The brief
regional private-sector bank with eighteen branches across western India came to us with a simple but expensive problem. Concurrent audit findings were landing in monthly batches — sometimes weeks after the underlying transaction. By the time the audit committee saw an exception, recovery options had narrowed and reputational exposure had compounded.
Compounding the cadence issue was sample-based testing: roughly 23% of qualifying transactions were reviewed each month. RBI’s Risk-Based Supervision framework expects far more — particularly for banks of this scale — and the bank’s own audit committee had begun to ask whether the model was fit for purpose. The brief: rebuild the function so that exceptions surface within a working day, with full transaction coverage, and without expanding headcount.
The approach
Five phases, partner-led, calibrated to the engagement’s scale and risk. Each phase produced a deliverable the audit committee could see, and a workpaper trail an independent reviewer could follow.
-
01
Discovery
Two weeks on the ground at three pilot branches — mapping the actual transaction flow, the exception escalation paths, and the friction points in the existing workpaper trail.
-
02
Risk re-mapping
We redrew the bank’s risk map against RBI’s RBS framework, identified the eight transaction categories carrying 80% of the exception volume, and flagged the six that warranted continuous (rather than periodic) coverage.
-
03
Tooling & rule design
Designed the rule library that drives the daily exception feed — jointly with the bank’s IT team. 142 rules across credit, treasury and operations, each tied to a specific audit assertion.
-
04
Run-rate transition
Three months running both the legacy monthly batches and the new daily feed in parallel. Exceptions reconciled across both systems before the legacy track was retired.
-
05
Knowledge transfer
Workshops for the bank’s internal-audit, branch-operations and audit-committee teams. Documentation that lets the function run independently of any single auditor.
Engagement led personally from kick-off to opinion — single accountable point of contact for every audit-committee question across the 9-month rollout.
In their voice
We expected a better audit. We got a better operating model. The exception feed is now part of how the bank decides — not just how it reports.
The outcome
By month seven, the daily exception feed was the bank’s primary control mechanism. Mean time to flag an exception fell from 11 working days to one. Sample testing was retired entirely — the new model reviews 100% of transactions in the six categories that drive most of the risk.
The year-end statutory audit closed with zero concurrent-audit qualifications, and the audit committee now receives a single weekly dashboard rather than the monthly exception report it had been used to. Crucially, the operating cost of the function did not increase — the work was redistributed, not multiplied.
