- of revenue is the typical loss to fraud estimated by the ACFE's global study
- 5%
- is the median time a fraud runs before detection in the same study
- 12 months
- rule-based tests cover most of what full-population testing finds in a mid-sized company
- 20
An internal auditor of the traditional kind arrives once a year, asks for the payment vouchers, pulls thirty from a population of eleven thousand, checks each for approval and supporting documents, finds two without a second signature, and writes a report. The report says controls over payments are "generally satisfactory with exceptions noted". Everyone signs it.
Consider what that exercise could and could not have found. If one payment in five hundred was a duplicate, a sample of thirty would probably contain none. If a purchase officer had been splitting orders to stay under an approval limit, no single voucher would reveal it, because each one is in order. If a vendor shared a bank account with an employee, nothing in a voucher would show it. Sampling tests whether a control operated on the items selected. It is weak at finding things that are rare, and blind to patterns across transactions.
Sampling was never chosen because it was the better method. It was chosen because checking eleven thousand paper vouchers by hand was impossible. That constraint has gone. The eleven thousand payments are rows in a database, and a rule can be run across all of them in seconds.
This article explains how to do that. It is the thirteenth in our series on artificial intelligence for business in Nepal, and the companion to controls over AI-generated numbers: that piece dealt with controlling the machine, this one with using the machine to control.
What continuous assurance means
Three terms are used loosely and are worth separating.
Full-population testing means applying a test to every transaction in a period, not to a sample.
Continuous monitoring is management's own routine: tests run on a schedule, daily, weekly or monthly, by the finance or operations team, with exceptions followed up as part of ordinary work. It is a control.
Continuous auditing is the same technique used by internal audit to give independent assurance that controls are working.
Continuous assurance is the combination: management monitors, internal audit checks that the monitoring works and tests what management does not.
"Continuous" does not have to mean real time. For most Nepali companies monthly is a large step forward, and the natural rhythm is the month-end close (redesigning the close).
Why it matters: the economics of fraud and error
The Association of Certified Fraud Examiners publishes the most widely cited global study of occupational fraud. Its recent editions report a consistent picture: organisations are estimated to lose around 5 per cent of revenue to fraud each year; the typical scheme runs for about twelve months before it is found; the longer it runs, the larger the loss; and more cases are detected by a tip from an employee, customer or supplier than by any formal control. Proactive data monitoring is associated in the study with materially lower losses and faster detection.
Treat the 5 per cent with care. It is an estimate by practitioners, not a measurement, and no comparable study exists for Nepal. The structural findings are the useful part: fraud is found late, mostly by chance or by a tip, and data monitoring shortens the delay.
Error is the larger and duller problem. Duplicate payments, wrong rates, missed TDS, VAT coded to the wrong account, discounts given outside policy, salaries paid after an employee has left. None is dishonest. All cost money, and several create tax exposure that compounds with interest (the data-driven tax authority).
In a typical Nepali mid-sized company the conditions for both are present: a small finance team where one person may raise, approve and pay; owners who sign cheques in batches; vendor masters built up over years without review; related parties among suppliers and customers; a good deal of cash; and no internal audit function, or one outsourced for a few days a year. Full-population testing does not cure weak segregation of duties. It compensates for it, by making it likely that what slips through is seen within a month.
What becomes possible when you test everything
| Sampling | Full-population testing |
|---|---|
| Tests a few dozen items | Tests every item |
| Finds what is common | Finds what is rare |
| Looks at each transaction alone | Sees patterns across transactions, vendors and time |
| Annual or quarterly | Monthly or more often |
| Result: an opinion on controls | Result: a list of specific items to examine |
| Depends on the auditor's selection | Repeatable and consistent |
| Evidence: "30 of 30 approved" | Evidence: "11,204 tested, 37 exceptions, 4 confirmed" |
The second column changes the conversation with the board. An audit committee that hears "we tested every payment and found four problems, here they are" is being told something a sample can never tell it.
The twenty tests to start with
These need no AI. Each is a filter, a sort, a join between two tables or a count, and each can be run in a spreadsheet from an export of the accounting system. They are grouped by cycle.
Purchases and payments
1. Duplicate invoices. Same vendor and invoice number. Then the fuzzier versions: same vendor, same amount, dates within a few days; same amount and invoice number under two vendor codes; invoice numbers differing by a character.
2. Split purchases. Several orders or invoices to the same vendor, by the same requester, within a short period, each just below an approval limit and together above it.
3. Amounts just below limits. A cluster of transactions at 95 to 100 per cent of an approval threshold.
4. Vendor and employee matches. Vendor bank account, phone number, address or PAN equal to an employee's.
5. Duplicate vendors. Two vendor codes with the same PAN, bank account or near-identical name.
6. Changes to vendor bank details followed by payment. Any payment within days of a change in the bank account on the vendor master. This is the signature of both internal diversion and external impersonation fraud.
7. Payments without a purchase order or goods receipt, where policy requires them. And invoices dated before the purchase order.
8. Vendors without a PAN, or VAT charged by a vendor not registered for VAT. A tax test as much as a fraud test.
9. Round-sum payments to vendors, especially repeated ones, and payments to vendors with only one or two transactions ever.
10. Price variance. The same item bought from the same or different vendors at prices differing by more than a set percentage.
Sales and receivables
11. Credit notes and write-offs. All of them, by customer and by approver, with those raised near period end or shortly after a sale, and those above a threshold without second approval.
12. Sales above credit limit, and credit limits raised shortly before a large sale.
13. Discounts outside policy. Discount percentage by salesperson and customer against the approved scale.
14. Gaps and duplicates in invoice numbering. Important for VAT as well as control.
Payroll
15. Ghost and departed employees. Payments to anyone not on the active staff list, or after the leaving date.
16. Shared bank accounts. Two employees paid into the same account.
17. Changes to pay. Every change in salary, allowance or bank account in the month, matched to an approval.
Ledger and cash
18. Manual journals. All of them, with attention to those posted on holidays and weekends, late at night, by senior users, to unusual account pairs, with round amounts, with no description, or after the close.
19. Cash transactions above the limit. Payments in cash above the threshold beyond which the Income Tax Act restricts deduction unless made through banking channels, and cash receipts that never reach the bank or reach it late.
20. Expenses without TDS. Payments for services, rent, contracts and professional fees with no corresponding TDS entry (TDS rates).
Further tests follow naturally once these run: stock adjustments by user and store, sales returns after period end, fuel and maintenance by vehicle, related-party transactions against approved terms, access rights against job roles, and the tax reconciliations described in our article on the tax authority.
A note on Benford's law, which appears in every article on this subject. In many natural sets of numbers the leading digit 1 occurs about 30 per cent of the time and 9 less than 5 per cent. Departures can indicate invented figures. It is a useful screen on large populations such as expense claims or journals, and a poor one on small sets, on amounts constrained by price lists or limits, and on anything already filtered. Treat a deviation as a reason to look, never as evidence.
Where AI adds something
Rules find what you thought to look for. The case for machine learning and generative AI is that they may find what you did not, and can read what rules cannot.
Anomaly detection. Statistical methods that learn what normal looks like, for a vendor, an employee, an account or a store, and score each transaction by how unusual it is. A payment that breaks no rule may still be odd: a vendor normally paid monthly is paid three times in a week, a cashier's voids are four times those of colleagues, a journal uses a pair of accounts never combined before. Useful at volume. At a few thousand transactions a month, sorting and charts achieve much the same.
Reading documents. Generative AI can extract terms from contracts, compare an invoice with a purchase order and agreement, read scanned bills in Nepali and English, and flag inconsistencies. This opens testing to what used to be untestable without reading every page: does the rate invoiced match the rate contracted?
Text analysis. Narrations, approval comments, expense descriptions and complaint logs can be searched for patterns: vague descriptions, repeated phrases, mentions of urgency or override.
Network analysis. Links between vendors, employees, addresses, phone numbers and bank accounts, drawn as a graph, reveal clusters that tables hide.
Drafting and triage. Summarising exceptions, drafting queries to process owners and writing first drafts of findings.
The honest limits:
False positives. An anomaly detector flags the unusual, and most unusual things are innocent. A system that raises hundreds of alerts a week will be ignored within a month.
Data quality. Models learn from the data. If the vendor master is full of duplicates and blanks, the output will be noise (data before algorithms).
Explainability. "The model scored it 0.93" is not a finding. An auditor must be able to say what is wrong.
Fabrication. A generative tool asked to review documents may report a discrepancy that does not exist, or miss one that does. Its output is a lead to be verified against the document.
It learns the past. A fraud that has been running since before the data began looks normal.
Confidentiality. Payroll, vendor and customer data must not be placed in public tools (AI risk as a governance question).
Gartner's 2025 survey of finance functions found error and anomaly detection among the most common uses of AI in finance, at about a third of respondents. The use is real. It supplements the twenty tests and does not replace them.
The exception problem
The professional literature is consistent on one point: running tests is easy and following them up is where programmes die. The first run of twenty tests on a year's data in a company that has never done this may produce thousands of exceptions. Without a method, nobody looks at any of them.
A method that works:
1. Tune before you circulate. Review the first output yourself. Remove the obviously innocent: the utility paid the same amount monthly is not a duplicate. Adjust thresholds until the list is a size people can handle.
2. Score and rank. Give each exception points for amount, for the number of tests it fails and for the sensitivity of the area. A payment that is round, to a new vendor, approved by its requester and made on a Saturday goes to the top. Work from the top down.
3. Assign an owner and a deadline. Each exception goes to someone who is not the person who processed the transaction, with a date.
4. Require evidence, not explanation. "It is fine" does not close an exception. The purchase order, the contract, the approval or the bank advice does.
5. Record the outcome. Confirmed error, confirmed irregularity, control gap, or cleared with reason. Keep the log.
6. Fix the cause. If the same exception recurs, change the process or the system setting: block duplicate invoice numbers at entry, require dual approval for vendor bank changes, enforce the PAN field.
7. Feed back. Use cleared exceptions to refine the test, so that next month's list is shorter and sharper.
8. Escalate properly. Suspected fraud goes, quietly, to someone senior and independent of the area. Do not confront, do not alert, preserve the records, and take advice before acting (forensic review).
A realistic target after three or four months is a monthly list of twenty to fifty ranked exceptions, cleared within ten working days.
Who does what: three lines
The model used by the Institute of Internal Auditors separates three roles.
First line: management. Runs the monitoring tests as part of the close and follows up exceptions. Owns the controls.
Second line: risk and compliance, where it exists. Sets policy and thresholds.
Third line: internal audit. Independent of both. Tests whether the monitoring is complete and honest, runs its own tests where management has an interest, and reports to the audit committee or board.
In a company with a finance team of six there are no three lines. The practical version: the finance head runs the tests, someone outside the processing chain reviews exceptions, and an independent party, an internal auditor in-house or outsourced, re-runs a selection and reports to the owner or board. What must be preserved is that the person reviewing an exception is not the one who created the transaction, and that somebody independent sees the results.
One caution about independence. The person who designs and operates a control cannot give independent assurance on it. If an outside firm builds and runs your monitoring, a different party should assure it.
The data you need
The tests depend on being able to extract five things from the accounting system with consistent fields:
| Extract | Fields that matter |
|---|---|
| Vendor master | Code, name, PAN, VAT status, bank account, address, phone, created by, changed by, dates |
| Purchase and payment register | Vendor, invoice number, date, amount, VAT, TDS, PO reference, entered by, approved by, payment date and mode |
| Sales register and customer master | Customer, invoice number, date, amount, discount, salesperson, credit limit, credit notes |
| Payroll register and employee master | Employee ID, join and leave dates, bank account, PAN, pay components, changes |
| General ledger journal listing | Date, time, user, accounts, amount, narration, source (system or manual) |
Plus the system's audit trail of changes to masters and user access, and bank statements.
Problems to expect in practice: user accounts shared between staff, which defeats every test based on who did what; narration fields left blank; dates in Bikram Sambat in one extract and Gregorian in another; back-dated entries permitted by the software; vendor names spelled four ways; and audit logs switched off. Fixing these is control work in its own right. Start with the tests the data can support and widen as the data improves.
Tools
In ascending order of cost and capability:
Spreadsheets. Pivot tables, lookups, conditional formatting and filters handle most of the twenty tests on up to a few hundred thousand rows.
Query tools built into spreadsheets and BI software. Repeatable: build the test once, refresh monthly.
Scripting, such as Python or SQL, for larger volumes, fuzzy matching and scheduling.
Audit analytics software. Purpose-built, with libraries of tests and audit trails. Justified in larger companies and audit firms.
ERP-embedded monitoring and AI features. Increasingly offered by vendors. Evaluate what the feature tests before paying for it.
Most mid-sized Nepali companies should spend at least six months at levels one and two. A company that cannot keep twenty spreadsheet tests running will not be rescued by software.
Statutory audit, internal audit and regulators
The external auditor gives an opinion on the financial statements under Nepal Standards on Auditing. That opinion is not a guarantee against fraud and is not designed to test every transaction. Auditors do increasingly use data analytics, and under the standards they must test journal entries for the risk of management override. A company with its own monitoring gives its auditor better evidence and usually a smoother audit (audit support).
Internal audit is a matter of governance. The Companies Act 2063 requires listed companies and companies above a specified paid-up capital to have an audit committee, as we understand the provision, and Nepal Rastra Bank's directives require internal audit functions in banks and financial institutions, reporting to the audit committee. Insurers, cooperatives above certain sizes and public enterprises have their own requirements. For licensed institutions the central bank's AI Guidelines add a further point: AI systems themselves fall within the scope of what internal audit should review.
For the unregulated family company none of this is compulsory, which is exactly why it is neglected (why growing businesses need better internal controls).
An illustrative example
This is an illustration with invented figures, not a client.
A trading and distribution company with turnover of NPR 80 crore processes about 14,000 purchase and expense payments a year through 900 vendors. Its finance team of seven runs the twenty tests on twelve months of data for the first time.
The first pass produces 2,300 exceptions. After removing recurring utilities and rents, tuning the round-sum threshold and excluding inter-branch transfers, 310 remain. Ranked by score, the top sixty are examined. What a company in this position might plausibly find:
Nine duplicate payments totalling NPR 14 lakh, mostly invoices received both by email and in hard copy and entered twice with slightly different numbers. Seven are recoverable from suppliers.
Forty-one vendor codes that are duplicates of others, and 118 vendors with no PAN recorded.
A pattern of orders to one transport contractor split into amounts just under the branch manager's limit: a control breach requiring explanation, whether or not anything improper lies behind it.
NPR 1.9 crore of service payments across the year with no TDS deducted, an exposure of roughly NPR 2.9 lakh in tax at 1.5 per cent or far more if payees were unregistered, plus interest.
Two former employees paid for one month after leaving.
Thirty-four manual journals posted by the finance manager after the close with no narration.
The value recovered and exposure avoided in such a case would exceed the cost of the work several times over. The more durable result is the list of six process changes that prevent recurrence.
Measuring the programme
| Measure | What good looks like |
|---|---|
| Coverage | Share of transaction value subject to at least one test, rising toward 100 per cent |
| Tests run on schedule | Every month, by working day five after close |
| Exceptions raised | Stable or falling after the first quarter |
| False positive rate | Falling as tests are tuned |
| Time to clear | Top-ranked exceptions within ten working days |
| Confirmed findings | Counted and valued: recoveries, errors corrected, tax exposure fixed |
| Root-cause fixes | Number of process or system changes made |
| Repeat findings | Falling |
From ground level to policy level
On the ground, the programme lives or dies on whether a finance officer runs the tests on the fourth working day of every month when the owner is not asking. It needs to be on the close checklist with a name beside it.
At company level, the board or owner should receive one page each quarter: tests run, exceptions, confirmed findings, fixes. Where there is an audit committee, internal audit should report on the monitoring itself.
At the level of the profession, the skills required are changing. An internal auditor who can extract data, build a test and read the result is worth several who can only tick vouchers. The Institute of Chartered Accountants of Nepal's curriculum and continuing education, and the training inside firms, need to give data analysis the weight it now has in practice. Audit regulators, for their part, will have to form a view on how far analytics over a whole population can replace traditional sampling as audit evidence, a question standard-setters internationally are working through.
At policy level, three things would help. Accounting software sold in Nepal should be required, or at least expected, to keep a tamper-evident audit trail and to export standard data, as some countries now require. Banks could accept evidence of continuous monitoring as a positive factor in credit assessment. And the public sector, where the Auditor General's annual report records large amounts of irregularities each year, is the largest potential beneficiary of full-population testing of payments, payroll and procurement.
The role of consulting and advisory firms
The large accounting firms have invested for years in audit analytics platforms that ingest a client's entire ledger, test all journals and visualise flows between accounts, and they now add AI for document reading and anomaly scoring. Their internal audit practices offer continuous monitoring as a managed service. Specialist software vendors supply tools to in-house audit teams. The Institute of Internal Auditors and the ACFE publish guidance and test libraries that anyone can use.
Two cautions when engaging any firm. Ask who will follow up exceptions, because a dashboard without follow-up is decoration. And keep the roles apart: whoever builds and runs monitoring for management should not also be the party giving independent assurance on it, and the statutory auditor is restricted by independence rules in the non-audit work it can do for an audit client.
Our role: we carry out outsourced internal audit and control reviews, build monitoring tests and reporting on a company's own data (data analytics and reporting), investigate specific concerns (forensic review), and prepare companies for their statutory audit (audit support). We do not perform statutory audits, and we do not sell audit software.
The next 90 days
Days 1 to 30. Confirm what data can be extracted and fix the worst gaps: shared logins, missing PANs, disabled audit logs. Run five tests on the last twelve months: duplicate invoices, vendor and employee bank matches, duplicate vendors, manual journals, expenses without TDS. Review results personally.
Days 31 to 60. Extend to the twenty tests. Tune thresholds. Introduce scoring, owners and deadlines. Clear the top fifty exceptions with evidence. Make the first root-cause fixes in the system.
Days 61 to 90. Put the tests on the monthly close checklist. Produce the first one-page report for the board or owner. Arrange for an independent party to re-run a selection. Decide whether volume justifies scripting or software, and whether any AI feature is worth a controlled trial.
Frequently asked questions
Do we need AI or special software to test every transaction?
No. A spreadsheet handles most tests for a mid-sized company. Software and AI help with large volumes, fuzzy matching and documents.
Does this replace the annual audit?
No. The statutory audit is a legal requirement with a different purpose. Monitoring is management's control. It makes the audit easier and reduces surprises.
We are a small company. Is it worth it?
Five tests run monthly take an hour or two and catch the commonest losses: duplicate payments, missing TDS and payroll errors. The smaller the team, the weaker the segregation of duties and the more a compensating check is worth.
Will staff see it as distrust?
Present it as routine checking of transactions, applied to everyone including senior people, that protects honest staff from suspicion. Consistent, impersonal testing is easier to accept than ad hoc enquiry.
What if a test suggests fraud?
Do not confront the person. Secure the records, limit who knows, inform a senior person independent of the area and take professional advice on investigation and employment law before acting.
How many exceptions are normal?
Many in the first run, most of them innocent. After tuning, a few dozen a month that deserve a look. If the list is long, the thresholds are wrong.
Can we rely on an anomaly score from an AI tool?
As a pointer to where to look. A finding requires a person to establish what happened from documents.
Who should run the tests?
Finance, as part of the close, with exceptions reviewed by someone outside the processing chain and results seen periodically by an independent party and the board.
*This article is general guidance, not professional advice. The example is illustrative and its figures are invented. References to legal and regulatory requirements are summaries and should be confirmed for your company.*
