Risk & Regulation

A functioning ERM programme has four moving parts: a risk taxonomy that lists the categories of risk relevant to the business; a risk appetite statement that says how much of each risk the board is prepared to accept; processes that identify, measure, and report on risk against appetite; and clear ownership of each material risk by a named executive. Documents alone don't constitute ERM — the test is whether risk information shapes how the business actually operates. NRB and NIA increasingly assess this in supervision.

Reporting entities under the Asset (Money) Laundering Prevention Act 2064 and its rules — BFIs, insurance companies, securities firms, casinos, real estate dealers, dealers in precious metals, and certain other designated entities — must perform customer due diligence at onboarding, enhanced due diligence for higher-risk customers and PEPs, ongoing transaction monitoring, suspicious transaction reporting to the Financial Information Unit, record-keeping, AML training, and have a designated AML compliance officer. Sectoral regulators (NRB, NIA, SEBON) layer on additional requirements.

Risk-based capital sizes the regulatory capital an insurer must hold to its actual risk profile rather than to flat percentages of premiums or reserves. Components typically include capital for insurance risk (underwriting and reserving), market risk (asset value movements), credit risk (counterparty exposures), and operational risk. The Nepal Insurance Authority has been phasing in an RBC framework following international practice. Implementation requires data, models, governance, and capital planning — it is a programme, not a year-end calculation.

For Nepali context, the COSO Internal Control framework (Integrated Framework) is the most widely used and is referenced by ICAN, NRB, and other regulators. COSO ERM (Enterprise Risk Management) extends to risk management. Companies with US-listed parents may need to apply SOX 404 controls testing. The framework is less important than its application — even the best framework fails if the underlying control activities aren't designed to actually mitigate the risks the business faces.

Yes — advisory engagements responding to NRB, NIA, SEBON, or other regulatory inspections are recurring work. We help with response drafting, management action plan development, remediation programme design, and follow-up testing to confirm closure. Where independence rules permit, we can also support pre-inspection readiness. Where we are the statutory auditor, our role is limited to clarifying audit work performed rather than advising on response strategy.