Last reviewed: 20 October 2026
An NRB IS audit is a recurring obligation for banks and financial institutions in Nepal, yet many teams still prepare for it the week before fieldwork starts. This guide explains where the requirement comes from in Nepal Rastra Bank's own documents, what an information systems audit in a Nepali bank should cover, and how to prepare evidence so the audit tells you something useful.
It draws on two primary NRB documents: the Information Technology Guidelines (August 2012) issued by the Bank Supervision Department, and the Cyber Resilience Guidelines (August 2023) issued by the Payment Systems Department. Where this article quotes them, the quote is taken from those documents.
Where the IS audit requirement comes from
The NRB IT Guidelines
The IT Guidelines have a dedicated section on IS audit. Its core sentence is short: "banks should conduct IS audit annually." The stated purpose is "to ensure the effectiveness of implemented controls framework and adequacy of the adopted security plan and procedures."
Two more points from that section shape how the audit is run:
- Resourcing is a board matter. "Board or the audit committee should provide sufficient resources to conduct audit to ensure the audit team is capable of evaluating IT controls in sufficient IT coverage."
- Outsourcing is allowed, accountability is not. If a bank lacks staff or expertise, "IS audit can be outsourced to external professional provider. However; the responsibility of audit planning, risk assessment and follow up rests on the bank." The guidelines add that "the audit committee should ensure that the outsourced service provider has expertise and experience in IS Audit."
On scope of application, the guidelines speak of commercial banks, and a footnote defines the term: "Bank in this document refers Bank and Financial Institutions licensed by NRB." They also state that "the extent of compliance of this guideline will be examined during the periodic onsite/offsite supervision from NRB."
The NRB Cyber Resilience Guidelines
The 2023 Cyber Resilience Guidelines (CRG) apply to "institutions licensed by the Payment Systems Department i.e., A, B, C, D class BFIs along with Payment System Operators (PSO) and Payment Systems Providers (PSP)."
They reinforce the audit expectation from the resilience side:
- "Through independent compliance programs and audits carried out by qualified staff, the LI shall periodically evaluate and measure the sufficiency and effectiveness of its cyber resilience framework (including all security controls) and adherence to it."
- "The LI should routinely order an external audit."
The CRG also makes clear it is not a checklist: it "is not meant to serve as a check list for technical requirements or control requirements," and NRB "will assess whether the LI is complying with the requirements outlined in the CRG" based on "the LI's own risk-based methodology and its criticality within the Nepalese financial system."
In practice, this means an IS audit that only ticks items from a list is weaker evidence than one that tests whether your controls actually manage your assessed risks.
What an NRB IS audit should look at
The IT Guidelines are organized into areas that map naturally to an audit programme. Their table of contents lists IT governance, information security, information security education, information disclosure and grievance handling, outsourcing management, IT operations, systems acquisition and development, business continuity and disaster recovery, IS audit, and fraud management.
A few requirements from those areas tend to generate the most audit findings, so it is worth checking them early:
- Board-approved policy. "Bank should have a board approved IT related strategy and policy and IT policy should be reviewed at least annually." There should also be "a board approved Information Security Policy addressing all electronic delivery channels and payment system."
- Risk assessment cadence. Banks "should conduct Risk Assessment periodically (at least annually) for each asset that has possibility of impacting the CIA of the information of the bank."
- Access on a need-to-know basis. Access "should be in 'need to know' basis and with least privilege and it should be for required time only," with privileged users "closely" supervised.
- Security testing. The guidelines ask banks to "regularly assess the security health of the organization and detect and fix the vulnerabilities," and add: "It is recommended to conduct penetration testing of the system periodically."
- Audit trails. Each application handling sensitive information needs "the detail audit trail with transaction id, date, time, originator id, authorizer id, action taken etc."
- Outsourcing. "Board and senior management are responsible for due diligence, oversight and management of risks associated with outsourcing." Agreements must recognize the authority of regulators "to carry out any inspection, supervision or examination of the service provider."
- Business continuity. BCP "should be periodically, at least annually, tested to ensure its effectiveness," and testing "should be audited by internal audit of the bank."
- Fraud reporting. "Banks should identify and document all electronic attacks and suspected electronic attacks in their system and report to Nepal Rastra Bank monthly."
- A named owner. "Bank should designate a senior official of the bank as Information Security Officer (ISO) who will be responsible for enforcing information security policy of the bank."
For institutions under the CRG, add the governance layer: the cyber resilience framework "should be approved by the LI board," and the CRG expects "an internal, cross-disciplinary steering committee comprised of senior management and appropriate staff" to develop the strategy and framework.
Choosing and managing the auditor
Because the bank keeps responsibility for "audit planning, risk assessment and follow up" even when the audit is outsourced, treat auditor selection as a governance decision, not a procurement one.
- Check expertise, as the guidelines require. Ask for the team's IS audit experience in Nepali banks and financial institutions, and who will actually do the fieldwork.
- Keep the auditor independent. The CRG says tests should be "carried out by independent parties, whether internal or external." An auditor that also designed or operates the controls under review is marking its own work.
- Agree the scope in writing. List the systems, locations, outsourced services and delivery channels in scope before fieldwork begins.
- Plan the follow-up before the audit. Decide who owns each finding, how remediation is tracked, and how the audit committee will see progress.
Preparation checklist
Use this list well before fieldwork starts. Every item ties back to a requirement quoted above.
| Prepare | Evidence the auditor will ask for |
|---|---|
| IT strategy and IT policy | Board approval, last annual review date |
| Information Security Policy | Board approval; coverage of all delivery channels and payment systems |
| Asset-based risk assessment | Current assessment, no older than a year, with owners |
| Access management | Need-to-know approvals, privileged user list, activity logs |
| Security testing | Latest vulnerability assessment and penetration test reports, with remediation status |
| Audit trails | Samples showing transaction id, time, originator and authorizer |
| Outsourcing | Contracts, risk evaluations, service reviews, regulator-access clauses |
| BCP / DR | Last annual test, internal audit of the test, RPO/RTO in the BCP |
| Electronic fraud reporting | Monthly reports to NRB |
| Information Security Officer | Designation letter for a senior official |
| Previous audit | Last report, finding owners, closure evidence |
| CRG (if licensed by PSD) | Board-approved cyber resilience framework, steering committee records |
Frequently asked questions
How often must a bank conduct an IS audit?
The NRB IT Guidelines state that "banks should conduct IS audit annually."
Can the IS audit be outsourced?
Yes. The guidelines allow outsourcing "to external professional provider" when internal staff or expertise is lacking, but "the responsibility of audit planning, risk assessment and follow up rests on the bank," and the audit committee must ensure the provider "has expertise and experience in IS Audit."
Do the Cyber Resilience Guidelines replace the IT Guidelines?
This article treats them as complementary: the IT Guidelines (Bank Supervision Department, 2012) set IT control expectations for banks, and the CRG (Payment Systems Department, 2023) applies to A, B, C and D class BFIs, PSOs and PSPs licensed by that department. Check with your compliance function which documents apply to your licence.
Is a checklist-based audit enough?
The CRG says it "is not meant to serve as a check list," and NRB assesses compliance based on the institution's own risk-based methodology. An audit that tests how well controls manage your assessed risks is stronger evidence.
Who should own preparation inside the bank?
The guidelines require a senior official designated as Information Security Officer, and place resourcing of the audit with the board or audit committee. Preparation usually sits with the ISO, with the audit committee overseeing follow-up.
Next step
Trinity Technology carries out independent information security audits aligned to NRB and NIA requirements. See our NRB and NIA IS audit service, or send us your scope and we will reply within 24 hours. If you also need ongoing security leadership, read when a vCISO makes sense for a regulated institution.