Business Contract: An Artifact of

Enterprise Risks Management and Risk-based Internal Audit

-CA Anima Maharjan

Abstract

Over the past few years, business landscapes have become even more complex due to the interconnected ecosystem, indispensable digital interdependence, globalization and continuous evolution of local and international regulations. The overall exposure of enterprise’s risk has been significantly heightened due to all these evolving business dynamics. In this context, the importance of prudently drafted business contracts has grown even more. As such, the business contracts should not be viewed as a mere legal formality but should be deployed as a strategic instrument for managing various corporate risks within the defined risk appetite of an organization. This article sheds light on how well-structured contractual clauses function as an effective instrument for managing a broad spectrum of enterprise risks, including business, operational, financial, technological, compliance and emerging AI risks in today’s business landscape. It further highlights the importance of contracts in risk assessment, control evaluation, and assurance within a risk-based internal audit (RBIA) approach.

 

1. Introduction

 

1. Business Contract

Simply, business contract is an agreement between two or more parties which clearly sets expectations and standards, and defines roles, responsibilities and liabilities of such parties before establishing any business relationships, primarily aiming to prevent intolerable underlying risk exposures. Additionally, it can also incorporate corrective elements like liquidated damages, indemnification and similar provisions, which help to minimize the impacts in the event of risk materialization. In the context of Nepal, Muluki Civil Code, 2074 (National Code of Nepal) is the primary legal basis for formation, execution, breach and termination of contracts. Besides, there are other specific laws that govern certain business activities such as the Public Procurement Act 2063, which further regulates public procurement-related contracts. Most importantly, well-drafted agreement helps to ensure legal protection and enforceability while fostering trust and relationship management between the contracting parties by legally establishing the rights and obligations of all sides.

 

1. Enterprise Risk Management (ERM)

On the other hand, ERM is the process of identifying, analyzing, evaluating and mitigating overall corporate risks within an acceptable limit set by an organization. It further includes ongoing monitoring and periodic review of risk management process while ensuring its proper recording and timely reporting. According to International Organization for Standardization (ISO) 31000-Risk Management Guidelines, risk management is coordinated activities to direct and control an organization with regard to risk. As such it serves as a proactive measure that gives a bird-eye view to the leadership of an entity facilitating risk-informed decision making. In line with the regulatory perspectives, Nepal Rastra Bank (NRB) defines the risk management as ‘the systematic application of management policies, procedures and practices to the assessment, treatment, controlling, and monitoring of risk’, further emphasizing that it must be ‘embedded in the culture and practices, and should be tailored to the business processes of the organization’ (NRB, 2018). However, it is equally important to periodically assess effectiveness of implemented ERM mechanism which can be achieved through an independent assurance mechanism such as RBIA.

 

1. Risk-based Internal Audit (RBIA)

Simply put, RBIA means audit which revolves around ERM framework of an organization. It is an audit approach that emphasizes the identification and assessment of high risks, and prioritizes audit focus and limited resources toward such high-priority areas to ensure that risks with the substantial potential impact on the achievement of organizational objectives are addressed on a priority basis by the management. Accordingly, audit planning and execution are aligned in response to the assessed risks of material misstatement at both the financial statement and assertion levels, with particular focus on significant risks. Chartered Institute of Internal Auditors (IIA) defines RBIA as a methodology that links internal auditing to an organization’s overall risk management framework. RBIA allows internal audit to provide assurance to the board that risk management processes are managing risks effectively, in relation to the risk appetite.

 

In this context, RBIA incorporates structured processes such as understanding the entity and its business environment, identifying and assessing risks, evaluating management’s risk responses, and testing the design and operating effectiveness of relevant controls. These processes are imperative for effective planning, scoping, execution, including audit reporting and communication with the management and those charged with governance of the auditee.

 

With the increasing shift of audit focus toward RBIA, additional responsibilities fall upon professional accountants or internal auditors, as they ultimately provide reasonable assurance to stakeholders regarding the effectiveness of organization’s risk management practices while also offering recommendations to enhance such practices and overall organizational performance. In fulfilling this role, professional accountants must conduct RBIA in a manner that ensures the conclusion drawn are supported by sufficient and appropriate evidence. This requires them to maintain independence, exercise professional judgement and professional skepticism, and due diligence throughout the audit process, while also possessing a comprehensive understanding of the organization’s risk profile, the criticality of identified risks, the existing governance and control environment along with the design and effectiveness of control measures implemented as risk responses, which are often formally documented through key business contracts.

 

 

1. Role of business contracts in ERM

 

As the contract management is an integral part of business processes, the aforementioned definitions on risk management vividly suggests that contractual frameworks should be aligned with the broader organizational risk management practices to effectively control enterprise-wide exposures, extending across all Three Line of Defense. Accordingly, an organization can operationalize risk responses through well-designed contractual clauses by assigning risk ownership and performance obligations to management along with chief of each department (first line of defense), incorporating governance, compliance, and control requirements overseen by risk and legal functions (second line of defense), and providing auditors with a concrete basis for independent evaluation of risk management practice that encompasses the assessment of risk exposure, control adequacy and effectiveness (third line of defense). From this perspective, contractual provisions addressing business, operational, financial, technological, legal, and emerging AI risk become vital to strengthening ERM outcomes, as discussed in the subsequent sections.

 

1. Business and Operational Risk Allocation

By clearly outlining the scope of work, performance expectations, reporting and documentation requirements, operational safeguards, compliance obligations, and other key governance mechanisms, a well-structured contractual framework plays a crucial role in containing business and operational risks within the organization’s defined risk appetite. Such clarity not only enhances accountability and transparency but also ensures that risks are proactively managed through predefined controls rather than being addressed reactively. Below are some of the key contractual clauses that serve as the predefined controls for mitigating foreseeable Business and Operational Risks.

 

1. Scope of Work (SOW): Predetermines the areas of work and boundaries, avoiding scope creep and ambiguity during execution.
2. Performance Matrix: Sets the Key Performance Indicators (KPIs), to measure the ongoing performance quality and progress.
3. Deliverables: Outlines the expectations and tangible output from each party in line with the SOW, minimizing disputes over delivery of goods and/or services.
4. Reporting and Documentation Requirements: Encompasses the requirements of structured and periodical reporting and communication to ensure transparency and maintain audit trails.
5. Escalation Matrix: Defines the formal communication path to effectively address the operational issues.
6. Competitive Engagement: Mitigates conflict of interest and ensures fair business relationships.
7. Business Continuity Plan (BCP): Requires to have the BCP in place to assure service resumption at the earliest during operational disruptions.
8. Amendments, Renewal and Validity: Maintains the ongoing relevance and validity of the contract and its terms both operationally and legally.

 

1. Information Technology (IT) /Information System (IS) Security Risk Allocation

With the growing dependency on technologies, cloud platform and artificial intelligence (AI) for the delivery of business-critical operations, safeguards for possible IT and IS security risks has become even more crucial. To that, well-defined contractual clauses can collectively help organizations secure systems, ensure business continuity and resilience while maintaining regulatory compliance and limiting exposure to cybersecurity.

 

1. Service Level Agreement (SLA): Sets measurable performance standards and matrix such as system uptime, ensuring efficiency, accountability, transparency while minimizing possible risk of service disruption, degradation and operational delays.
2. Security Certification: Requires service providers to pose security certification such as Payment Card Industry Data Security Standard (PCI-DSS), providing independent third-party assurance on the security controls and governance practices as per the internationally accepted benchmarks.
3. Ownership and License Rights: Establishes the clear rights related to data, software, intellectual properties and proprietary assets, avoiding unnecessary legal and operational risks.
4. Escrow Agreement: Protects against operational impacts of vendor insolvency and service discontinuity by ensuring access to critical intellectual property such as source code.
5. System and Organization Controls (SOC) Type 2 Report: Provides independent auditor’s assurance over IT and system security controls and their effectiveness of the service provider, reducing system security exposure arising due to high-risk external system integration.
6. Right-to-Audit: Strengthens oversight of client by allowing them to verify the compliance and controls of the service provider and mitigates the risk of process deviations and hidden vulnerabilities.
7. Vulnerability Assessment and Penetration Testing Report (VAPT) /IS Audit Report: Allows transparency on the current system security posture of the service provider by mandating periodical VAPT and/or IS Audit Report.
8. Technical Support Matrix: Defines the criticality based technical support level and availability along with escalation path for timely incident response, reducing the massive impacts of major disruptions.
9. Disaster Recovery Plan (DRP): Places the requirement to have intact DRP to restore the information systems, applications and data during system failures or natural disasters, reducing impacts of prolonged system downtime and data loss risk.

 

1. Financial Risk Allocation

Financial activities are the lifeblood of any business, and undertaking adequate measures to minimize the financial risks is undeniably important. One such measure is proactive inclusion of strategical contractual terms in business agreements. This practice also supports more accurate and reliable financial planning that ultimately aids the smooth achievement of business goals.

 

1. Payment Terms: Defines payables, payment milestones, billing/settlement cycle and corresponding conditions for fund release which contributes to mitigate risks pertaining to liquidity mismanagement and financial irregularities. 
2. Pricing Model: Outlines the pricing structure including cost components, cost breakdown, conditions for price adjustment and underlying assumptions, minimizing the risks associated with unclear and incomplete financial data and terms.
3. Tax Liabilities: Clarifies tax withholding and payment responsibilities along with applicable tax rates, reducing the risk of tax penalties resulting from tax default and tax payment disputes.
4. Financial and Performance Security: Requires the service provider to maintain financial security such as deposits, settlement guarantee fund, performance bond/bank guarantee, collectively aims to reduce the financial impacts arising from the vendor’s financial and performance default.
5. Liquidated Damages (LQD): Helps to manage the financial risk arising from the vendor non-performance or contractual breaches, obliging the vendor to compensate predefined amount for such non-delivery or breaches.

 

1. Legal & Compliance Risk Allocation

Legal and compliance risks have become even more pronounced in today’s increasingly regulated business environment, particularly with cross-border transactions, complex business and outsourcing arrangements, and the growing use of AI along with advance digital and data-driven technologies. These factors have broadened the focus of business organizations, compelling them to proactively assess potential legal and compliance risks before entering into or formalizing any business relationship.

 

1. Representation and Warranties: Aims to avoid fraud risks and misrepresentation by ensuring each party provides truthful information and has the adequate authority and capabilities to perform underlying obligations.
2. Governing Laws and Jurisdiction: Helps to minimize legal ambiguity and uncertainty by specifying applicable country’s laws and place for dispute settlement.
3. Privacy and Data Protection: Obliges all the contracting parties to safeguard data and information whether in use, in transit or at rest so as to prevent its misuse or unauthorized access.
4. Confidentiality/Non-disclosure Agreement (NDA): Predefines the scope of term ‘Confidential Business Information’ and prohibits their unauthorized publication, use or dissemination, safeguarding the client’s sensitive business information from leakage.
5. Indemnification: Allocates the liability of indemnification to the party responsible for breaching contractual terms or misconduct, protecting non-breaching party from legal claims and consequential financial burden.
6. Severability: Protects entire contract from becoming void if any clause within the contract is deemed unenforceable by law.
7. Intellectual Property (IP) Protection: Attempts to avoid the risk of copyright infringement and unauthorized use of IP by clarifying its ownership and permissible use.
8. Termination: States the conditions, grounds and procedures of exit or discontinuance of the contract by either party, reducing associated legal and operational uncertainties.

 

1. Emerging Risk: AI Risk Allocation

AI-related risks are not entirely distinct in nature; however, its rapid use across business functions, often without comprehensive assessment of its associated risks and overarching impacts on businesses, customers, and society, necessitates precautionary measures. For that reason, at least in the present scenario, it has become imperative for organizations to explicitly consider potential AI-related risks and ensure that they are confined within acceptable risk limits. Therefore, this underscores the need for businesses to review, update, and amend existing agreements, as well as to incorporate specific AI-focused contractual clauses in new contracts to effectively address and mitigate AI-related risks. In this situation, business contracts serve as a critical governance instrument for managing AI-related risks by translating following aspects into legally enforceable obligations.

 

1. AI Governance: Defines the need for continuous AI training data assessment, requirements of algorithmic audit or independent assurance from third party and ownership of AI models, minimizing the risk of model drift.
2. Ethical Requirements: Aims to ensure fair AI-driven decisions prohibiting algorithmic biasness and discrimination in AI model, reducing ethical risks.
3. Transparency and Accountability: Requires disclosure of use of AI model, underlying AI logic, its limitations, protocols for AI-driven decisions making process, especially for high-risk or sensitive use cases, assigning accountability for its decisions and outcomes as well.
4. Data Privacy and Confidentiality: Impose the limitation on collection, use, storage and dissemination of personal and sensitive information used by AI systems, including breach notification obligation.
5. Compliance and Regulatory Requirements: Emphasizes the need of compliance with prevailing domestic and international AI-related laws, regulations, guidelines including privacy regulations and other regulatory requirements to avoid legal and regulatory sanctions.
6. Specific Performance Obligations: Outlines the performance benchmark and matrices in SLA to safeguard against the consequences of AI system failure and performance degradation and outcome inconsistent overtime.

 

The aforementioned contractual terms addressing various enterprise risks are not exhaustive; rather, they should be incorporated, modified, excluded or supplemented based on their relevance and the particular risk profile and requirements of the underlying business arrangements.

 

1. Role of business contracts in RBIA

 

As discussed above, business contracts clearly play an integral role in the design, allocation, and enforcement of risk responses; however, in the context of RBIA, its role becomes particularly significant during the evaluation of control measures implemented by management as responses to identified enterprise risks. Accordingly, it serves as concrete and documented evidence of how risk responses, such as risk reduction, risk avoidance, and risk transfer, are formally designed and operationalized by the management. By incorporating performance obligations, control requirements, accountability mechanisms, indemnities, and other safeguards into legally enforceable terms, contracts provide auditors with a reliable basis for assessing whether management’s risk responses are appropriately designed and aligned with the organization’s risk appetite.

 

BDO emphasizes that audit readiness is significantly strengthened through proactive contract management, noting that well-maintained and clearly documented contracts and agreements provide auditors with reliable evidence for validating balances, testing compliance, and assessing control effectiveness. According to BDO, centralized documentation and continuous monitoring of contractual obligations not only reduce compliance and reporting risks but also enable early identification of issues, thereby supporting stronger internal controls and risk-based audit execution (BDO, 2021).

 

Likewise, Internal Audit Manual issued by ICAN consistently underscores that RBIA is not about auditing risks, but auditing the management response to risks (ICAN, 2025). Further, the manual requires internal auditors to assess and evaluate the adequacy and effectiveness of internal controls in place, which essentially represent the risk mitigation steps adopted to strengthen the organization’s systems and processes. Taken together, these principles directly and indirectly give rise to the following use cases of contracts review and verification within the RBIA framework.

 

Risk Area/Objective	Examples of related Contractual Risk Responses/Terms	RBIA use case
Risk Mitigation and Risk Transfer (Business/ Financial/ Operational/ IT & Others)	Competitive Engagement, Payment terms, LQD, Financial Security, BCP/DRP, Escrow Agreement Clause, Insurance Obligation	Whether contracts have incorporated and enforced all the required terms to mitigate and transfer identified key risks.
Third-Party / Outsourcing Risk	Right-to-Audit, Indemnification, NDA & Confidentiality Clause	Whether third-party risks are identified, assessed and contractually mitigated.
Effectiveness of Risk Responses	Clear allocation of contractual obligations, Enforceability & Validity	Whether contractual responses are adequate, proportionate and effective in addressing underlying risks.
Monitoring of Risk Responses	Reporting & Documentation, Performance Metrics	Whether management has monitoring controls in place and consistently assesses its effective implementation.

Table: Use Cases of Contracts within RBIA

 

Collectively, the use cases of business contract review under RBIA provide substantive evidence to validate the initially assessed risk maturity level, demonstrating the extent of the organization’s understanding of risk and the maturity of its associated risk management culture.  Besides, it also helps to conclude whether management’s risk responses, particularly where contracts are relied upon as a key risk response, have reduced residual risks within the organization’s defined risk appetite.

 

This perspective is also consistent with the principles of ISA 315, Identifying and Assessing the Risks of Material Misstatement, which requires auditors to obtain an understanding of the entity’s processes, controls, and contractual arrangements that are relevant to risk assessment. In practice, contractual terms related to service delivery, financial commitments, compliance obligations, and third-party arrangements often form a critical component of the control environment and risk assessment procedures. Hence, the thorough review and evaluation of high-value and strategic business contracts constitute a key audit procedure that enables auditors to effectively apply the principles of ISA 315 along with the guidance of ICAN’s manual in identifying and assessing risks during the conduct of a RBIA.

 

1. Nepalese Context

In the Nepalese context, the level of awareness regarding the role of contract in ERM and RBIA varies significantly across industries. Such awareness and its implementation are relatively stronger in well-regulated and high inherent-risk sectors such as banking and insurance, where contractual arrangements and their enforcement are closely aligned with regulatory expectations, risk governance, and audit requirements.

 

Taking the banking sector as an example, where the core operations revolve around deposit mobilization and lending, the credit function naturally falls within the scope of RBIA due to its high-risk nature. Within this function, contractual documents—such as loan deeds, sanction/offer letters including credit covenants, and security documentation, are used as primary instruments for risk control and risk allocation in line with the risk management framework and supervisory expectations prescribed by NRB. And in the insurance sector, the insurance contract itself constitutes the core product. Insurance risks are assumed and distributed through underwriting processes, primarily via insurance policies and reinsurance treaties, which are governed by the Insurance Act 2079 and related regulations, including various directives and guidelines issued by Nepal Insurance Authority (NIA). Furthermore, recent practices indicate a shift toward more technology-oriented frameworks. The introduction of digital terms and conditions, as required by NRB and NIA, exemplifies the evolving alignment of contractual practices with emerging business dynamics, particularly in response to the growth of digitized banking and insurance products, outsourcing arrangements, use of AI and their associated risk management requirements. Accordingly, the proper execution, periodic review, and verification of such documentation and practices, representing various forms of contractual arrangements, hold critical importance from both an ERM and RBIA perspective, which is visible across public sectors of Nepal.

However, this level of integration is not consistently observed in many privately held entities, where contracts are frequently treated as mere legal formalities with little connection to ERM and RBIA practices. In practice, they often adopt a “business-first” and one-time execution approach to contracts, and rely on standardized templates that may not adequately incorporate fully address the unique risk profile of the underlying transaction. Consequently, this may expose the organization to risks beyond its intended tolerance levels.

This perception is partly influenced by the discretionary nature of risk appetite in such entities, which typically operate without direct exposure to public funds, facing comparatively lower regulatory and public accountability pressures. Further, this gap can also be attributed to constraints such as the lack of skilled resources, insufficient emphasis from top-level management on the strategic value of contract management and cost considerations which include direct cost such as legal drafting and review, contract repository systems, compliance and monitoring tools, staff training, and sectoral expert input for technical issues, and indirect costs such as slower negotiation cycles, more detailed documentation requirements, and governance overhead associated with approvals, monitoring, and follow-up. These costs are typically viewed as disadvantages of linking contract management with ERM and RBIA. However, these costs should be viewed against the potential benefits of stronger compliance, better risk visibility, fewer disputes and improved audit readiness to reach at trade-off point.

 

1. Conclusion

To sum up, well-crafted business contracts not only act as a unifying instrument by translating strategic risk decisions into enforceable operational terms but also play a crucial role across three lines of defense, supporting management execution, risk oversight and independent audit assurance. Ultimately, this practice facilitates the enterprise-wide ERM implementation and strengthen its overall effectiveness. Having said that, neither contract management nor ERM seeks to eliminate risks entirely, rather both aim to strike an optimal balance between business objectives and maintaining risk exposure within acceptable limits. As aptly articulated by EY, “for contracting, the key lies in hitting that sweet spot between business facilitation and risk mitigation” (EY, 2021). And for that, contractual frameworks must be subject to periodic review, monitoring, and updates, ensuring continued alignment with evolving business dynamics and emerging risk profiles.

 

References

ISO-International Organization for Standardization. (2018). ISO 31000, Risk Management-Guidelines.

 

Nepal Rastra Bank. (2018, December). Risk Management Guidelines for Bank and Financial Institutions.https://www.nrb.org.np/contents/uploads/2019/12/Guidelines-Risk_Management_Guidelines_for_Banks_and_Financial_Institutions_2018-new.pdf

 

Chartered Institute of Internal Auditors, (2014). Risk Based Internal Auditing.

 

BDO, USA. (3 September, 2025). Audit Readiness for Nonprofits: Best Practices for Controllers and CFOs. https://www.bdo.com/insights/assurance/audit-readiness-for-nonprofits-best-practices-for-controllers-and-cfos

 

The Institute of Chartered Accountants of Nepal (ICAN). (June 2025). Internal Audit Manual 2025. https://en.ican.org.np/_browsable/file/downloads/Internal_Audit_Manual_2025.pdf

 

Nepal Standards on Auditing. (2024). NSA 315(Revised), Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and Its Environment.

 

Earnest & Young Global Limited (EY). (12 May 2021). How does contracting complexity hide clear profitability). https://www.ey.com/content/dam/ey-unified-site/ey-com/en-gl/insights/law/documents/ey-contracting-report-june-2021.pdf