounts that have become NPA in current month.

Account Wise AuditAudit This menu is to be used to go directly to the loan

Audit Execution accounts for providing observations. It consists of the
Observations Account Wise following sub-menus:
Audit
Observations a) Account based for scheme wise classification) - It
is preferable to select account based search option
when specific type of account product such as
Cash Credit, Overdraft, Housing Loan, etc is to be
selected.

b) Customer based for customer ID wise

classification) - For classification of accounts
based on customer ID, we may go for Customer
Based search option. It is specially recommended
where a single customer may be availing multiple
credit facilities.

c) Stock Verification/Unit Visit - To be used for

accounts where stock verification/unit visits have
been conducted by the auditor.

 In order to mark accounts for unit visit, go to

AuditAccount Details Unit visit Marking-
Month wise

 Select “month” and “year” and then press

PROCEED.

 Select the account from the list provided and click

on SAVE.

 All the saved accounts will reflect in Stock

verification/unit visit tab

Page 25 of 33
Standard Operating Procedure (SOP) for Risk Based Internal Audit (RBIA) and Risk Based Concurrent
Audit (RBCA) by IAD H.O.
“CONFIDENTIAL STRICTLY FOR INTERNAL CIRCULATION ONLY”
 PUNJAB NATIONAL BANK
INSPECTION AND AUDIT DIVISION HEAD OFFICE

Guidelines for recording observations on checklists:

 Reply to any checklist may be marked as “YES”, “NO” or “NA” as applicable through
the drop down box.

 “YES” means that particular checklist is complied with (risk score will be 1); “NO” means
that particular checklist is not complied with and there is some irregularity to be reported
(risk score will be 2-10); “NA” means that that particular checklist is not applicable to the
type of advance in question (risk score will be 0).

 If “NO” is selected; a pop-up screen will be displayed for entering remarks.

 There is also an option to upload any documents, excels, other files if required.

 For the first time the pending irregularities of previous inspection reports will have to be
entered manually in eTHIC while marking audit observations. For this purpose kindly mark
your observations against applicable checklists in accounts which have pending
irregularities as per previous inspection reports.

 If any account reflecting in audit has pending irregularity, kindly mention

specifically that the irregularity was pointed out in previous inspection report also.

 If any income leakage has been detected by the auditor, they can enter the same within
the observation box under “Income leakage” button provided in the checklists.

 Once a checklist is successfully saved, its font colour will turn green. Once all
observations of a particular account are saved, the account will also turn green (fully
saved account). For partially saved account the colour is red while unsaved account
reflects in black colour.

 Repeat the above process until the audit observations for all the accounts have been
entered.

 Please ensure saving the data at regular intervals so that the same is stored in the
software in case of Session Logout/Expiry. Presently, after 30 minutes of inactivity
the session expires. For the last 3 minutes out of 30 minutes inactivity period, a
timer is displayed on the screen, showing that the session will expire after the
seconds’ countdown (starting from 180) is over.

Page 26 of 33
Standard Operating Procedure (SOP) for Risk Based Internal Audit (RBIA) and Risk Based Concurrent
Audit (RBCA) by IAD H.O.
“CONFIDENTIAL STRICTLY FOR INTERNAL CIRCULATION ONLY”
 PUNJAB NATIONAL BANK
INSPECTION AND AUDIT DIVISION HEAD OFFICE

Process of Fraud Reporting by Concurrent Auditor:

Fraud Reporting Audit Fraud  If any fraud is to be reported for the branch under
(Optional) Details- Month audit, the same may be done through this option.
Wise
 Enter the month and year in which fraud is to be
reported and click PROCEED.

 The following question will appear: “Any fraud

detected/surfaced during the month/”. Mark
YES and fill the details pertaining to the fraud.

Process of Monthly Report Release and Compliance:

Step Path Remarks

Monthly Report AuditReport  Select the month and year and press PROCEED.
Release (first ReleaseReport  Pendency prior to report release, if any, will
two months of Release-Month reflect on the screen
any quarter) Wise  Check all details reflecting on the report release
screen and press SAVE.

Branch Maker Audit  As soon as the auditor raises any observation in

Compliance Compliance concurrent audit, the same starts reflecting in
Auditee Maker compliance menu in Branch Maker ID (even prior
Compliance to monthly report release).
 Branch Maker to select the quarter in which
compliances are to be given.
 Each observation shows the month in which it has
been reported
 Irregularities may be filtered based on account,
area, risk category.
 Carry over points will also be available in this
screen for compliance.
 Branch Maker may select on the individual
checkbox or the Select All checkbox on the screen
to provide spot rectification remarks against
individual observation or total observations
respectively. Auditor comments may be viewed in
details tab.

Page 27 of 33
Standard Operating Procedure (SOP) for Risk Based Internal Audit (RBIA) and Risk Based Concurrent
Audit (RBCA) by IAD H.O.
“CONFIDENTIAL STRICTLY FOR INTERNAL CIRCULATION ONLY”
 PUNJAB NATIONAL BANK
INSPECTION AND AUDIT DIVISION HEAD OFFICE

Branch Checker Audit  Branch Checker will get the observations in which
Compliance Compliance compliance remarks have been entered by the
Auditee Checker branch maker for authorisation. He may accept the
Compliance compliance of branch maker (in which case it will
go to the concurrent auditor) or reject the same (in
which case it will go to the concurrent auditor).
 All other options and screen display will be the
same.

Concurrent Audit  Concurrent Auditor will get the observations where

Auditor Compliance compliance is authorised by the branch checker.
Compliance Concurrent He may accept the compliance of branch (in which
Auditor case it will get dropped) or reject the same (in
Compliance which case it will go to the branch maker).
 After all compliances are dropped, concurrent
auditor may close the monthly audit of the branch
(only after report has been released for the
month).

Process of Quarterly Data Sheet Entry, Risk Rating and Report Release by Concurrent
Auditor:

Data Sheet AuditAudit  These data sheets reflect the business data of the
Entry ExecutionData auditee office. Most of the data points will be
Sheet Entry fetched automatically from CBS. Wherever data is
not fetched from CBS, auditors are required to fill
the data manually by collecting the information
from the auditee office.

 Select the relevant quarter for which datasheet

entry is to be done

 Click each data sheet as displayed on the left side

of the screen and enter the necessary information
in the data sheet.

 After ensuring that all the data are properly

entered, the data sheet should be saved.

 Saved Datasheets will reflect in “green colour”.

Page 28 of 33
Standard Operating Procedure (SOP) for Risk Based Internal Audit (RBIA) and Risk Based Concurrent
Audit (RBCA) by IAD H.O.
“CONFIDENTIAL STRICTLY FOR INTERNAL CIRCULATION ONLY”
 PUNJAB NATIONAL BANK
INSPECTION AND AUDIT DIVISION HEAD OFFICE

Draft Risk AuditRating  For business and control risk rating of the branch,
Rating Process Quarterly Draft the auditor will visit the above page to save the risk
Risk Rating score against various elements.

 If there is any pendency prior to risk rating it

will reflect on the screen

 On saving the risk score, we get the final risk rating

of the branch.

Monthly Report AuditReport  Select the month and year and press PROCEED.
Release ReleaseReport  Pendency prior to report release, if any, will
(quarter ending/ Release-Month reflect on the screen
third month of Wise  Check all details reflecting on the report release
any quarter) screen and press SAVE.

Steps for processing of Quarterly Audit Report at ZAO Level:

Step URL/Path Remarks

Final Risk Rating AuditRating  ZAO should check the Audit Observations,
Quarterly Final Datasheet Entry and Draft Risk Rating of the
Risk Rating branch for the quarter being processed and in case
of any discrepancy the same to be corrected prior
to final risk rating process.

 After final risk rating no changes will be

allowed.

Report Release AuditReport  After completion of final risk rating, the ZAO PRC
ReleaseQuart may do the report release so that the quarterly
erly Report compliance process can start.
Release/  The report release screen reflects the major audit
Submission details. It may be saved if all things are found in
order.

Page 29 of 33
Standard Operating Procedure (SOP) for Risk Based Internal Audit (RBIA) and Risk Based Concurrent
Audit (RBCA) by IAD H.O.
“CONFIDENTIAL STRICTLY FOR INTERNAL CIRCULATION ONLY”
 PUNJAB NATIONAL BANK
INSPECTION AND AUDIT DIVISION HEAD OFFICE
Steps for Compliances on Quarterly Basis:

Step Path Remarks

Branch Maker Audit  Branch Maker to complete compliances similar to

Compliance Compliance monthly audit
Auditee Maker
Compliance

Branch Audit  Branch Checker to complete compliances similar

Checker Compliance to monthly audit
Compliance Auditee Checker
Compliance

Concurrent Audit  Concurrent Auditor will get the observations

Auditor Compliance where compliance is authorised by the branch
Compliance Concurrent checker for vetting. He may accept the
Auditor compliance of branch (in which case it will go to
Compliance ZAO Maker) or reject the same (in which case it
will go to the Branch Maker).

ZAO Maker Audit  ZAO Maker will get the compliances vetted by
Compliance ComplianceZAO Concurrent Auditor.
Maker Compliance  He may accept the compliance (in which case it
will go to ZAO Checker) or reject the same (in
which case it will go to the Branch Maker).

ZAO Maker Audit  ZAO Checker will get the compliances accepted
Compliance ComplianceZAO by ZAO Maker
Maker Compliance  He may accept the compliance (in which case the
observation will get dropped) or reject the same
(in which case it will go to the Branch Maker).
 Once all/ minimum prescribed level of
observations are dropped, the quarterly report
may be closed.

Page 30 of 33
Standard Operating Procedure (SOP) for Risk Based Internal Audit (RBIA) and Risk Based Concurrent
Audit (RBCA) by IAD H.O.
“CONFIDENTIAL STRICTLY FOR INTERNAL CIRCULATION ONLY”
 PUNJAB NATIONAL BANK
INSPECTION AND AUDIT DIVISION HEAD OFFICE

Common Problems faced by Auditors in RBCA (FAQ):

S. N. Problem statement Resolution
1 What is the process flow LoginSelect branchAudit
of Concurrent Audit to 1. Audit ExecutionArea wise account observations
be followed by Auditor 2. Audit ExecutionAccount wise audit observations
3. Audit ExecutionReport Release (for first two
months of a quarter)
4. Audit ExecutionDatasheet Entry (at the time of
quarter end)
5. Audit ExecutionRatingQuarterly draft risk
rating (at the time of quarter end)
6. Audit ExecutionReport Release (for last month
of the quarter)
2 I am trying to upload  This may occur due to two reasons:
document in 1. You have not selected any account from the list
insurance/limitation/limit appearing at the top in the pop up box. Select the
/NPA based tabs but it required accounts out of the list of accounts
says “Select atleast one displayed.
account” 2. There are no accounts for that particular tab, in
which case the pop up box will also give a
message in red colour “No Account Found”. If
there are no accounts, then you will not be able to
upload any document in that particular tab but you
may do so against relevant checklist in operational
risk tab
3 I am not getting any  This is a bug in the application.
account in New  Change the selection from “New Accounts” to
Accounts for the current “Existing/Old Accounts”. Now again change back
month to “New Accounts”
 Now check the scheme codes. Accounts will reflect
after selection of relevant scheme code.

4 I am not getting any This may occur due to two reasons:

accounts in 1. There are no accounts pertaining to these heads in
insurance/limitation/limit CBS/MISD. eTHIC fetches data from MISD. If the
/NPA based tabs data is not present in MISD database then it will
also not be a part of eTHIC.
2. There is some technical issue/bug due to which the
accounts though available in CBS/MISD are not
reflecting in eTHIC. Report to your ZAO nodal
officer who will escalate the issue to eTHIC team
at HO.

Page 31 of 33
Standard Operating Procedure (SOP) for Risk Based Internal Audit (RBIA) and Risk Based Concurrent
Audit (RBCA) by IAD H.O.
“CONFIDENTIAL STRICTLY FOR INTERNAL CIRCULATION ONLY”
 PUNJAB NATIONAL BANK
INSPECTION AND AUDIT DIVISION HEAD OFFICE
5 I am not getting This may occur due to:
checklists when I click 1. The sanction type of the account has not been
on the account in selected. Select sanction type of the account in the
account wise audit main page of account based audit observation
observations table.
2. There is an issue with network speed and
connectivity at local level or the server as a whole
is down. Local network issues may be reported to
IT team at Circle Office under whose purview the
branch falls.
3. There is some technical issue/bug in the system.
Report to your ZAO nodal officer who will escalate
the issue to eTHIC team at HO.
6 Do I have to fill  Datasheet entry is to be done on a quarterly basis.
datasheets each month
7 Will quarter wise data be  Data in datasheets will have to be filled manually
auto-filled in datasheets by auditor for the time being.
8 When should I do the  Draft Risk Rating is to be done on a quarterly basis.
draft risk rating
9 During report release I  This occurs when operational risk checklists (in
am getting a message “ area wise audit observations) for that particular
some general remarks month have not been fully saved.
are pending”  Go to area wise audit observationsoperational
risk save all checklists pertaining to the month
whose report is to be released and proceed with
report release.
10 During Report Release I  Some accounts/checklists may be left unaudited or
am getting a message partially audited. Check in both account wise and
“Some area wise audit observations and save any
accounts/checklists are previously unsaved/partially saved
not taken up for audit. accounts/checklists.
Please save all!!!”
11 During Report Release I  Kindly release the report of prior months before
am getting a message report release for current month.
“Previous month report
not released” Note: If your branch is one of the 21 branches
where concurrent audit module was made live on
pilot basis since 01.03.2021, then kindly complete
audit of March 2021 and do report release prior to
report release of April 2021.

Page 32 of 33
Standard Operating Procedure (SOP) for Risk Based Internal Audit (RBIA) and Risk Based Concurrent
Audit (RBCA) by IAD H.O.
“CONFIDENTIAL STRICTLY FOR INTERNAL CIRCULATION ONLY”
 PUNJAB NATIONAL BANK
INSPECTION AND AUDIT DIVISION HEAD OFFICE
12 During Report Release, I  This happens if the concurrent audit for that month
am getting a message has not been assigned to the auditor in eTHIC.
“Report release can be During audit assignment by ZAO if the “New
done for the assigned Account from Date” should ideally be the first day
month only” of the quarter from which audit is assigned.

 If audit has not been assigned to you for a

particular month/quarter, kindly do not save
observations for that month even if system is
reflecting data of that month. For example if you
have been assigned audit from 01.04.2021 and
you save observations in the month of March 2021,
you will be unable to do report release of April as
the message will be that previous month report is
not released.
 Further, when you try to do report release of
March, you will get the message that it is not
assigned to you.
13 Do I have to release  No, the quarterly audit report will be released by
quarterly report also? ZAO. Auditor has to release monthly reports only.
However, prior to releasing the monthly report for
the last month of any quarter, both datasheet entry
and quarterly draft risk rating have to be completed
by the concurrent auditor.

Page 33 of 33
Standard Operating Procedure (SOP) for Risk Based Internal Audit (RBIA) and Risk Based Concurrent
Audit (RBCA) by IAD H.O.
“CONFIDENTIAL STRICTLY FOR INTERNAL CIRCULATION ONLY”