Internal Audit in Nepal: What It Actually Covers and Why It Is Not Optional for Many Businesses

Ask a business owner in Kathmandu what internal audit is, and most will describe statutory audit instead — the annual exercise that produces the signed report filed with the Office of Company Registrar. The two are not the same function, they are not performed by the same mandate, and confusing them is the most common reason internal audit gets treated as an optional extra rather than a control mechanism a company genuinely needs.

Prepared by Nishant Marasini and team · Position stated as at 22 September 2026

Two different jobs, not two sizes of the same job

Statutory audit exists to let an external, independent auditor express an opinion on whether the financial statements present a true and fair view, for the benefit of shareholders, regulators and lenders who were not in the room when the transactions happened. It is backward-looking, annual, and its output is a single opinion attached to one year's numbers.

Internal audit exists for a completely different reader — management and the board — and asks a completely different question: are the controls that are supposed to protect the company's assets and its financial reporting actually operating, day to day, the way they are meant to? It is not concerned with whether last year's balance sheet was fairly stated. It is concerned with whether the purchase approval matrix was followed in March, whether the physical stock count in the Biratnagar warehouse matches the system quantity, and whether the person who approves supplier payments is the same person who can also add a new supplier to the vendor master. Statutory audit samples transactions to support an opinion. Internal audit walks the process itself.

Because the two functions ask different questions, a company can pass its statutory audit cleanly and still be bleeding cash through a procurement process nobody has actually tested since the ERP was implemented four years ago. Statutory auditors are not designed to catch that, and under professional standards they are not required to.

Who is actually required to have one

For a meaningful share of Nepali entities, internal audit is not a governance nicety — it is a regulatory requirement, and in some sectors a condition of the operating licence.

• Banks and financial institutions. Nepal Rastra Bank's directives require licensed banks and financial institutions to maintain an internal audit function reporting to the board's audit committee, independent of executive management, with a defined audit charter and a risk-based annual audit plan covering branches and head office departments on a rotating basis. A commercial bank that lets six months pass without a branch audit is not meeting the supervisory expectation, and NRB inspection teams check for exactly this.
• Insurance companies. The Nepal Insurance Authority's governance directives carry a parallel requirement — an internal audit function that reports functionally to the audit committee, not to the CEO.
• Listed companies. Companies listed on the Nepal Stock Exchange are expected, under SEBON's corporate governance directives, to maintain an internal audit function or equivalent arrangement as part of the audit committee's oversight structure, alongside the statutory auditor.
• Larger private and cooperative entities. Outside a strict statutory trigger, internal audit becomes a practical necessity once a company has multiple locations, a workforce large enough that the owner can no longer personally verify every transaction, or outside investors who want assurance between annual audit cycles. A manufacturing company with three factories and a distributed sales team is not legally compelled to run internal audits — but by the time inventory sits in four different warehouses and is handled by staff the owner has never met, the absence of one is a decision, not a default.

What an internal audit actually examines

A competent internal audit does not produce a list of exceptions and stop there. It names the control that failed and what needs to change, which is the entire point of the exercise — an exception without a root cause is just a number for a file. The recurring areas of focus in Nepali businesses:

Inventory controls

Physical counts reconciled against system records, movement of goods between warehouses and branches, write-off and damage approval trails, and — particularly relevant for trading and manufacturing businesses — whether shrinkage is consistent with the nature of the goods or points to something that needs a closer look. A distributor whose warehouse shows 3% shrinkage on fast-moving consumer goods is within a plausible range; the same 3% on a product line that does not spoil or break easily is a finding that deserves a name and a follow-up, not a footnote.

Cash and banking controls

Segregation of duties between whoever initiates a payment, whoever approves it, and whoever reconciles the bank statement. Petty cash handling at branch level. Whether cheque signatories and online banking access actually match the board-approved authority matrix, which in practice drifts within a year or two of being set unless someone checks it.

Procurement

Whether purchase orders are raised before goods are received rather than after, whether vendor selection follows a documented process or defaults to whoever the purchase officer knows, and whether related-party vendors — a supplier owned by a director's relative, for instance — are disclosed and priced at arm's length rather than quietly absorbed into routine purchasing.

Receivables

Ageing analysis against the credit terms actually extended, write-off approvals, and whether the sales team's informal credit extensions to preferred customers are visible to finance at all or only surface when a customer stops paying.

Cadence: quarterly or annual

For NRB-regulated banks and financial institutions, the internal audit plan is typically structured around quarterly reporting to the audit committee, with individual branches and departments cycling through a risk-based schedule over the year rather than every unit being audited every quarter. High-risk branches — new branches, those with prior findings, or those handling large cash volumes — get visited more often than low-risk ones.

For a private company without a regulatory mandate, the right cadence depends on transaction volume and how distributed the operations are. A single-location business with a small team can often manage with a thorough annual internal review timed a few months ahead of the statutory audit, so findings can be corrected before the external auditor arrives. A multi-branch retail or distribution business, by contrast, benefits from quarterly cycles — waiting a full year to discover that a branch's stock reconciliation has been wrong since April means twelve months of a control failure compounding before anyone notices.

Why the distinction from statutory audit matters in practice

A board that treats the statutory audit opinion as proof that "everything is fine operationally" is reading the wrong document for that question. The statutory auditor's opinion covers whether the financial statements are fairly presented in aggregate; it does not certify that every control in the organisation is functioning, and it is not designed to. Internal audit is the mechanism that actually tests the controls themselves, on a schedule the company sets, reporting to people who can act on the findings before they become a material misstatement or a fraud loss that the annual audit only discovers after the fact.