NRB Expands Scope of External Audit Reporting for Banks and Financial Institutions

Nepal Rastra Bank (NRB) has expanded the scope of disclosures required from external auditors of banks and financial institutions.

Issuing a directive on Monday, the central bank instructed auditors to include additional indicators in the Long Form Audit Report starting from the fiscal year 2024/25.

According to the directive, the auditors must now provide their assessment of compliance with the Directive on Non-Banking Asset Management and its effectiveness, as well as the implementation status of the Environmental and Social Risk Management Framework in lending practices.

While assessing operational risks, auditors are also required to examine information technology and cybersecurity control systems, along with the adequacy of control mechanisms related to digital banking operations and digital banking products. Furthermore, they must review whether shortcomings identified by NRB and other regulators in past inspections have been rectified.

The audit report must also disclose the status of policies and procedures related to payment systems, as well as the security of electronic transactions. In addition, banks and financial institutions must report their investments in private equity and venture capital funds, and the activities carried out by their overseas branches, liaison, or representative offices.

Auditors are also required to comment on whether banks have met regulatory requirements regarding priority sector lending. Similarly, they must provide observations on customer protection and financial literacy, including compliance with NRB’s directives on service charges.

The directive further requires auditors to assess compliance with NRB’s instructions issued on the basis of on-site inspections and off-site supervision. They must also evaluate mechanisms established by banks to manage credit, operational, liquidity, and market risks.

Unusual transactions in share-backed lending must be disclosed in the audit report. Moreover, auditors are expected to verify whether adequate loan loss provisions have been made in cases of loan restructuring and rescheduling, and provide details regarding loans backed by personal or corporate guarantees. The report must also cover the identification and auction status of non-banking assets.