
Internal audit is an ongoing, internal process. It is performed by the company’s own staff or an outsourced firm to evaluates risk, strengthens internal controls, and improves operational efficiency throughout the year.
External audit is an independent, statutory review of a company's financial statements, conducted once a year by a licensed Chartered Accountant registered with the Institute of Chartered Accountants of Nepal (ICAN). Under the Companies Act 2063, every private and public limited company in Nepal must appoint an external auditor to make it a legal obligation, not a choice.
Who performs the final audit?
An ICAN-registered CA appointed at the company's AGM
Submission deadline: Within 6 months of fiscal year-end (by Poush)
Unlike the external audit, Nepal's legal framework does not mandate that an internal auditor hold a specific professional licence (like a Chartered Accountant license). This makes the internal audit function considerably more flexible in terms of who can perform it.
In practice, internal audits in Nepal are carried out by one of three arrangements:
- In-house internal audit department. Large companies, banks, and financial institutions regulated by the Nepal Rastra Bank (NRB) are required to maintain a dedicated internal audit department. These staff members are employees of the company and report directly to the audit committee or the board of directors.
- Outsourced audit firm. Small and medium enterprises (SMEs) commonly hire an external accounting or consultancy firm on a monthly or quarterly retainer to perform internal audit functions. The firm conducts periodic reviews of specific departments. Finance, procurement, inventory, payroll and submits findings with these departments to management.
- Individual internal auditor. Some companies appoint a single qualified individual, often a CA or a semi-qualified accountant, to manage the internal audit function on a part-time or contract basis.
The critical distinction is the reporting line. The internal auditor can be whether in-house or outsourced reports to the company's management or board, not to shareholders or the government. Their findings are internal documents used for operational improvement. They do not carry the legal authority of an external audit opinion.
Best Practice for Internal Audit in Nepal: ICAN has published an Internal Audit Manual 2025. It aims to establish a standard and encourages only the qualified professionals for auditing to ensure conformity with international standards.
The final audit of a company in Nepal is the external audit, and it is a statutory requirement & not optional. Under the Companies Act 2063, Section 111, every private and public limited company registered in Nepal must appoint an auditor to examine its financial statements at the end of each fiscal year. This auditor must be an independent professional entirely separate from the company's management, ownership, or internal staff.
The Institute of Chartered Accountants of Nepal (ICAN) is the main authority in Nepal that provides licenses and regulates auditors. Established under the Nepal Chartered Accountants Act 2053, ICAN sets the professional standards, issues Certificates of Practice, and governs the conduct of all auditors operating in the country.
For an auditor to legally perform an external audit in Nepal, they must meet all three of the following conditions:
ICAN also mandates that its members follow the Nepal Standards on Auditing (NSA), which are aligned with the International Standards on Auditing (ISA) issued by the IAASB. This alignment means an external audit conducted in Nepal meets internationally recognised benchmarks, which matters when seeking foreign investment or bank financing.
If your auditor does not hold a current ICAN Certificate of Practice, their audit report has no legal standing. The OCR can reject the submission and the company remains non-compliant.
The Companies Act 2063 establishes a clear, mandatory process for appointing the external auditor. Failing to follow this process correctly is itself a compliance violation, separate from the audit submission deadline.
Step 1 Appointment at the Annual General Meeting (AGM). Under Section 111 of the Companies Act 2063, the appointment of the external auditor must be approved by the shareholders at the company's Annual General Meeting. The board may propose a candidate, but the final appointment authority rests with the shareholders through a resolution.
Step 2 ICAN eligibility verification. Before formally appointing an auditor, the company must confirm that the proposed CA or RA holds a valid Certificate of Practice from ICAN for the current fiscal year. Appointing an auditor without a current CoP renders the appointment invalid.
Step 3 Notification to the Office of the Company Registrar. Following the AGM resolution, the company must formally notify the OCR of the appointed auditor's name, ICAN registration number, and Certificate of Practice details. This notification must be filed within the prescribed timeline.
Step 4 Audit completion and submission. The appointed auditor has until six months after the end of the fiscal year (i.e., by mid-Poush/January) to complete the audit and submit the audited financial statements to the OCR. The fiscal year in Nepal runs from 1st Shrawan to the last day of Ashad (mid-July to mid-July).
Step 5 Reappointment or rotation. At the following AGM, shareholders either reappoint the same auditor or appoint a new one. While Nepal's law does not currently mandate mandatory auditor rotation for all companies, NRB-regulated institutions have specific rotation requirements under Nepal Rastra Bank directives.
Note: A company that fails to appoint an auditor at its AGM, appoints an unqualified individual, or misses the submission deadline faces financial penalties from the OCR, potential delisting, and difficulties renewing its business licence.
Most business owners in Nepal understand that both audits exist. Fewer understand how fundamentally different they are in when they happen, what they examine, who they report to, and what they cost. This section breaks down each dimension clearly so you can plan both functions with confidence.
Internal audit operates on a continuous cycle throughout the fiscal year. There is no single "audit season." Instead, the internal audit function runs scheduled reviews across departments at regular intervals. The key principle is that internal audit findings reach management while there is still time to correct problems within the fiscal year.
External audit is a point-in-time exercise tied directly to Nepal's fiscal calendar. Nepal's fiscal year runs from 1st Shrawan to the last day of Ashad. Under the Companies Act 2063 and the Income Tax Act 2058, companies have six months from the end of the fiscal year to complete the external audit and submit audited financial statements to the Office of the Company Registrar (OCR) and the Inland Revenue Department (IRD). Missing this six-month deadline is a compliance violation in its own right, separate from any findings within the audit itself.
Internal audit reports travel upward within the organisation. The internal auditor submits their findings to the audit committee (where one exists) or directly to senior management and the board of directors. The internal audit findings commonly consist of identified weaknesses, control failures, and recommendations. In banks and financial institutions, Nepal Rastra Bank directives require that internal audit findings be reported to the board-level audit committee, not just to management, specifically to prevent management from suppressing unflattering findings.
These reports are confidential and do not go to the government, shareholders, or the public. Their purpose is corrective that gives management the information needed to fix problems before the external auditor finds them, or before they become financial losses.
External audit reports move in the opposite direction, outward and upward, beyond the company itself. The external auditor's report is addressed to the shareholders of the company, not to management. It is presented at the Annual General Meeting and filed with the Office of the Company Registrar as a public document. The Inland Revenue Department relies on the audited financial statements for tax assessment. Banks require the external audit report before extending or renewing credit facilities. Any investor conducting due diligence on your company will examine this report.
This means the external audit report carries legal and public accountability that the internal audit report does not. A qualified or adverse opinion from an external auditor is a serious public finding with direct consequences for banking relationships, regulatory standing, and investor confidence.
Internal audit costs are structured as an ongoing operational expense rather than a single annual fee. Companies in Nepal typically fund this function in one of three ways:
- An in-house internal audit team involves a fixed salary cost. A qualified internal auditor in Kathmandu typically commands a monthly salary depending on experience and qualifications.
- An outsourced internal audit retainer with a professional firm is the most cost-effective model for small and medium-sized businesses in Nepal. This is the model most businesses in Kathmandu use for audit functions that do not require a dedicated full-time resource.
- A project-based internal audit engagement. They will hire a firm for a one-time review of a specific department or process
External audit costs are governed by the ICAN Minimum Audit Fee Guidelines (issued under the Guideline for Audit Firms and Fixation of Fees Directive 2078), which set a floor below which a licensed CA cannot legally charge. ICAN established these minimum fees taking into account the complexity of assignments, professional knowledge required, time spent, and prevailing market conditions.
Source: ICAN Minimum Audit Fee Guidelines, Directive 2078 (effective 2078-04-01). Fees are minimum thresholds; actual fees may be higher based on complexity and firm seniority.
Internal and external audit are not competing options. They serve entirely different purposes and fill different gaps. Choosing one over the other is not a cost-saving decision; it is an exposure decision. Here is what each gap actually costs.
No Immediate Penalty, But High Long-Term Risk
Internal audit has no statutory deadline in Nepal, leading many businesses to ignore it—until issues compound into serious financial and compliance problems.
Accumulation of Financial Errors
Mistakes in VAT filings, payroll, and purchase records go unchecked throughout the year, resulting in audit qualifications, IRD notices, or costly write-offs.
Increased Risk of Fraud and Leakage
Lack of internal checks allows inventory losses, procurement fraud, and cash mismanagement—especially in SMEs where roles are not segregated.
No Early Warning for Tax Compliance Issues
Without internal audit, businesses fail to track frequent changes in VAT and TDS rules by Nepal’s IRD, leading to penalties and non-compliance.
Poor External Audit Outcomes
Absence of internal audit leads to disorganized records, increasing the likelihood of qualified audit reports and extended audit timelines.
Stronger Internal Controls Reduce Audit Effort
Well-maintained records allow external auditors to rely on internal systems, reducing testing and audit costs.
Faster and More Efficient Audit Process
Pre-prepared documents like bank reconciliations, debtor aging, and creditor confirmations save time and avoid last-minute stress.
Accurate Inventory and Financial Reporting
Regular stock reconciliation and proper documentation eliminate common audit disputes.
Better Tax Compliance Throughout the Year
Quarterly reviews of VAT, TDS, and advance tax ensure error-free final tax computation.
Cleaner Audit Opinions and Reduced Risk
Businesses with internal audit functions typically receive unqualified audit opinions and fewer IRD queries.
Cost Savings in the Long Run
Internal audit costs are significantly lower than penalties, extended audit fees, or tax disputes.
Penalties Under Companies Act 2063
- Failure to submit audited financials within 6 months leads to fines.
- Continued non-compliance results in annual fines (NPR 5,000–20,000).
- Directors may face personal penalties for delays.Penalties Under Companies Act 2063
Income Tax Act 2058 Consequences
- IRD may issue a best judgment assessment, often increasing tax liability.
- Amendments can occur within 4 years or anytime in fraud cases.
Operational and Business Restrictions
- Business license renewals may be blocked.
- Banks may refuse loan renewals without audited reports.
- OCR filings become publicly visible, impacting credibility and due diligence.
Public Record: You are correct that external audits filed at the OCR become part of the public record, which is why they are vital for bank loans and investor due diligence in Kathmandu's business environment.
The ICAN Directive: The reference to Directive 2078 is spot on. ICAN (Institute of Chartered Accountants of Nepal) strictly enforces these minimum fee floors to prevent "low-balling" and ensure audit quality.
IRD Reliance: The Inland Revenue Department (IRD) uses the audited financials as the base for tax assessment. If your audit is missing or "qualified," the IRD frequently triggers a "Best Judgment Assessment," which almost always results in higher tax bills and penalties.
Operational Reality: For SMEs in Nepal, the point about VAT and TDS errors is the most common reason for internal audits. Because Nepal’s tax rules change frequently via the annual Financial Act (Aarthik Ain), internal audits act as a vital safety net.
Minor Detail to Keep in Mind:
While internal audit reports are "internal," keep in mind that Nepal Rastra Bank (NRB) or the Insurance Authority can demand to see internal audit reports during their own regulatory inspections of banks or insurance companies.