RBI Annual Report FY 2025-26 Part 27 explains ERM 2.0, three lines of defence, Next Gen-IRIS, internal audit, business continuity, budget management and Utkarsh 2029.

The RBI Annual Report FY 2025-26 shows that institutional resilience is no longer being treated merely as a compliance exercise. During 2025-26, the Reserve Bank strengthened its enterprise-wide risk management framework, automated internal audit, launched Next Gen-IRIS, improved business-continuity arrangements, refined budget management and introduced Utkarsh 2029, its medium-term strategy framework for April 2026–March 2029. These developments are particularly important for RBI Grade B promotion examinations, Grade B, UPSC, banking examinations and interviews, because they test not only monetary policy and banking regulation but also the institutional architecture through which the RBI performs its functions.

The central message is simple:

RBI is moving from reactive risk control to anticipatory, technology-enabled and enterprise-wide resilience.

1. Why Risk Management Matters Inside the RBI

The RBI itself is a large and complex institution. It performs monetary, regulatory, supervisory, payment-system, currency, foreign-exchange, debt-management, government-banking and developmental functions.

Therefore, risks can arise from:

technology and cybersecurity;
operational disruptions;
information security;
financial reporting;
governance;
business-process failures;
emerging technologies;
inadequate controls;
business continuity failures; and
other risks associated with the Reserve Bank’s expanding mandate.

The RBI Annual Report FY 2025-26 records a clear institutional response: risk management was strengthened through wider risk coverage, stronger frameworks and greater emphasis on risk culture and awareness.

This is where the three lines of defence become crucial.

2. RBI’s Three Lines of Defence

This is one of the highest-value conceptual areas for examination.

The RBI’s internal risk-management framework consists of three lines:

Line of Defence	Institutional responsibility	Core function
First line	Individual business areas	Identify and manage risks arising from their own functions
Second line	Risk Monitoring Department (RMD)	Centralised risk monitoring and ERM
Third line	Inspection Department	Independent risk assurance through inspection and audit

The Annual Report explicitly states that individual business areas constitute the first line, RMD is the second line, and the Inspection Department is the third line.

Exam Point

Do not confuse the second and third lines.

RMD = risk monitoring.
Inspection Department = risk assurance.

That distinction is extremely important for objective and interview questions.

3. Risk Monitoring Department: The Second Line of Defence

The Risk Monitoring Department (RMD) is responsible for formulating and operationalising the RBI’s Enterprise-wide Risk Management (ERM) framework.

Its role goes beyond simply checking whether departments have followed rules.

The focus during 2025-26 was on:

widening risk coverage;
strengthening existing risk frameworks;
developing risk awareness;
propagating a strong risk culture; and
making risk management more forward-looking.

This culminated in the introduction of ERM Framework 2.0.

4. ERM Framework 2.0: A Major Institutional Reform

The Enterprise-wide Risk Management Framework 2.0 is perhaps the most important concept in this part.

The RBI describes it as a roadmap for the next decade for strengthening organisational resilience.

The key change is philosophical:

Earlier orientation

Compliance-driven risk management

New orientation

Value-creating and anticipatory risk management

The framework emphasises:

advanced data analytics;
preparedness for emerging risks;
continuous improvement of risk-management approaches;
stronger risk culture;
enterprise-wide risk awareness; and
necessary structural and policy refinements.

Why is this significant?

A purely compliance-oriented system asks:

“Did we follow the prescribed procedure?”

An anticipatory system asks:

“What could go wrong next, and are we prepared for it?”

That distinction captures the essence of ERM 2.0.

5. Next Gen-IRIS: Technology-Enabled Risk Management

The RBI’s Integrated Risk Monitoring and Incident Reporting System (IRIS) was originally launched in January 2020 for:

reporting incidents; and
formulation of risk registers.

During 2025-26, the RBI revamped this system to provide:

a comprehensive risk repository;
advanced risk-management tools;
improved user experience; and
greater operational efficiency.

The result was Next Gen-IRIS.

Most important date

Next Gen-IRIS went live on April 1, 2026.

This is an excellent factual question for competitive examinations.

Information Security Policy

Operating procedures for implementation of the revised Information Security (IS) Policy 2024 were also completed by the end of December 2025.

The objective was to align the procedures with:

emerging threats; and
evolving IT best practices.

6. What Is the Next Step for Risk Management in 2026-27?

The RBI is not stopping with ERM 2.0.

For 2026-27, RMD proposed:

1. Risk profiling of business areas

The objective is to help individual business areas manage their risks more effectively.

This reinforces the three-lines model because the first line—the business area itself—must remain responsible for managing its risks.

2. Thematic review of patch and configuration management

The RBI will conduct a thematic review on:

“Effectiveness of Patch and Configuration Management in the Reserve Bank.”

This is particularly relevant because technology infrastructure increasingly forms the backbone of central-bank operations.

7. Internal Audit: The Third Line of Defence

The Inspection Department provides the third line of defence.

Its principal responsibility is to examine and evaluate:

internal controls;
governance systems; and
risk-management effectiveness.

It provides risk assurance to top management and the Central Board under the Risk-Based Internal Audit (RBIA) framework.

The department reports to the:

Audit and Risk Management Sub-Committee (ARMS)

It also administers:

Concurrent Audit (CA); and
Control Self-Assessment Audit (CSAA).

8. ARMS: Why It Matters

The Inspection Department acts as the Secretariat to the Audit and Risk Management Sub-Committee (ARMS).

During 2025-26, the ARMS Charter was reviewed.

The review covered its oversight responsibilities relating to:

financial reporting;
internal controls;
risk monitoring;
audits; and
compliance.

Exam Connection

Remember the chain:

Central Board → ARMS → Inspection Department → Risk assurance

while:

Business areas → first line

and:

RMD → second line

9. Concurrent Audit Was Strengthened

The RBI reviewed the procedure for selecting concurrent auditors and issued a revised circular during 2025-26.

The Charter of the Inspection Department was also finalised.

This reflects a broader objective:

Make internal assurance more independent, systematic and risk-focused.

10. AI and ML in Internal Audit

One of the more forward-looking developments was the examination of whether Artificial Intelligence and Machine Learning could be used in internal audit.

An internal Working Group was constituted for this purpose.

The Working Group submitted its report in February 2026.

Notice the distinction:

The RBI studied the feasibility of AI/ML adoption.

Do not incorrectly write in an examination that the Annual Report says AI has already replaced the internal audit process.

The source supports a feasibility examination and Working Group report, not wholesale replacement of auditors by AI.

11. Audit Management System: Complete Automation

A particularly important operational milestone was the achievement of complete automation of the Inspection Department’s audit processes through the Audit Management System (AMS) during 2025-26.

This matters because automation can improve:

audit workflow;
documentation;
tracking;
compliance monitoring;
institutional memory; and
management visibility.

Thus, the RBI’s internal-control architecture is becoming increasingly digital and data-enabled.

12. 2026-27 Internal Audit Priorities

The Inspection Department’s priorities for 2026-27 include:

conducting integrated thematic reviews;
reviewing and refining categorisation of auditee offices;
strengthening assurance coordination; and
augmenting inspection capacity.

The trajectory is therefore:

Risk-based audit → thematic review → integrated assurance → technology-enabled audit.

13. Business Continuity Management: Preparing for Disruption

A central bank cannot afford prolonged operational disruption.

The Corporate Strategy and Budget Department (CSBD) is responsible for formulating and executing the RBI’s Business Continuity Plan (BCP) for critical operations.

During 2025-26, the RBI introduced an application for Business Continuity Management (BCM) containing an interactive dashboard.

Importantly, this dashboard is also designed to function as a:

Crisis-response tool during disruptions to business continuity.

The RBI also put in place a formal Standard Operating Procedure (SOP) for business continuity during crisis situations.

The SOP guides business units on actions:

before a crisis;
during a crisis; and
after a crisis.

Exam Interpretation

This is a shift from:

“Restore operations after disruption”

towards:

“Prepare, respond, maintain and recover systematically.”

14. Corporate Strategy and Budget Department: What Does CSBD Do?

The Corporate Strategy and Budget Department (CSBD) has a wide institutional role.

It:

coordinates the RBI’s medium-term strategy framework;
prepares the annual budget;
monitors expenditure;
promotes budgetary discipline;
maintains superannuation and staff welfare funds;
formulates and executes BCP for critical operations;
acts as nodal department for four RBI-funded institutes;
handles opening of new offices; and
monitors Citizen’s Charter performance.

Therefore, CSBD is not merely a “budget department”.

It combines strategy + budgeting + continuity + institutional coordination.

15. Budget Management: Greater Efficiency and Discipline

During 2025-26, the RBI fine-tuned its Budget Rating Framework to improve budget-management efficiency.

This is important from a governance perspective.

Budget management within a central bank involves ensuring that resources are allocated in line with institutional priorities while maintaining expenditure discipline.

Thus:

Strategy determines priorities → Budget allocates resources → Monitoring checks utilisation → Risk management protects execution.

16. Utkarsh 2029: RBI’s Medium-Term Strategy Framework

Now comes the most important strategic concept of Part 27.

What is Utkarsh?

Utkarsh is the RBI’s medium-term strategy framework designed to achieve excellence in the performance of its mandates and strengthen the trust of citizens and institutions.

The earlier framework was:

Utkarsh 2.0

January 2023 – December 2025

The new framework is:

Utkarsh 2029

April 2026 – March 2029

It therefore covers a three-year horizon: 2026-29.

17. Structure of Utkarsh 2029

Utkarsh 2029 has a three-layered structure supported by six strategy pillars.

The structure incorporates:

Vision → Strategy Pillars → Values → Deliverables

The Annual Report makes an important distinction:

Utkarsh 2029 covers overarching strategic deliverables

while:

Regular functions continue through annual departmental action plans.

This distinction is highly useful in descriptive answers.

18. What Does Utkarsh 2029 Aim to Achieve?

The framework aims to make the RBI a future-ready organisation.

Its strategic priorities include:

reviewing and strengthening regulations;
maintaining a customer-centric approach;
promoting greater inclusivity;
enhancing competitiveness and depth of financial markets;
adapting rapidly to new technologies;
expanding internationalisation initiatives; and
strengthening institutional readiness for the future.

One-line exam answer

Utkarsh 2029 is RBI’s three-year medium-term strategy framework for 2026-29 aimed at strengthening regulatory effectiveness, inclusion, market depth, technological agility and internationalisation to create a future-ready institution.

19. Utkarsh 2029 vs Annual Action Plans

This distinction deserves special attention.

Feature	Utkarsh 2029	Annual Action Plans
Nature	Medium-term strategy	Annual departmental execution
Horizon	April 2026–March 2029	One year
Focus	Overarching strategic deliverables	Regular departmental functions
Purpose	Long-term institutional direction	Annual implementation

The Annual Report explicitly states that regular RBI functions will continue under the annual action plans of respective departments.

20. RBI-Funded Institutions: Strategic Ecosystem

CSBD also acts as the nodal department for four institutions funded by the RBI:

CAFRAL – Centre for Advanced Financial Research and Learning
IGIDR – Indira Gandhi Institute of Development Research
NIBM – National Institute of Bank Management
IIBM – Indian Institute of Bank Management

During 2025-26, CSBD strengthened their governance through meetings of governing boards and sub-committees.

A formal mechanism was also established to encourage collaboration among these institutions and allow RBI departments to leverage their research capabilities.

21. Important Institutional Output from RBI-Funded Institutes

During 2025-26:

357 training programmes were conducted across CAFRAL, NIBM and IIBM;
around 9,986 participants were covered;
87 IGIDR students were awarded Economics degrees;
131 NIBM students were awarded PGDM degrees in Banking and Financial Services.

These numbers demonstrate that the RBI’s institutional ecosystem extends beyond regulation and monetary policy into:

research + training + capacity building.

22. Citizen-Centric Institutional Management

The RBI also reviewed its regulatory approvals and Citizen’s Charter services.

A revised list of:

204 services was released on July 1, 2025;
this was subsequently revised to 200 services as of March 2, 2026.

Performance under the Citizen’s Charter is published on the RBI website on the first working day of every month.

This represents an important governance principle:

Institutional accountability should be measurable and publicly visible.

23. The Bigger Picture: How All These Reforms Fit Together

It is easy to memorise these developments as isolated facts.

That would be a mistake.

The RBI Annual Report FY 2025-26 actually presents a connected institutional architecture:

Layer 1 — Business ownership

Business areas identify and manage their risks.

↓

Layer 2 — Central risk oversight

RMD monitors risk across the institution.

↓

Layer 3 — Independent assurance

Inspection Department provides risk assurance.

↓

Technology

Next Gen-IRIS + AMS + AI/ML exploration

↓

Continuity

BCM dashboard + BCP + crisis SOP

↓

Strategy

Utkarsh 2029

↓

Resource discipline

Budget management + Budget Rating Framework

This is the institutional equivalent of moving from reaction to resilience.

24. Key Numbers and Dates to Memorise

Item	Important Fact
ERM 2.0	Roadmap for the next decade
Next Gen-IRIS	Live from April 1, 2026
Revised IS Policy 2024 procedures	Completed by December 2025
AI/ML internal audit Working Group report	February 2026
Audit Management System	Audit processes fully automated during FY26
Utkarsh 2.0	January 2023–December 2025
Utkarsh 2029	April 2026–March 2029
Utkarsh 2029 horizon	3 years
Citizen’s Charter	204 services July 1, 2025 → 200 March 2, 2026
BCM	Interactive dashboard + crisis response capability
RBI-funded institutes	4
Training programmes at CAFRAL/NIBM/IIBM	357
Participants	~9,986
IGIDR degrees	87
NIBM PGDM degrees	131

25. Most Important Exam Concepts

Concept 1: Three Lines of Defence

First line: Business areas
Second line: RMD
Third line: Inspection Department

Concept 2: ERM 2.0

Compliance-driven → Value-creating and anticipatory

Concept 3: Next Gen-IRIS

Revamped risk repository and risk-management application, live April 1, 2026.

Concept 4: Internal Audit

Inspection Department → third line of defence → RBIA → risk assurance.

Concept 5: ARMS

Audit and Risk Management Sub-Committee oversees financial reporting, internal controls, risk monitoring, audits and compliance.

Concept 6: Utkarsh 2029

Three-year medium-term strategy framework, April 2026–March 2029.

Concept 7: CSBD

Strategy + Budget + BCP + Citizen’s Charter + RBI-funded institutes.

26. Probable RBI Grade B / Promotion Exam Questions

MCQ 1

The Risk Monitoring Department of RBI constitutes which line of defence?

Answer: Second line of defence

MCQ 2

Which department constitutes the third line of defence?

Answer: Inspection Department

MCQ 3

Next Gen-IRIS was made live on:

Answer: April 1, 2026

MCQ 4

Utkarsh 2029 covers which period?

Answer: April 2026 to March 2029

MCQ 5

Which department prepares RBI’s annual budget and coordinates its medium-term strategy framework?

Answer: Corporate Strategy and Budget Department (CSBD)

MCQ 6

ERM Framework 2.0 shifts RBI’s internal risk management from:

A. Risk-based to compliance-based
B. Compliance-driven to value-creating and anticipatory
C. Centralised to decentralised
D. Manual to physical

Answer: B

MCQ 7

The Audit and Risk Management Sub-Committee reports to/operates under which institutional structure?

Answer: It is a Sub-Committee of the Central Board, with the Inspection Department serving as its Secretariat.

MCQ 8

Which of the following is NOT a principal objective of Utkarsh 2029?

The answer should be the option unrelated to strengthening regulation, inclusion, market depth, technological agility or internationalisation.

27. Descriptive Answer Framework

Question:

“Explain the evolution of RBI’s internal risk-management framework during 2025-26.”

A high-quality answer can follow this structure:

Introduction:
The RBI strengthened its internal resilience through ERM 2.0, risk-based internal audit, automation and business-continuity arrangements.

Body:

Explain three lines of defence.
Explain RMD’s second-line role.
Discuss ERM 2.0.
Mention Next Gen-IRIS.
Explain Inspection Department and RBIA.
Mention AMS automation.
Discuss AI/ML feasibility study.
Explain BCM dashboard and crisis SOP.
Conclude with Utkarsh 2029.

Conclusion:
The overall movement is towards a proactive, technology-enabled, risk-aware and future-ready central bank.

This is much stronger than simply listing departmental achievements.

28. The One-Minute Revision Sheet

If you have only 60 seconds, remember this:

RMD = 2nd line. Inspection = 3rd line. Business areas = 1st line.

ERM 2.0 = next-decade roadmap + anticipatory/value-creating risk management.

Next Gen-IRIS = live April 1, 2026.

Inspection = RBIA + risk assurance + CA + CSAA.

AMS = audit processes fully automated.

AI/ML internal audit = feasibility Working Group report submitted February 2026.

BCM = interactive dashboard + crisis response tool.

CSBD = strategy + budget + BCP + Citizen’s Charter + four RBI-funded institutes.

Utkarsh 2029 = April 2026–March 2029 = three-year medium-term strategy.

Citizen’s Charter = 204 services → 200 services.

Utkarsh 2029 = future-ready RBI through regulation, inclusion, market depth, technology and internationalisation.

Key Takeaways — RBI Annual Report FY 2025-26 Part 27

RMD is the second line of defence in RBI’s three-tier internal risk-management framework.
Business areas are the first line and remain primarily responsible for managing their own risks.
Inspection Department is the third line, providing independent risk assurance.
ERM Framework 2.0 represents a shift from compliance-driven to value-creating and anticipatory risk management.
ERM 2.0 is intended as a roadmap for the next decade.
Next Gen-IRIS went live on April 1, 2026.
The revised Information Security Policy 2024 operating procedures were completed by December 2025.
The AI/ML Working Group examining internal-audit applications submitted its report in February 2026.
RBI achieved complete automation of Inspection Department audit processes through the Audit Management System.
RBI introduced a BCM interactive dashboard that can function as a crisis-response tool.
Utkarsh 2029 covers April 2026–March 2029.
Utkarsh 2029 is a three-year medium-term strategy framework.
It seeks stronger regulation, greater inclusion, deeper markets, technological agility and expanded internationalisation.
CSBD combines strategy, budgeting, BCP, Citizen’s Charter monitoring and coordination of RBI-funded institutes.
The institutional direction is unmistakable: from compliance and reaction towards anticipation, assurance, resilience and future readiness.

Final Exam Revision: Part 27 in 10 Lines

Three Lines:
1st — Business Areas → 2nd — RMD → 3rd — Inspection

ERM: Framework 2.0

Risk Technology: Next Gen-IRIS

Audit: RBIA + AMS automation

AI in Audit: Feasibility examined; Working Group report Feb 2026

Continuity: BCM dashboard + crisis SOP

Strategy: Utkarsh 2029

Period: April 2026–March 2029

Budget: CSBD + Budget Rating Framework

Ultimate objective: Future-ready, resilient RBI

Source Note

All substantive facts in this article are based on Chapter XI — Governance, Human Resources and Organisational Management of the uploaded RBI Annual Report FY 2025-26, particularly the sections dealing with Enterprise-wide Risk Management, Internal Audit/Inspection and Corporate Strategy and Budget Management.

Next Part

Part 28 will move to another highly important numerical and conceptual area of the RBI Annual Report FY 2025-26: RBI’s Balance Sheet, Income, Expenditure, Assets, Liabilities and Accounting Policies—including the numbers that are particularly useful for RBI Grade B and promotion-exam MCQs.