Audit and Assurance

Statutory audit is an annual independent audit required by law (Companies Act 2063 and sector-specific Acts) that produces a signed opinion on the financial statements for external users — regulators, shareholders, lenders, the public. It is performed by a registered chartered accountant firm. Internal audit is an independent function within the organisation (often outsourced or co-sourced) that examines internal controls, risk management, and governance for the benefit of management and the board. Statutory audit looks at financial reporting outcomes; internal audit looks at the processes that produce those outcomes.

Under the Companies Act 2063, all public companies, all listed companies, and all private companies above defined paid-up capital and turnover thresholds require statutory audit. Banks and financial institutions, insurance companies, cooperatives above DoC thresholds, and other regulated entities have specific audit requirements under their governing Acts. NGOs and INGOs require audit under the Association Registration Act and SWC requirements. Many smaller private companies below the statutory threshold also commission audit voluntarily for lender and investor purposes.

For a mid-sized private company in stable operation, expect six to eight weeks from kick-off to signed report — covering planning, fieldwork, finalisation, and management discussion. Banks, insurance companies, and large groups take longer (often three to four months) because of the volume of work and regulatory long-form requirements. Year-end audits in Nepal cluster in the Shrawan-Asoj period, so engaging the auditor well in advance helps lock the timeline.

ESG assurance provides independent third-party verification of an organisation's sustainability disclosures — emissions, social metrics, governance indicators. Demand is rising globally as listed companies, financial institutions, and exporters face investor, regulator, and customer expectations on ESG reporting. In Nepal, banks are beginning to publish sustainability disclosures, exporters to developed markets face Scope 3 emissions reporting from customers, and large corporates increasingly publish standalone sustainability reports. ESG assurance — typically limited assurance under ISAE 3000 — gives these disclosures credibility.

Three criteria matter most: ICAN registration and peer review track record; sector experience that matches your business; and partner availability — who specifically will lead your engagement and what is their other portfolio. Beyond these, examine the firm's audit methodology (risk-based vs checklist), staff continuity, fee transparency, and references from existing clients in your sector. Lowest-fee selection often costs more in the end through poor-quality work, retrospective regulator queries, and lender concerns.

Yes, with safeguards. ICAN's Code of Ethics and NSA independence requirements permit non-audit services to audit clients, but with restrictions: services that would create self-review threats (e.g. preparing the financial statements we then audit) require explicit safeguards; services creating advocacy threats (representation before tax authorities) may be incompatible with audit independence depending on the engagement. We assess and document the threats and safeguards on every multi-service relationship and decline engagements where independence cannot be assured.