Certifying financials for a bank facility is more than a compliance formality — it’s the point where a genuinely diligent CA catches problems the borrower’s own management may not have noticed yet.
Why This Sits at the Centre of a Bank Finance Practice
When a bank relies on audited or certified financials to sanction or renew a credit facility, the auditor’s certificate becomes part of the bank’s own credit assessment. Missing an obvious inconsistency between a client’s books, their CIBIL report, and their actual bank statement isn’t just a client-service gap — under RBI’s fraud risk management framework, auditors who come across signs of fraudulent transactions during an audit have a specific escalation responsibility.
CIBIL / Credit Report Red Flags
DPD (Days Past Due) history
Any account showing 30+, 60+, or 90+ DPD markers in the last 12–36 months signals repayment stress that may not yet be visible in the financials you’re certifying — cross-check the timing against the period under audit.
“Settled” or “Written Off” accounts
An account marked settled (paid less than the full outstanding) or written off by a previous lender is a materially different fact from a clean closure — this history often doesn’t surface in management representations unless specifically asked.
Multiple recent enquiries
A cluster of credit enquiries across several lenders in a short window often indicates active shopping for finance to plug a liquidity gap — worth asking about directly rather than assuming it’s routine.
High credit utilisation
Consistently near-maximum utilisation of sanctioned working capital limits, especially alongside declining or flat turnover in the financials, suggests the business may be funding operations through credit rather than genuine cash generation.
Guarantor and co-borrower exposure
Check whether the entity or its promoters appear as guarantors on other stressed accounts — an undisclosed guarantee obligation is a contingent liability that should be reflected, or at minimum considered, in your certification.
Related entity credit profile
Where promoters run multiple entities, a strong CIBIL profile for the entity being audited alongside a distressed profile for a related entity warrants a closer look at inter-company fund flows.
Bank Statement Red Flags
| Red Flag | Why It Matters |
|---|---|
| Circular / round-trip transactions | Funds moving out and returning from the same or related counterparties within days can indicate artificial turnover inflation to support a higher drawing power or loan eligibility |
| Sales credits not matching invoiced turnover | A material gap between bank credits described as sales and the turnover reported in books/GST returns needs a documented explanation, not an assumption of timing difference |
| Frequent cheque returns / ECS bounces | Recurring instrument returns — even if eventually honoured on representment — are a genuine liquidity stress indicator often missed when only period-end balances are reviewed |
| Large unexplained cash deposits | Cash deposits inconsistent with the nature and scale of the business raise both an audit-evidence question and, potentially, a source-of-funds question |
| Diversion to related parties | Transfers to promoter-linked accounts or group entities without a documented business rationale is one of RBI’s explicitly listed Early Warning Signals for fund diversion |
| Outstanding cheques unusually old | An issued cheque still outstanding after several months in the bank reconciliation can indicate a fictitious liability or a payment that was never genuinely intended to clear |
| End-of-period window dressing | A spike in bank balance or receivables collection concentrated right at period-end, reversing shortly after, is a classic sign of balance-sheet dressing for a renewal or review date |
Bank confirmations remain the most reliable evidence
Bank statements and balance confirmations obtained directly from the financial institution are more reliable audit evidence than client-prepared reconciliations, because they originate from an independent external source. Don’t rely solely on a client-prepared bank reconciliation statement — verify the underlying transactions and, where risk is assessed as material, obtain a direct confirmation.
RBI’s EWS & Red Flagged Account Framework
Banks are required to maintain a framework of Early Warning Signals (EWS) — an illustrative list of over 45 indicators issued by RBI — that trigger classification of a loan account as a Red Flagged Account (RFA) for further investigation. This isn’t just a banking-side concern; several of these EWS indicators are things an auditor is directly positioned to notice first.
Common EWS relevant to auditors
Frequent changes in the scope or auditor of the account, significant deviations between projected and actual financial figures, funds diverted for purposes other than the sanctioned end-use, and financial statements showing inflated sales through debtors — all appear on RBI’s illustrative list.
The auditor’s escalation duty
Where an auditor comes across transactions or documentation during an audit that point to possible fraud, the expectation is to bring it immediately to the notice of top management and, where necessary, the Audit Committee of the Board — not to quietly note it and move on.
Timelines matter to the bank
Once flagged, banks work to a turnaround time — typically not more than 30 days — for examining an account. A clean, well-documented certification from you materially shortens that process for a genuine borrower; a sloppy one can trigger unnecessary scrutiny.
The Auditor’s Specific Role & Responsibility
What SA 240 and SA 550 actually expect
- SA 240 (fraud responsibility) requires maintaining professional scepticism throughout — a plausible management explanation for an unusual bank transaction still needs corroboration, not automatic acceptance.
- SA 550 (related parties) requires evaluating whether related-party transactions have been properly identified, authorised, and disclosed — a wire transfer to an unlisted related entity, or a pattern of transfers to the same third party around period-end, needs explanation before you sign off.
- Where your certification is specifically being relied upon by a bank for a credit decision (project reports, stock statements, CMA data, provisional financials), your professional responsibility runs to that reliance, not just to the client relationship.
Pre-Certification Checklist
Pull the CIBIL report yourself
Don’t rely solely on what the client discloses — obtain or ask to review the current CIBIL/CIC report directly as part of your working papers before certifying figures that feed into a credit decision.
Reconcile bank statement to books, not just balances
A matching closing balance can still sit on top of significant unexplained movement during the period — reconcile transaction-level activity, not just the period-end figure.
Cross-check turnover against GST returns
A material, unexplained gap between GSTR-1/3B turnover and books/bank credits is one of the fastest ways a lender’s own risk team will flag an account — better to have already resolved it before certification.
Document your enquiry, not just your conclusion
Where you’ve investigated an apparent red flag and found a satisfactory explanation, keep that enquiry on file — it protects you if the matter is revisited later by the bank or a subsequent auditor.
Common Questions
Is an auditor legally obligated to check a client’s CIBIL report?
There’s no blanket statutory mandate to pull a CIBIL report for every audit, but where you’re certifying financials, stock statements, or CMA data specifically for a bank facility, professional prudence and the applicable Standards on Auditing (SA 240, SA 550) support actively verifying credit history rather than relying purely on management representation.
What should I do if I find a red flag but management provides a plausible explanation?
Corroborate the explanation with independent evidence rather than accepting it at face value — professional scepticism under SA 240 specifically requires this, particularly for unusual or related-party transactions.
Does finding an EWS indicator mean the account is automatically fraudulent?
No — an Early Warning Signal triggers further investigation, not an automatic fraud classification. But as the auditor, surfacing the signal and documenting your enquiry is the responsible course, rather than assuming it will be caught elsewhere.