Information Systems play a pivotal role in modern day banking. Today's banking is totally dependent on information systems and more so on CBS. What are the directions of the RBI regarding Information Systems Audit of the

The directions of the RBI as regards Information Systems (IS) Audit of the regulated entities under Chapter VI- Information Systems Audit Para (30) under Information Systems Audit are as follows: The Audit Committee of the Board shall be responsible for exercising oversight of IS Audit of the Regulated Entity (RE). REs shall put in place and IS Audit Policy. The IS Audit Policy shall contain a clear description of its mandate, purpose, authority, audit universe, periodicity of audit etc. The policy shall be approved by the Audit Committee of the Board and reviewed at least annually. The Audit Committee of the Board shall review critical issues highlighted related to Information Technology / information security / cyber security and provide appropriate direction and guidance to the RE's Management. REs shall have a separate IS Audit function or resources who possess required professional skills and competence within the Internal Audit function. Where the RE uses external resources for conducting IS audit in areas where skills are lacking within the RE, the responsibility and accountability for such external IS audits would continue to remain with the competent authority within Internal Audit function. REs shall carry out IS Audit planning by adopting a risk-based Audit Approach. REs may consider, wherever possible, a continuous auditing approach for critical systems, performing control and risk assessments on a more frequent basis.