PNB fraud takeaway: Financial audits at banks must be beefed up by systems' check by tech experts

It is now universally acknowledged that banks, more than other businesses, lend themselves to technology-led operations, often rendering human interference or interface unnecessary. Technology-driven banks do not in fact have any interface with their savings account customers once their accounts have been opened. Thereafter, it is technology-driven systems all the way, be it cash withdrawal, net-banking or ordering of cheque books. Even banking operations among banks and their branches are largely consummated through systems like SWIFT.

In the event, the Reserve Bank of India (RBI) was right in alerting banks in India to the dangers of systems being compromised or corrupted or hacked. Punjab National Bank (PNB) has been accused by the Central Bureau of Investigation (CBI) of being blasé or deliberately indifferent to the RBI warning.

Banks subject themselves to numerous audits, most of them financial. In addition to the year-end audit culminating in auditor reporting to the RBI and shareholders, there are internal audits galore---revenue audit, expenditure audit, concurrent audit etc. This gives one the impression that banking staff suffer from auditing fatigue. But the auditing overkill hasn’t shored up the fortunes of Indian banks, particularly the PSBs. Feverish auditing activity does not automatically translate into perfection.

Everything we do in our lives must be relevant and well-directed. That applies to auditing as well. What is the point in having so many rounds of auditing albeit with different focuses when the wood is missed for the trees. It is the systems, silly. Core banking, internet-banking and money transfers across continents with the click of mouse all call for heightened systems safety and precautions.

RBI must wake up and institutionalise systems audit and make it mandatory. This is like periodic maintenance of machinery. For a bank, its systems are its machinery and plant. Unless they are in order and beyond corruption, no amount of financial audit can insulate it from losses arising out of systemic failure. PNB-Nirav Modi fraud is a classic example of fraudsters infiltrating the banking systems taking advantage of systemic weaknesses.

The systems audit that is suggested herein necessarily has to focus more on prevention of manipulations and fraud. Yes a system should be fool-proof. Who can ensure this? Certainly not chartered accountants unless they also have armed themselves with information technology qualifications and experience. It is trite that the one who created the system should not be the one who is reviewing it. Thus if Infosys has developed and installed the banking software for a bank, its annual review must be done by its rival say TCS. And the next year by Wipro and so on.

Peer review after all is healthy though cynics say it is all about pitting one expert against another. A surgeon’s failure is reviewed in the weekly peer review meetings in the US by another surgeon so as to keep both of them on their toes.

It is not necessary that the systems audit must be an annual exercise. If the RBI feels this would be disruptive and costly, it can mandate it for every second or third year.

Experience shows that in a technology-driven environment, robust, efficient and fool-proof systems can render perpetration of frauds extremely difficult if not impossible.

The systems audit by IT professionals should not be construed as a slight to chartered accountants who historically have been hogging all auditing work though it is not necessary that only rival IT firms must undertake this exercise. CAs can be allowed to do it provided they suitably arm themselves with the requisite expertise. They have woken up to the need for learning forensic auditing skills after taking shelter behind the smug we-are-not-bloodhounds-but-only-watchdog alibi for long. Time and technology move with inexorable speed. Those who refuse to emerge out of time warp are left behind. Perhaps it is also time for chartered accountants to acquire IT skills so as to qualify for the demanding job of auditing systems rooted in technology.

(The author is a senior columnist and tweets @smurlidharan)