RBI consolidates governance norms for risk, compliance and audit functions

The Reserve Bank of India (RBI) on Wednesday consolidated regulatory instructions relating to risk management, compliance and internal audit functions for commercial banks, requiring lenders to establish dedicated control functions headed by a chief risk officer (CRO), chief compliance officer (CCO) and head of internal audit (HIA).

The amended directions will come into effect from January 1, 2027.

Under the revised directions, the CRO, CCO and HIA will ordinarily be appointed for a fixed tenure of at least three years, and any premature transfer or removal will require board approval.

The central bank said the three control functions must operate independently of business lines, remain free from business targets, and have unrestricted access to all business areas and records. Banks will also be required to frame board-approved policies defining the objectives, roles and responsibilities of each function.

The RBI has mandated that CROs, CCOs and HIAs be appointed from among senior officials not more than two levels below the managing director and chief executive officer (MD & CEO). They will report functionally to the board or the relevant board committee and administratively to the MD & CEO.

The directions require the three officials to meet the board or relevant board committee at least once every quarter without the presence of senior management. Their final performance review will also be carried out by the board or the respective board committee.

Under the revised framework, the CRO will be an invitee to meetings of credit sanction and approval committees without voting rights. Any decision to assume risk contrary to the CRO's advice, without adequate risk-mitigation measures, will have to be approved by the next higher authority in the delegation matrix and reported to the board or the risk management committee.

The RBI has also prescribed detailed responsibilities for compliance and internal audit functions. Banks will be required to maintain an annual compliance risk assessment and adopt a risk-based internal audit framework covering all significant activities, with high-risk areas subject to more frequent reviews.

Further, any appointment, reappointment, removal or exit of a CRO will have to be reported to the RBI within five working days. In the case of chief compliance officers and heads of internal audit, banks will have to provide prior intimation to the regulator.