Five Concurrent Audit Findings and One Week to Reply
A concurrent audit of the Pune branch of a housing finance company has thrown up five findings:
(i) A ₹1.20 crore construction finance facility to a builder; ₹35 lakh of it was disbursed in cash against a self-certified voucher described as 'site labour and miscellaneous'. (ii) The mortgage valuation for a ₹82 lakh home loan, secured on a flat valued at ₹95 lakh, was done by a valuer who is the brother-in-law of the credit manager who sanctioned the file; his value was 22% above a valuation obtained eleven months earlier. (iii) e-KYC for three borrowers was completed by Aadhaar OTP, but each applicant's current address differs from the Aadhaar address; no re-verification was done. (iv) The sanction letter in one file is dated nine days before the credit appraisal note. (v) EMI of ₹45,000 a month has been received in cash for eight months in one account.
The branch manager must respond to the audit memo within a week and has asked you, as compliance officer, to classify the findings and set out the remediation.
1. Classify the findings by severity, name the control each one breaches, and quantify the LTV finding.
Read the worked answer
(i) Cash disbursement - very high. Loan funds must move through banking channels against verified end-use; a self-certified voucher for ₹35 lakh destroys the audit trail, is an AML red flag and creates a misappropriation risk. Control breached: disbursement and utilisation certification.
(ii) Related-party valuation plus an LTV breach - high. Two problems. First, a valuer connected to the sanctioning officer is a conflict of interest; valuations must come from an independently empanelled valuer with rotation. Second, the arithmetic: 82/95 = 86.3% LTV, against the 75% cap applicable to home loans above ₹75 lakh. The maximum permissible loan is 0.75 × ₹95 lakh = ₹71.25 lakh, so the file is over-lent by ₹10.75 lakh. The 22% jump in eleven months makes the valuation itself suspect.
(iii) e-KYC address mismatch - medium. Aadhaar OTP establishes identity, not current residence. The current address must be re-verified through an officially valid document or the prescribed digital process and recorded; otherwise the file carries an impersonation and traceability risk.
(iv) Sanction letter predating the appraisal - very high. Sanction cannot precede appraisal and credit approval. Either the letter was backdated or the file was sanctioned on an appraisal written afterwards; both are falsification indicators and must be treated as fraud-risk, not a documentation slip.
(v) Cash EMI collection - high. ₹45,000 × 8 = ₹3.60 lakh outside banking channels. It defeats the audit trail, is an AML indicator, may breach the company's own fair-practice and repayment mandates, and creates room for collection staff to misappropriate receipts.
2. Set out the remediation and escalation plan you would put to the branch manager.
Read the worked answer
Stop and preserve. Freeze further disbursement on the construction finance facility; secure the cash vouchers, the valuation report, the diary order of the sanction letter and the appraisal note, and the cash receipt book. Do not allow the file to be 'completed' retrospectively - a post-facto note is itself a reportable event.
Verify independently. For the valuation file, obtain a fresh valuation from a panel valuer unconnected with the branch and decide the excess ₹10.75 lakh as margin or reduction. Review every other file valued by the same person in the last twelve months. For the cash receipts, reconcile each of the eight months to the company's bank account and the borrower's statement; for the construction loan, trace utilisation to bank payments and invoices.
Escalate. Findings (i) and (iv) have fraud characteristics. Route them to the audit committee of the board through the MD/CEO, initiate a staff accountability review, and report to RBI in the prescribed format under the fraud-reporting master direction for HFCs within the timeline it sets - check the current threshold and format before filing. If the cash pattern suggests structuring, file a suspicious transaction report with FIU-IND. Findings (ii), (iii) and (v) are control failures: report to the risk committee with an owner and a closure date each.
Fix the controls. Remove the conflicted valuer from the panel; enforce maker-checker on disbursement with bank-channel-only payments; make address re-verification a mandatory field before disbursement; convert EMI collection to NACH mandates with a cash exception report reviewed monthly.
3. The borrower in the ₹82 lakh LTV-breached account says he was never told of any problem and refuses to bring in more money. How do you handle it?
Read the worked answer
Separate the internal fault from the customer's obligation. The breach arose because the branch lent against an inflated, conflict-tainted valuation. The borrower signed a sanction letter and a loan agreement; whether he must now fund the shortfall depends on what those documents say and on the fair-practice obligation not to change terms unilaterally.
Sequence of action:
- Obtain the independent re-valuation first. If it supports ₹95 lakh, there is no breach to cure and the finding narrows to the valuer's conflict of interest.
- If the re-valuation is lower, the loan is over-lent against the security. Do not demand cash on a phone call. Issue a written note explaining the position, the policy cap and the options - additional margin, additional unencumbered collateral where policy permits, or a reduction of exposure over an agreed schedule.
- Offer a hearing and record it. A coercive demand in a file the company itself got wrong is a conduct risk and a likely ombudsman complaint.
- If the borrower refuses, escalate to the credit committee for a decision - do not let the branch unilaterally reclassify or regularise the account.
Also fix the incentive that created it. The sales team's push for same-day sanctions, without a hard stop on LTV at the system level, is the real cause. The remediation memo should recommend a system-enforced LTV check keyed to the valuation date and valuer identity, so this decision never rests on a branch officer's discretion again.