Risk desk
The assurance layer boards and lenders now ask for.
Internal audit, control design and governance frameworks: the work that turns a statutory audit finding into something that does not recur next year.
- Reporting to
- Board or audit committee
- Cycle
- Annual plan, quarterly reviews
- Independence
- Separate from the audit team
- Output
- Findings ranked by exposure
Who this is for
If the same issue came up in the audit twice.
A repeated finding is rarely a people problem. It usually means nobody owns the control, or the control was designed for a smaller company.
Ask about a controls review- Boards that want assurance between statutory audits
- Groups where a lender has asked about controls
- Companies growing faster than their processes
- Businesses that have suffered a loss or a fraud
- Family groups formalising governance
- Entities preparing for external investment
How the engagement runs
Four stages, repeating annually
-
Map
Risk assessment
What could actually hurt this business, ranked by exposure rather than by how easy it is to test.
-
Plan
The audit plan
An annual plan agreed with the board, so nobody is surprised by what gets looked at or when.
-
Test
Fieldwork
Controls walked through and tested against real transactions, not against a description of the process.
-
Fix
Findings and follow-up
Each finding gets an owner and a date, and we check the following quarter whether it closed.
Scope of work
What the engagement covers
Scoped as a co-sourced function or a one-off review. Small groups rarely need a full internal audit department.
- Internal audit, co-sourced or outsourced
- Internal controls over financial reporting
- Standard operating procedures
- Enterprise risk assessment
- Fraud and forensic reviews
- Governance and delegation frameworks
Inside this line
What sits under Risk, Governance & Internal Audit
9 services on this desk. Most engagements use two or three of them.
Policies & Procedures Development
Written so the people doing the work use them
Ask about this
Design and operation
Two different assurances, often confused
A control can be well designed and never run. Boards are usually shown the first and assume the second, which is why an incident so often contradicts a clean controls report.
We test both and report them separately. Where a control exists only on paper we say so plainly rather than grading it amber.
Reporting lines
Who internal audit answers to decides what it finds
An internal audit function reporting to the finance director it is auditing will find small things. The reporting line is not an administrative detail; it is the control.
Where we are engaged as an outsourced function we report to the board or audit committee, in writing, with the findings unedited by the people they concern.
Reports to The board or audit committee
Before we scope
What tells us where the risk actually sits
We would rather scope against what you have than against a standard checklist that may not describe your business.
- Current organisation chart and delegations
- Existing policies and procedure manuals
- Prior internal or external audit findings
- System access and approval matrices
- Known incidents or near misses
- Board or committee minutes on risk
Where it goes wrong
Three things we are asked to fix most
Not theory. These are the ones that arrive as a problem rather than a question.
-
01
Policies written and never read
A manual that does not match how the work is actually done fails its first test.
-
02
Controls designed but never tested
Design and operation are different assurances. Only one of them survives an audit.
-
03
Internal audit reporting to the audited
Where the reporting line runs decides whether findings ever reach the board.
Questions we get weekly
Risk and governance, answered plainly.
Possibly. Below a certain size the honest answer is a short controls review every couple of years rather than a standing function, and we would rather sell you that.
Not over the same processes. Where we keep the books, the internal audit work is scoped away from them or handed to another firm, and we will say which applies before quoting.
A short report per review: what was tested, what failed, the exposure in money where it can be estimated, and a named owner with a date against each fix.
Related
Usually engaged alongside
Talk to the risk desk
Send us last year's management letter.
We will tell you which findings are likely to repeat and what it would take to close them properly. Thirty minutes, no charge.