The two audits answer different questions for different audiences. The statutory audit answers, once a year and for the outside world: do these financial statements present a true and fair view? Internal audit answers, continuously and for the board and management: are our controls working, are our risks managed, and is the organisation actually following its own policies? Conflating the two leaves a governance gap that the statutory audit was never designed to fill.
What the statutory audit does not do
A statutory audit is scoped to the financial statements. It tests controls only to the extent needed to form the opinion, samples rather than examines everything, and reports primarily on the numbers — not on operational efficiency, procurement integrity, IT security or compliance with internal policy. Independence rules also restrict the statutory auditor from designing or operating the client's controls: an auditor who built the system cannot then objectively opine on its output.
What internal audit adds
- Continuous assurance over internal controls — approvals, segregation of duties, reconciliations — rather than a once-a-year snapshot.
- Risk-based coverage: procurement, inventory, payroll, revenue leakage, related-party transactions, IT access.
- Fraud deterrence — the known presence of periodic independent review changes behaviour.
- Actionable recommendations tracked to closure, giving the board evidence that findings are fixed, not filed.
- For NGOs and INGOs, donor-required assurance over programme spending and sub-grantee compliance.
Signals that you need an internal audit function
Growth is the usual trigger: multiple locations or branches, delegated procurement, inventory that no single person can physically oversee, headcount past the point where the founder signs everything, or donor and regulatory requirements that demand documented controls. In banks and certain regulated entities, internal audit is mandatory; elsewhere it is a choice — but the businesses that choose it early tend to be the ones whose statutory audits, years later, produce clean opinions and short management letters.
In-house or outsourced?
A full-time internal audit department is justified at scale. Below that, outsourcing the function to a professional firm delivers senior, independent capability on a periodic cycle — quarterly or trimester reviews against a risk-based plan agreed with the board. The statutory auditor must remain independent of this work, which is precisely why many organisations engage one firm for the statutory audit and a different firm for internal audit.
Frequently asked questions
- Is internal audit mandatory in Nepal?
- For banks, financial institutions and certain regulated entities, yes — sector regulators require it. For most private companies it is voluntary, but boards increasingly adopt it as the organisation grows.
- Can our statutory auditor also do our internal audit?
- Professional independence rules restrict an auditor from auditing controls or records they themselves designed or operated. Best practice is to separate the two engagements across different firms.
This note is general information prepared by A. Adhikari & Associates, Chartered Accountants, and is not professional advice for any specific situation. Rates, thresholds and procedures change through annual Finance Acts and regulatory updates — please consult our team before acting.
