1. Justification: Risk Assessment is Crucial in Determining Audit Approach (2 marks)

The audit approach — whether it is a compliance (systems-based) approach, a substantive approach, or a mixed approach — cannot be decided in the abstract; it flows directly from the auditor's assessment of risk. The justification rests on the following grounds:

• It drives the nature, timing and extent of audit procedures. Where risk is assessed as high, the auditor must rely more on substantive procedures, test at or near the year-end, examine larger samples and use more reliable (external, documentary) evidence. Where risk is low, greater reliance on internal controls and interim testing becomes possible. Thus risk assessment decides what to test, when to test and how much to test.
• It is the basis of the audit risk model. Audit risk = Inherent Risk × Control Risk × Detection Risk. Since the auditor can control only detection risk, the assessed levels of inherent and control risk directly fix the acceptable detection risk and hence the audit approach.
• It ensures efficient and economical use of audit resources. High-risk areas receive more attention and senior staff time; low-risk areas receive less. This avoids over-auditing safe areas and under-auditing vulnerable ones.
• It enables the auditor to give reasonable assurance and to express an opinion with confidence. By concentrating on areas where material misstatement is most likely, the auditor reduces the risk of issuing an inappropriate opinion to an acceptably low level.
• It is a professional requirement. Standards on Auditing (NSA/ISA 315 and 330) mandate risk assessment and require the audit plan to be responsive to assessed risks.

In short, risk assessment is the bridge between the auditor's understanding of the entity and the design of the audit programme; without it the audit approach would be arbitrary.

2. Factors to Consider in Determining Whether an Area is Risky for Audit Purposes (3 marks)

An area is treated as risky when there is a reasonable possibility of material misstatement, whether due to fraud or error. The following factors are considered:

A. Inherent risk factors (nature of the area itself)

1. Nature of the business and industry — highly regulated, volatile or complex industries (banking, insurance, construction) carry greater risk.
2. Complexity and volume of transactions — large volume, high-value or complex transactions (foreign exchange, derivatives, inter-branch transactions) increase risk.
3. Non-routine or unusual transactions — one-off transactions such as business combinations, restructuring or litigation are harder to audit.
4. Accounting estimates and judgments — areas requiring significant estimation (loan loss provision, depreciation, provision for gratuity, fair value) are inherently risky.
5. Susceptibility to fraud or misappropriation — cash, inventory, receivables and related-party transactions are highly vulnerable.
6. Prior period experience — areas with past errors, qualifications, misstatements or audit adjustments are risk-prone.
7. Degree of manual intervention and IT environment — manual processing and weak or newly implemented IT systems increase risk.
8. Related party transactions — transactions not at arm's length are presumed risky.
9. Changes during the period — changes in management, accounting policy, systems or key personnel raise risk.
10. Going concern and liquidity pressures — financial distress increases the incentive to misstate.

B. Control risk factors

11. Weakness in the control environment — poor tone at the top, lack of segregation of duties, inadequate supervision.
12. Absence or failure of control procedures — no reconciliation, no authorization, no physical safeguards.
13. Ineffective internal audit or monitoring — weak oversight reduces reliance on controls.

C. Other factors

14. Materiality of the area — the larger the balance or class of transactions relative to materiality, the greater the risk.
15. First-year or new engagement — lack of accumulated knowledge increases risk.
16. Regulatory and statutory sensitivity — areas attracting regulatory scrutiny or legal exposure.
17. Extent of reliance on third parties — outsourced functions and service organizations.

Conclusion: An area is classified as risky where these factors indicate a higher likelihood of material misstatement. The auditor then responds by increasing the extent of substantive testing, using more experienced staff, performing procedures at the period end, and applying greater professional skepticism — thereby confirming that risk assessment is indeed crucial in determining the audit approach.

The Auditor General is a constitutional office under Part 23 of the Constitution of Nepal, 2072. Article 240 deals with appointment and tenure, and Article 241 with functions, duties and powers. As the supreme audit institution, it promotes financial accountability and transparency.

Appointment and independence (Article 240):

• Appointed by the President on the recommendation of the Constitutional Council, for a term of six years.
• Removable only on constitutionally prescribed grounds, which secures independence.

Functions and responsibilities (Article 241 and the Auditor General Act):

1. Audit of public accounts: audits the accounts of the Federal, Provincial and Local governments, the courts, the Federal Parliament and Provincial Assemblies, constitutional bodies, and the Nepal Army, Nepal Police and Armed Police Force.
2. Public entities: audits government-owned corporations and bodies in which the government holds a majority share, as provided by law.
3. Standards of audit: examines regularity, economy, efficiency, effectiveness and propriety of expenditure, not only legal compliance.
4. Access to records: may seek any document or information needed for audit.
5. Reporting: submits an annual report to the President, who has it tabled in the Federal Parliament. The report is reviewed by the Public Accounts Committee.
6. Advice: gives opinion when consulted on matters relating to audit and accounts.

Significance: the office acts as a guardian of public funds, curbing irregularities and corruption and strengthening good governance.

Audit planning is the process of developing an overall strategy and a detailed approach for the conduct and scope of an audit before the audit work begins. It is considered fundamental to a quality audit for the following reasons:

1. Sets direction and scope — It defines the audit objectives, scope, timing and the nature, extent and timing of audit procedures, so that the auditor examines the right areas rather than auditing at random.
2. Identifies risk areas — It helps the auditor identify high-risk areas (in a bank: cash, loans and advances, investments, foreign exchange, IT systems) and concentrate audit effort where the risk of material misstatement is greatest. This is the basis of the risk-based audit approach.
3. Ensures efficient use of resources — Audit resources (manpower, time, cost) are limited. Planning allocates them to significant areas, avoiding duplication of work and unnecessary detailed checking of low-risk items.
4. Facilitates coordination and supervision — It allows proper delegation of work among audit staff, coordination with internal and external auditors, and effective supervision and review of work performed.
5. Provides a basis for control and evaluation — A written audit plan serves as a benchmark against which actual performance is monitored, variances are explained, and the quality of the audit is later evaluated.
6. Compliance with standards — NSA/NAS and ISA 300 require that the auditor plan the audit work adequately. Planning is therefore a mandatory requirement for a quality audit, not an optional step.
7. Reduces audit risk — By anticipating problems, planning reduces the risk of overlooking material misstatements and of issuing an inappropriate audit opinion.

In short, planning converts an audit from a mechanical checking exercise into a systematic, risk-focused and quality-assured engagement.

---

Audit planning process in relation to an audit of a bank

A bank audit is complex, voluminous, spread over many branches and highly exposed to financial and operational risk. The planning process therefore follows a structured sequence:

(a) Preliminary engagement activities / client acceptance The auditor evaluates whether to accept or continue the engagement — considering the bank's regulatory status (NRB licensing), integrity of management, availability of competent staff, independence, and any regulatory restrictions. For a bank, compliance with NRB directives and the Bank and Financial Institutions Act must be considered before accepting the engagement.

(b) Establishing the overall audit strategy The auditor determines the scope of the audit (statutory audit under NRB/BFIA, branch audit, consolidated audit), the reporting framework (NFRS/NAS), reporting deadlines (NRB submission dates), and the overall audit approach (risk-based, substantive or combined). The strategy also fixes materiality levels for the bank as a whole and for individual branches.

(c) Understanding the bank and its environment The auditor obtains knowledge of:

• The bank's business — deposits, loans and advances, treasury, foreign exchange, remittance, card business, digital banking.
• Regulatory environment — NRB circulars, directives on loan classification, provisioning, single borrower limits, capital adequacy (Basel III), AML/CFT rules.
• Internal control environment — credit approval process, segregation of duties, dual custody of cash and securities, reconciliation systems, internal audit and compliance functions.
• IT environment — core banking system (CBS), access controls, data integrity, business continuity.

(d) Risk assessment and materiality The auditor performs risk assessment procedures (inquiry, analytical procedures, observation) to identify risks of material misstatement at the financial statement level and at the assertion level. For a bank, key risks include:

• Credit risk — wrong classification of loans, inadequate provisioning, evergreening.
• Liquidity and market risk — valuation of investments, forex positions.
• Operational risk — cash misappropriation, fraud in accounts, KYC failures.
• Compliance risk — breach of NRB directives, AML/CFT lapses. Materiality is set considering total assets, loans and advances, deposits and profit before tax, since banks are asset-heavy institutions.

(e) Developing the audit plan / programme Based on the assessed risks, the auditor prepares a detailed audit programme specifying:

• Areas to be covered (cash, bank reconciliation, loans and advances, investments, deposits, income and expenses, off-balance sheet items).
• Extent of substantive testing and compliance testing.
• Reliance on internal audit and internal control.
• Selection of branches for detailed audit (risk-based branch selection as per NRB norms).
• Use of computer-assisted audit techniques (CAAT) for CBS data analysis.

(f) Staffing and time budget The auditor allocates staff according to the size and complexity of the bank, ensures team members have banking and IT audit skills, assigns responsibilities, and prepares a time and cost budget for the engagement.

(g) Coordination and communication The auditor coordinates with the bank's internal audit, compliance and risk management departments, with the NRB where required, and with other auditors of the bank's group. The audit plan is discussed with those charged with governance (Audit Committee of the Board) before execution.

(h) Documentation and approval The overall strategy, risk assessment, materiality and audit programme are documented in the audit working papers and approved by the engagement partner. This documentation is evidence of a properly planned, quality audit.

(i) Continuous review and revision Planning is not a one-time activity. During the audit of a bank, new risks (e.g., large NPLs discovered, system failures, regulatory changes) may require revision of the plan. The auditor updates the plan and documents the reasons for change.

Conclusion In a bank, where public money, depositor confidence and regulatory compliance are at stake, planning ensures that the audit is directed at the right risks, carried out efficiently and documented properly — all of which are essential conditions for a quality audit.

Internal Control

Internal control is the system of policies, procedures, practices and organisational arrangements established by an entity's management and governing body to provide reasonable assurance regarding the achievement of objectives relating to:

1. Effectiveness and efficiency of operations – including safeguarding of assets against loss, misuse or fraud.
2. Reliability of financial and operational reporting – both internal and external.
3. Compliance with applicable laws, regulations, policies and contracts.

Key features of the concept:

• It is a process, not a single event or a pile of manuals — it is ongoing and embedded in the way management runs the business.
• It is effected by people at every level — board, management and all staff — not merely by policy documents.
• It provides only reasonable, not absolute, assurance, because of inherent limitations such as cost–benefit constraints, human error, collusion and management override.
• It is objective-driven — controls exist to help achieve objectives, so the design of controls follows the risks threatening those objectives.
• It is risk-based — controls are proportionate to the significance of the risk being mitigated.

In banking, internal control is especially critical because banks handle public deposits, large cash volumes, high transaction frequency and exposure to fraud, money laundering and regulatory penalties. Weak internal control in banks has historically led to major failures (e.g., Barings Bank), which is why regulators treat it as a supervisory concern.

---

Critical Components of Internal Control (COSO Framework)

The internationally accepted framework is the COSO Internal Control – Integrated Framework (Committee of Sponsoring Organizations of the Treadway Commission; original 1992, revised 2013). It identifies five interrelated components, supported by seventeen principles. These components apply to all organisations, including banks.

1. Control Environment (the foundation)

This is the set of standards, processes and structures that provide the basis for carrying out internal control across the organisation. It reflects the tone at the top.

• Demonstrated integrity and ethical values — a written code of conduct, whistle-blower policy, and disciplinary action for violations.
• Board of Directors demonstrates independence from management and exercises oversight of internal control; in banks, an Audit Committee of the board is essential.
• Management establishes, with board oversight, structures, reporting lines, authorities and responsibilities.
• Commitment to attract, develop and retain competent individuals — proper recruitment, training and succession planning.
• Individuals are held accountable for their internal control responsibilities.

In a bank, this component includes a clear organisational structure, a functioning Audit Committee, a code of ethics, and a culture where staff can report irregularities without fear.

2. Risk Assessment

A dynamic and iterative process for identifying and assessing risks to the achievement of objectives, forming the basis for how risks are managed.

• Objectives are specified with sufficient clarity to enable identification and assessment of risks.
• The organisation identifies risks across the entity and analyses them as a basis for determining how they should be managed (risk register, risk rating, risk appetite).
• It considers the potential for fraud in assessing risks — including incentives and pressures, opportunities, and attitudes/rationalisation.
• It identifies and assesses changes that could significantly affect the system of internal control — regulatory changes, new technology, new products, restructuring, rapid growth.

For a bank, this means assessing credit risk, liquidity risk, operational risk, market risk, cyber risk and AML/CFT risk, and mapping controls to each.

3. Control Activities

These are the actions established through policies and procedures that help ensure management's directives to mitigate risks are carried out. They occur at all levels and in all functions.

• Segregation of duties — separation of authorisation, custody of assets, and recording (no single person controls a transaction end to end).
• Authorisation and approval — proper approval limits and hierarchies; dual authorisation for high-value transactions.
• Physical controls — custody of cash, vaults, restricted access to IT systems and records.
• Reconciliations — bank reconciliation, inter-branch reconciliation, nostro/vostro accounts, general ledger scrutiny.
• Verification and review — maker–checker system, supervisory review, exception reports.
• IT general controls and application controls — access controls, change management, segregation of duties in systems, input/processing/output controls.
• Performance reviews — comparing actual against budgets, forecasts and prior periods.

4. Information and Communication

Relevant, accurate and timely information must be identified, captured and communicated so that people can carry out internal control responsibilities.

• The organisation obtains or generates relevant, quality information to support the functioning of internal control.
• It communicates internally — objectives, responsibilities, policies, procedures and results, including to the board.
• It communicates externally — to regulators (NRB), auditors, depositors, shareholders and other stakeholders on matters affecting internal control.

In banks, this includes MIS reports to management, board reporting, whistle-blower channels, regulatory reporting to Nepal Rastra Bank, and disclosure requirements.

5. Monitoring Activities

Ongoing evaluations, separate evaluations, or a combination of both, used to ascertain whether each component of internal control is present and functioning.

• Ongoing monitoring — built into daily operations: supervisory checks, exception reporting, reconciliation, internal audit follow-up.
• Separate evaluations — periodic internal audit, external audit, regulatory examination, compliance testing.
• Evaluation and communication of deficiencies — deficiencies are reported to management and the board in a timely manner, with serious matters escalated to the board and, where required, to the regulator.

In a bank, this component is operationalised through a three lines of defence model: business units (first line), risk and compliance functions (second line), and internal audit (third line), with the board and audit committee providing oversight.

---

Conclusion

Internal control is a continuous, risk-based process designed to give reasonable assurance about operations, reporting and compliance. The COSO framework's five components — control environment, risk assessment, control activities, information and communication, and monitoring — together with their underlying principles, provide the internationally recognised structure for designing, implementing and evaluating internal control. For a bank like Nepal Bank Limited, adherence to this framework, reinforced by NRB directives and the three lines of defence model, is essential for safeguarding depositors' funds, ensuring reliable reporting and maintaining regulatory compliance.

INTOSAI Standards and the Office of the Auditor General of Nepal

1. Description of INTOSAI Standards (4 marks)

INTOSAI (International Organization of Supreme Audit Institutions) is the global body of Supreme Audit Institutions (SAIs), of which the Office of the Auditor General (OAG) of Nepal is a member. It issues the International Standards of Supreme Audit Institutions (ISSAIs), which form the professional framework for public sector auditing. The standards are organized into a four-tier hierarchy:

• Level 1 – Founding Principles: ISSAI 1, the Lima Declaration (1977), which lays down the basic requirements of an SAI, including its independence.
• Level 2 – Prerequisites for the Functioning of SAIs: ISSAI 10–99 (e.g., ISSAI 10 – Mexico Declaration on SAI Independence, ISSAI 20 – Principles of Transparency and Accountability, ISSAI 30 – Code of Ethics, ISSAI 40 – Quality Control).
• Level 3 – Fundamental Auditing Principles: ISSAI 100–400, covering general principles (ISSAI 100), financial audit (ISSAI 200), performance audit (ISSAI 300) and compliance audit (ISSAI 400).
• Level 4 – Auditing Guidelines: Detailed, operational guidance such as ISSAI 1000–2999 (financial audit), 3000–3999 (performance audit) and 4000–4999 (compliance audit), largely aligned with IFAC/INTOSAI pronouncements.

Thus, INTOSAI standards cover independence, ethics, quality control, transparency and the conduct of different types of audit in the public sector.

2. Contribution of INTOSAI Standards to the OAG of Nepal (6 marks)

(a) Contribution to Independence

• ISSAI 10 (Mexico Declaration) sets out eight principles of SAI independence: an appropriate legal framework, independence and security of tenure of the head of the SAI, a sufficiently broad mandate, unrestricted access to information, the right and obligation to report, freedom to decide the content and timing of reports, effective follow-up mechanisms, and financial and managerial autonomy. The OAG derives its mandate from Articles 240 and 241 of the Constitution of Nepal (2015) and the Auditor General Act, 2075, which broadly reflect these principles.
• The constitutional provision that the Auditor General is appointed by the President on the recommendation of the Constitutional Council, holds office for a six-year term, and can be removed only on constitutionally prescribed grounds, reflects ISSAI 10's requirement of security of tenure.
• ISSAI 10 also requires financial and administrative autonomy. The OAG's budget is charged to the Consolidated Fund and its staffing and procurement decisions are largely independent, reducing executive influence.
• ISSAI 20 (Transparency and Accountability) obliges the OAG to publish its audit reports and make its mandate, strategy and audit findings publicly accessible, which strengthens its credibility and thereby its de facto independence.

(b) Contribution to Ethical Standards

• ISSAI 30 (Code of Ethics) provides the ethical foundation for the OAG's staff, based on five core values: integrity, independence and objectivity, competence, confidentiality and professional behaviour.
• The OAG has adopted these values in its Code of Conduct and in its Audit Manual, requiring auditors to declare conflicts of interest, refuse gifts or favours, and maintain political neutrality.
• ISSAI 30's threat-and-safeguard approach (self-interest, self-review, familiarity, intimidation and advocacy threats) helps the OAG identify and mitigate ethical risks in a politically sensitive environment.
• Ethical compliance is reinforced through training, rotation of audit teams and disciplinary provisions, which reduce the risk of collusion between auditors and auditees.

(c) Contribution to Quality of Audit Work

• ISSAI 40 (Quality Control) requires the OAG to establish a system of quality control covering leadership, ethical requirements, acceptance and continuance of audits, human resources, engagement performance and monitoring.
• The OAG accordingly maintains an Audit Manual, Quality Assurance Manual and Audit Charter, and conducts internal quality reviews and periodic peer reviews by other SAIs.
• Level 3 and 4 ISSAIs (ISSAI 100, 200, 300, 400 and their guidelines) provide the methodology for planning, evidence collection, documentation, reporting and follow-up, ensuring audits are risk-based, evidence-based and consistent.
• ISSAI 20 requires the OAG to report on its own performance and finances, which promotes accountability and continuous improvement in audit quality.
• Compliance with ISSAIs also enables the OAG to participate in INTOSAI's IDI (INTOSAI Development Initiative) capacity-building programmes, further enhancing staff competence.

Conclusion

The INTOSAI standards, particularly ISSAI 10, 20, 30 and 40, provide the constitutional, ethical and methodological backbone of the OAG of Nepal. They safeguard its independence, instil professional ethics in its staff, and ensure that its audit work is of high quality, credible and internationally comparable — thereby strengthening accountability and good governance in the use of public funds in Nepal.