There are two very different ways organisations approach an IS audit. In the first, a team turns up, runs some tools, hands over a report with plenty of red in it and everyone agrees to look at it properly later. The file lands in a shared folder. It gets opened again next year, when the same team turns up. In the second, somebody decides in advance what needs examining, why it matters and who fixes what by when. The report is the middle of the process, not the end of it.
The gap between them is not skill, but usually sequence. Teams start with the testing and work backwards to the paperwork, when the rules are written the other way round.
This guide covers how to conduct an IS audit as per RBI’s requirements: what has to exist before testing starts, who is allowed to do the work and what happens after the findings land.
What is an IS audit under RBI’s requirements?
An information systems (IS) audit is an independent examination of whether your technology controls actually work. And whether the controls do what the policy says they do. Under the Reserve Bank of India (Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, issued in Jul 2026, an IS audit sits inside the internal audit system rather than beside it. Its job is to identify risks arising from IT infrastructure and recommend how to reduce them, covering areas such as server architecture, local and wide area networks, physical and information security and telecommunications.
The scope includes the effectiveness of policy, the adequacy of internal controls, the state of business continuity and disaster recovery, and compliance with applicable legal and statutory requirements.
Who oversees and performs the IS audit?
Three parties share the work, and mixing them up is a common occurrence.
- Audit Committee of the Board (ACB): exercises oversight, approves the IS audit policy and reviews it at least annually. It also reviews critical IT, information security and cybersecurity issues and gives direction to management
- Internal audit: houses a separate function or dedicated resources with the right professional skills
- External specialists: may be engaged where internal skills are lacking, but accountability stays with the competent authority inside internal audit
Independence is the test that matters. Auditors must act independently of management in attitude and in appearance. A review performed by the same team responsible for the systems being audited can create an independence concern and should be avoided.
How to conduct an IS audit as per RBI’s requirements
It’s a good practice to follow the order below. Skipping ahead to testing is what creates rework.
1. Audit policy
Nothing starts without this. The policy must set out the mandate, purpose, authority, audit universe and periodicity. The ACB approves it and reviews it at least once a year. Treat it as the contract for the engagement. Everything downstream is measured against what this document says.
2. Audit universe
List what is auditable before deciding what gets audited. Applications, infrastructure, networks, data centre and disaster recovery sites, third-party hosted systems and the processes wrapped around them. An undocumented universe is how systems quietly stay out of scope for years.
3. Risk planning
Audit planning must follow a risk-based approach. Rank what you will examine by exposure, not by convenience or by what was easy to test last time.
Your annual IT risk assessment feeds this directly. Under the rules it is expected to serve as an input for information security auditors, so the two exercises should not be running in separate silos.
4. Audit team
Decide who does the work and confirm they are independent of the systems under review. Where you bring in external specialists, document how independence and accountability are handled in the engagement terms.
The ACB also needs adequately skilled people who can understand what the results actually mean.
5. Fieldwork
Use a proper mix of manual techniques and computer-assisted audit techniques (CAATs). CAATs earn their place in high-volume areas such as revenue leakage detection, treasury functions and monitoring customer transactions under anti-money laundering requirements.
Coverage should include the effectiveness of policy and oversight, the adequacy of processes and internal controls, and whether business continuity and disaster recovery arrangements genuinely work.
6. Closure loop
Findings go to the Board or ACB as set out in your framework. Management then decides what action to take.
The framework must clearly define compliance responsibilities, reporting lines, timelines for submitting compliance and who has authority to accept it. It must also provide audit-mode access for auditors and regulatory authorities. Findings without clear owners and timelines are one of the most common weaknesses in an otherwise sound audit.
How Often Should an IS Audit Be Conducted?
The periodicity of the exercise is ideally be based on size and operations but may be conducted at least once in a year.
Timing matters more than most teams realise. The audit should preferably be undertaken before the statutory audit, so the reports reach statutory auditors in time to be examined and commented on. Middle Layer and above entities are also encouraged to consider continuous auditing for critical systems, running control and risk assessments more frequently than once a year.
Conclusion
An IS audit is a governed process with a policy behind it, a risk-ranked plan, independent people doing the work and a closure trail that somebody can produce on request. Many entities already have the individual elements of the framework. What they lack is the sequence and the evidence that connects them. Fix the policy and the closure loop first, and the rest of the audit gets easier every cycle.
At CyberNX, our RBI Master Direction compliance services help banks, NBFCs and financial institutions work out how to conduct an IS audit as per RBI’s requirements and stay ready between cycles. As a CERT-In empanelled auditor, we support IS audit readiness, gap assessment, VAPT and remediation tracking. Talk to our experts and find out where your IS audit stands today.
How to conduct an IS audit as per RBI’s requirements FAQs
How often must an IS audit be conducted?
At least once a year, with the exact periodicity based on the size and operations of the entity. It should preferably be completed ahead of the statutory audit, so the findings are available to statutory auditors in time. Larger entities may also adopt continuous auditing for critical systems.
Can the audit be outsourced?
Partly. Where internal skills are lacking, external specialists with genuine IT and audit expertise may be appointed. Responsibility and accountability continue to rest with the competent authority within the internal audit function, and independence must be properly addressed in the engagement terms.
What does the audit have to cover?
At a minimum, the effectiveness of policy and oversight of IT systems, the adequacy of processes and internal controls, the effectiveness of business continuity and disaster recovery arrangements, and compliance with applicable legal and statutory requirements. Corrective action and follow-up form part of the scope, not a separate exercise.
Does RBI require an external auditor for an IS audit?
No. RBI does not universally need an external auditor for an IS audit. For applicable NBFCs, the IS Audit function/resources are to be maintained within Internal Audit, while external specialists may be engaged where the NBFC lacks the required skills. Where external resources are used, responsibility is with the competent authority within the Internal Audit function, and auditor independence must be properly addressed.
