ALSO READRs 114-bn PNB scam: Mehul Choksi, the uncle who mentored Nirav Modi Before PNB fraud: Nirav Modi, Choksi left 18 businessmen, 24 firms bankrupt Bank Union wants CBI probe into PNB fraud, alleges RBI failed as regulator Revealed: Nirav Modi's Taiwan, Surat, Hong Kong & Dubai connections Regulatory lessons: India should reduce dependence on the banking system
Auditors are facing questions as to how the fraud at Punjab National Bank (PNB) went on for six years and how they failed to detect it.
The process seems foolproof. A branch such as Mumbai’s Brady House, which is a corporate-focused one, is headed by a branch manager who holds the rank of an assistant general manager. In such branches, a senior official is designated as ‘concurrent auditor’, who tracks all the transactions of the branch and at the end of the day generates an audit report. This report can be opened only by the branch manager in a specified room. Both the concurrent auditor and the manager sign the report and then it goes to the head office.
The auditor reports directly to the head office and nobody can manipulate the auditor’s work. “It is quite surprising that a few people, including one clerk, could continue issuing LoUs (letters of understanding) of vast amounts without any checks and balances,” said a banker.
However, there is a catch. If the transaction is not done using the bank’s core banking system (CBS), the concurrent auditor has a slim chance of catching any discrepancy unless he is industrious enough to scrutinise every aspect of the operations daily.
“One person cannot do it. If the transaction has not been done using the CBS, the auditor cannot catch any discrepancy,” said a senior public sector banker. Usually, these concurrent auditors do not have an easy relationship with bank officials, from the head office to branch level, some senior bankers said.
“Usually these people are on the verge of retirement or have been given the assignment as a punishment posting. Their job is essentially to sign vouchers. If a system-generated voucher does not come to them, they are least bothered,” said a retired chairman of a large public sector bank (PSB).
There is another set of auditors called internal auditors. Ideally, they should have caught the fraud. Even if a SWIFT (Society for Worldwide Interbank Financial Telecommunication) system sits outside the CBS, it does leave a trail and eventually gets linked up with the CBS through the nostro account overseas. Any foreign branch audit should have easily picked up the amount hanging.
However, the issue again is lack of training and interest. These are bank employees who join the audit department from other centres on deputation for around three years. Depending upon the size of the branch, an internal audit is conducted once, or a couple of times in a year.
The problem here is that internal auditors are good at accounts, but they are not trained to track foreign exchange transactions.
Since the number of specialists is very small in PSBs for doing treasury and foreign exchange operations, they are on the same job for years on end, though the practice is to shift positions every three years. Due to lack of skills, internal auditors are solely dependent on these specialists in the bank. Bankers said if the specialist wanted to fudge something, chances of him getting caught were slim.
There is another kind of audit called statutory audit. This is done by outside auditors who are highly trained and specialised. However, they do not necessarily visit branches but rely on internal audit reports to collate the branch-based data.
Finally come the auditors of the Reserve Bank of India. Their job is mainly in the head office. This auditing is for risk-based supervision and not necessarily for the daily operations of a bank, said a person familiar with the process.
However, the recent scam points out to a wider collusion than the initial numbers put out by PNB, experts said.
When a guarantee is generated by a bank, the beneficiary bank sometimes wants to verify with the issuer bank if the payment has to be done. This is not done always, but when there are hundred such guarantees, ideally there should be some verifications. The SWIFT system is not integrated with the CBS of banks, but sits outside as a separate unit, bankers said. But, because of the two-way communication, it is quite difficult to do a fraud involving the SWIFT.
The verification call comes to the zonal office of the bank and not to the branch where it was originated, said bankers. In that case, there is no chance that the employee who generated the guarantee could access it.
“If the bank wanted to crack the fraud, they could have done it. But there are unanswered questions that would get clarified only after a full investigation,” said one of the officials quoted above. “A deputy general manager will have the appetite for only a few lakhs, not thousands of crores,” said the banker.
PNB, in its letter to 30 banks on February 12, had said its CBS system was tampered with. “In the case of LoUs/FLCs (foreign letters of credit), it was found that at the time of issuing FLCs for a smaller sum by the SWIFT, the transaction was routed through CBS, but subsequently, amendments were made in these FLCs by substantially enhancing the amount and were transmitted through the SWIFT without enhancements through CBS,” the letter said.
The buyer’s credit availed against fraudulent LoUs was either used to retire import bills or to replenish the maturing buyer’s credit of some other banks, according to the letter.
A recent Edelweiss report also pointed this out. “The amount involved is substantial (cumulative gross exposure relating to fraudulent transactions is Rs 114 billion), but more worrying is the stark process lax and repeated instances of similar frauds (Winsome Diamond, etc). PSBs continue to grapple with weak systems, raising questions on why the processes are not centralised, unlike most private banks where bypassing CBS is not easy,” said the report.