Forensic Audit in Nepal: The Warning Signs That Actually Trigger One

A statutory audit is scheduled the day the fiscal year ends. A forensic audit is scheduled the day someone stops trusting a number. That difference in origin explains almost everything else about how the two are conducted.

Prepared by Nishant Marasini and team · Position stated as at 22 September 2026

What makes an audit "forensic"

Forensic audit is an investigative examination of financial records undertaken because there is a specific, articulable reason to suspect fraud, misappropriation, or financial misrepresentation — not because the calendar says it is time for one. It is not a more intensive version of a routine audit; it is a different kind of engagement with a different objective. A statutory or internal audit tests whether controls and figures are reasonable in the ordinary course. A forensic audit starts from a suspicion and works backward through the records until it can either substantiate that suspicion with evidence or rule it out with the same rigour.

Because the output of a forensic audit may end up in front of a court, a labour tribunal, a shareholder dispute forum, or the police, the process is built differently from the ground up — how evidence is collected, how it is preserved, who is interviewed and how, and how the findings are documented all follow a stricter discipline than a routine audit requires.

What actually triggers one

In Nepali businesses, forensic audits rarely start with a grand theory. They start with something specific and hard to explain away.

Inventory shrinkage that does not match the sales pattern

Every trading and manufacturing business carries some inventory variance. What turns ordinary shrinkage into a forensic trigger is when the pattern stops correlating with anything operational — stock disappearing from a single warehouse faster than from comparable ones, a product line with unusually high write-offs that happens to also have unusually high resale value on the open market, or shrinkage that tracks a particular shift or a particular staff member's tenure rather than the season or the product category.

Related-party transactions that do not get disclosed properly

A company transacting with a supplier or customer connected to a director, a senior manager, or a family member is not automatically improper — but it becomes a red flag when the relationship is not disclosed to the board or the auditor, when pricing on those transactions is consistently more favourable than arm's-length terms, or when the volume of business with that party grows quietly year over year without anyone flagging it. Boards that discover a related-party relationship only after an outside party raises it, rather than through the company's own disclosure process, commonly order a forensic review to establish how much value moved and over what period.

A finance staff departure that coincides with discrepancies

An accountant or finance manager resigning abruptly — particularly with little notice, or shortly after being asked pointed questions about a reconciliation — followed by discrepancies surfacing in accounts that person controlled, is one of the most common real-world triggers. The pattern that typically prompts a forensic engagement: bank reconciliations that were "always fine" under that person's supervision turn out not to have been performed at all for several months, or a vendor account shows payments to a bank account that does not match the vendor's registered details.

Board or shareholder disputes

When co-owners or shareholders lose confidence in each other's account of how company funds were spent — common in family-run businesses transitioning between generations, or in joint ventures where one partner manages operations and the other does not — a forensic audit becomes the mechanism for producing an independent, evidence-based account of the books that all parties can rely on, rather than each side arguing from its own version of events. This is also frequently the trigger in disputes that are heading toward, or already inside, a legal proceeding.

What the process actually involves

A forensic audit follows a sequence that is deliberately more procedural than a routine audit, because the output has to hold up under challenge.

Document preservation first

Before analysis begins, the relevant records — ledgers, bank statements, vendor files, correspondence, system access logs — are identified and secured in a form that establishes when they were obtained and that they have not been altered afterward. This step exists specifically because forensic findings may later be challenged on the basis that records were tampered with after the fact; a chain of custody addresses that challenge before it can be raised.

Transaction tracing

Rather than sampling transactions the way a statutory audit does, a forensic audit traces the specific transactions relevant to the suspicion end to end — from the originating document, through approval, through payment, through the bank, to the ultimate recipient. Where the trail leads to a related party, a shell arrangement, or an account that does not match the counterparty on record, that is documented with the supporting evidence attached, not summarised as a conclusion.

Interviews

Staff with knowledge of the relevant process — not only the person under suspicion — are interviewed, with notes kept in a form that can be referred back to later. This is one of the clearest procedural differences from a routine audit, where interviews are informal and largely unrecorded; in a forensic engagement, the interview itself can become part of the evidentiary record.

A report built for use outside the company

The final report sets out the scope of the investigation, the methodology followed, the evidence examined, and findings stated in terms that are precise about what the evidence supports and what it does not — a forensic report does not speculate beyond what the documents and testimony establish. Where the matter may proceed to a police complaint, a civil suit, a labour case, or an arbitration, the report is prepared with that eventual use in mind from the outset, rather than reformatted for legal purposes after the fact.

How this differs legally from a routine audit

A statutory audit report is an opinion addressed to shareholders under the Companies Act framework, prepared on the understanding that its evidentiary use, if any, will generally be as one piece of context rather than as the central exhibit in a dispute. A forensic audit report is prepared knowing from day one that it may be tested directly — cross-examined, challenged on methodology, or relied on as the primary evidentiary basis for a claim. That expectation shapes the engagement letter itself: forensic engagement letters typically define the scope of suspicion being investigated far more narrowly and specifically than a statutory audit engagement letter defines the scope of an annual audit, precisely because the forensic exercise is answering one specific question, not forming a general opinion on the financial statements as a whole.

It also changes who is entitled to see the result. A statutory audit report goes to shareholders as a matter of course. A forensic audit report is typically commissioned by, and reports to, whoever ordered the investigation — a board, an audit committee, a specific shareholder group, or occasionally a court or regulator — and its circulation is controlled far more tightly, because the findings, if they point to wrongdoing, carry consequences for named individuals that a routine audit exception never does.