Treasury Internal Audit: Off-List Counterparty, ISIN Mismatch and a Breached Limit
IRFC's internal audit has reviewed treasury front office for Q3. Findings: (i) a ₹150 crore purchase of an 8.40% 2031 bond of an AAA-rated NBFC was executed with a counterparty absent from the board-approved counterparty list; (ii) the deal ticket was raised on trade date, but the confirmation memo was prepared on T+3, after the dealer had seen the custodian statement; (iii) the custodian reports a holding with ISIN ending 4471, while the counterparty's confirmation cites ISIN ending 4417; (iv) intra-day exposure to that counterparty touched ₹340 crore against a sanctioned limit of ₹200 crore, and the limit report is produced weekly by the same dealer who executes trades; (v) the bond is valued using the dealer's own mark. The dealer says the counterparty 'is a group entity of an approved name' and the ISIN is a typographical error. The audit committee meets in ten days.
1. Classify the findings and identify the fraud indicators and the additional procedures required before concluding.
Read the worked answer
Classification. Distinguish design deficiency from operating (compliance) failure:
- Design - segregation of duties: the dealer executes, monitors limits and provides the valuation mark. The control does not exist even in form.
- Design - counterparty onboarding: there is no pre-trade check against the approved list.
- Operating - the ₹200 crore limit was breached at ₹340 crore (70% overshoot); the weekly report cannot prevent an intra-day breach.
- Operating - the confirmation memo prepared on T+3, after sight of the custodian statement, defeats the purpose of an independent confirmation.
- Operating - valuation by the dealer's own mark violates the independent-price-source principle.
Fraud indicators (SA 240 red flags). The ISIN mismatch is the most serious: a difference in the last two digits can mean IRFC does not own the security it paid for. Combined with an off-list counterparty, a back-dated confirmation and a limit breach, the pattern is consistent with a deliberate override. 'Group entity of an approved name' is not an approval; approval lists are entity-specific.
Additional procedures before concluding.
- Obtain the custodian's statement directly, on a controlled basis, and match ISIN, quantity and value.
- Obtain the counterparty's confirmation directly (not via the dealer) and reconcile.
- Inspect the RTGS/SWIFT payment trail and the beneficiary account name.
- Compare the executed price with the market price on trade date to test for off-market transfer of value.
- Interview the back office and compliance independently of the dealer.
- Preserve the deal ticket, e-mails and chat records. Do not permit deletion or 'correction' of the ticket.
Until the ISIN is reconciled, treat the ₹150 crore as an unresolved exposure and escalate immediately - the ten-day gap to the audit committee is too long to wait.
2. Recommend the remediation controls, with owners and a realistic timeline.
Read the worked answer
Control framework - design the fix around prevention, detection and independence.
Prevention (30 days).
- Pre-trade compliance block in the treasury system: the counterparty must exist in the approved master with an unexpired limit and a valid ISDA and KYC record; the order cannot be released otherwise. Owner: Head of Treasury, with IT.
- Limit framework split into sanctioned, intra-day and settlement limits, with hard system stops. Owner: Risk.
- Dual authorisation on every deal ticket before release to the back office. Owner: Back Office.
Detection (60 days).
- Real-time limit monitoring and an exception report to the CFO on any breach, with a mandatory post-facto approval. Owner: Risk.
- Three-way reconciliation (front-office ticket, counterparty confirmation, custodian statement) on T+1. Owner: Back Office.
Independence (90 days).
- Move valuation to a middle-office unit using FBIL/NSDL/CCI published curves and independent dealer polls; dealer marks are evidence, not valuation.
- Rotate dealing mandates and enforce a mandatory leave policy for dealers - an established anti-fraud control.
- Strengthen the whistleblower channel and confirm that the audit committee receives all exceptions directly.
Governance. A quarterly treasury control certificate signed by the CFO, with a tracker of open items reported to the audit committee, plus a follow-up review after six months to test that the operating effectiveness has actually improved - not just that the policy has been rewritten.
3. What must be reported, to whom, and under which provisions?
Read the worked answer
To the audit committee, immediately (not in ten days). Present the facts, the unresolved ₹150 crore exposure, the amounts involved and the interim containment measures. The committee should authorise a forensic review and, if the ISIN mismatch is confirmed, consider suspension of the dealer pending investigation.
Statutory auditors - SA 265. Deficiencies in internal control are communicated in writing to those charged with governance on a timely basis. Significant deficiencies - those that merit the attention of those charged with governance - must be reported, distinguishing design from operating deficiencies and stating the possible effect on the financial statements.
Section 143(3)(i) and the Companies (Audit and Auditors) Rules. The auditor reports on the adequacy and operating effectiveness of internal financial controls over financial reporting. A dealer who executes, confirms and values trades, combined with a limit breach and an unreconciled ISIN, is a strong candidate for a material weakness in IFC, which must be reported.
Section 143(12) and Rule 13. Fraud involving ₹1 crore or more by officers or employees must be reported by the auditor to the Central Government (Secretary, Ministry of Corporate Affairs) in ADT-4, after communication to the board/audit committee. The threshold is comfortably crossed if the ISIN mismatch is confirmed as a fraud.
Also consider. A report to the RBI as the regulator if the NBFC's prudential or market-risk framework is implicated, and a legal opinion on recovery. Do not conclude 'typographical error' without documentary proof from both counterparty and custodian; conversely, do not label it fraud until the investigation establishes intent.