Information Security Audit — NRB & NIA Regulatory Compliance
Independent information security audits aligned to Nepal Rastra Bank (NRB) and Nepal Insurance Authority (NIA) requirements. Includes SWIFT Customer Security Programme (CSP) assessment capability for financial institutions on the SWIFT network.
This service is distinct from ISO certification work. We assess against what your regulator expects — not only what a certification body checklist requires.
If you need ISO 27001, 27701, or 42001 implementation and certification readiness, see ISO 27001 / 27701 / 42001: Gap Assessment, Implementation & Audit Readiness.
Who this is for
Methodology
Engagement & Scope
Align audit scope to your regulatory filing, prior audit findings, and NRB/NIA circular requirements — including SWIFT CSP controls where applicable.
Document Review
Review IS policies, risk assessments, access management records, change logs, incident registers, and vendor due diligence evidence.
Control Testing & Fieldwork
Test key controls through sampling, configuration review, and interviews with IT, security, and business process owners.
Findings Validation
Validate observations with your team before finalisation — factual, evidence-backed findings rated by risk and regulatory impact.
Audit Report & Management Letter
Issue the formal audit report and management letter in a format suitable for board, regulator, and remediation tracking.
What you get
- Information systems audit report aligned to NRB or NIA supervisory expectations
- Findings register with risk ratings and regulatory reference where applicable
- Management letter for board and senior leadership
- Remediation tracking sheet for follow-up and closure evidence
- SWIFT CSP gap assessment report and remediation plan (for SWIFT member institutions)
Engagement FAQ
A fixed fee based on the agreed scope, quoted after a scoping call.
Typically 2–4 weeks, depending on scope.
The circulars and guidelines applicable to your institution, which we confirm with you at scoping, together with your prior audit findings.
For SWIFT member institutions, we assess your controls against the SWIFT Customer Security Programme (CSP) and support your attestation, with a CSP gap assessment report and remediation plan.
Yes. We sign a mutual NDA before scoping. We can sign yours or provide ours.
We store client data and evidence in Microsoft 365, encrypted at rest (AES-256), with access limited to the engagement team. We delete them 90 days after the engagement closes and confirm the deletion in writing.
Every engagement is led by one of our three co-founders, from scoping through remediation. IS audits are led by our Head of Business & Advisory, a PECB-certified ISO/IEC 27001 Lead Auditor.
The full list of deliverables is under What you get above.
Or email contact@trinitytech.com.np