What an Auditor-Ready Co-Lending Evidence Dossier Should Contain

The Shift from MIS Spreadsheets to Auditor-Ready Proof

Historically, co-lending partners exchanged monthly Excel spreadsheets summarizing loan balances, interest collections, and DPD statuses. Under the RBI Co-Lending Directions 2025, spreadsheets no longer satisfy audit requirements. Regulatory inspectors expect verifiable, source-linked evidence proving that retention ratios, booking windows, blended interest rates, escrow flows, and CIC filings agreed on a loan-by-loan basis.

An Evidence Dossier is a stamped, single-click audit package compiled from underlying transaction logs and raw system events. Here are the 7 non-negotiable components an auditor-ready dossier must contain.

1. Executive Score & Status

The dossier must lead with a clear executive verdict and an Evidence Confidence Score (ECS) (ranging from 0 to 100). The overall status is color-coded based on deterministic severity:

• GREEN: All mandatory controls pass, evidence coverage is complete, and no non-maskable exceptions exist.
• AMBER: Minor operational gaps exist (e.g. pending document upload within SLA) but mandatory RBI requirements hold.
• RED: One or more non-maskable breaches exist (e.g. sub-10% retention, 15-day booking window breach, or classification divergence).

2. Evidence Confidence Factors

The Evidence Confidence Score cannot be a black-box AI output. It must be computed transparently from five explainable factors:

1. Loan & Tape Completeness: Percentage of mandatory field populations across both RE loan tapes.
2. Connector Data Coverage: Presence of raw webhooks and statement files from escrow banks and CICs.
3. Control Exception Burden: Deductions for open findings weighted by severity.
4. Remediation SLA Health: Track record of resolving exceptions within agreed SLA windows.
5. Audit Trail Integrity: Cryptographic verification of event sequence continuity.

3. Control Findings & Non-Maskable Exceptions

Every exception in the dossier must cite its exact regulatory or derived basis (e.g. CL-RET-01: Para 10 Minimum Retention or CL-TRF-03: Derived 15-Day Booking Evidence). Critical breaches must be flagged as non-maskable, meaning they cannot be hidden or overridden without an explicit audit trail.

4. Remediation SLA Rail State

Auditors examine how mismatches were handled. The dossier includes a Remediation SLA table detailing every open and resolved finding, assigned joint owners, SLA due dates, evidence submissions, and approval sign-offs.

5. Connector & Product-Evidence Coverage

The dossier lists the active intake shims and evidence pipelines (e.g. Yubi/M2P lifecycle webhooks, Finacle/T24 loan tapes, CIBIL/Experian CIC files, MT940 escrow bank feeds). A missing connector feed automatically flags affected controls as UNKNOWN rather than passing them.

6. Event Hash-Chain & Manifest Proof

To prevent post-facto tampering, every evidence ingestion, control evaluation, and commentary update is recorded on an append-only, hash-chained log. The dossier includes the audit proof sequence range, latest block hash, and manifest hash so external auditors can verify data integrity.

7. Explicit Scope Boundary & Caveats

An honest Evidence Dossier clearly states what it is not: it is not a statutory audit, legal opinion, credit decision, or fund-flow record. The regulated entities retain full responsibility for lending policies, regulatory reporting, and credit underwriting.

8. Review Gates for Public and Committee Claims

A modern dossier should also state what has been reviewed, and what has not. AssureCLA now keeps this separate through deterministic review gates: benchmark packets require an exact manifest-hash sign-off, product-control packs show approval and source-provenance status, and connector matrices distinguish built/tested shims from sandbox or credential-dependent integrations.

This matters because a risk committee can rely on the evidence packet without mistaking a demo-ready control pack for a production-certified regulatory interpretation, or a named adapter shim for an official third-party integration.