Exceptions reported, risk not
A programme that tests what is easy to test produces a list of small differences and no view at all of what could actually hurt the business.
Systems & Assurance
Internal Audit
A risk-based internal audit programme, reported in terms a board can act on rather than as a list of exceptions nobody reads.
- Boards and audit committees
- Owner-managed groups
- Multi-outlet retail
- Pharmaceutical distribution
- Businesses running on an ERP
What we are usually called about
The questions this work arrives with
None of these is unusual and none of them is a failing. They are what happens when a business grows faster than the records, the systems and the filings that describe it.
Controls that exist on paper
The policy says two approvals are required; the system allows one. The gap between the written procedure and the configured system is where a great many findings come from.
Nobody owns the follow-up
A finding is accepted, an owner is named, and the next report finds the same thing. Without a tracked closure step an internal audit function repeats itself.
Growth outrunning the controls
New outlets, a new warehouse or a new line of business added faster than the approvals around them, until authority limits and segregation of duties quietly stop matching the organisation chart.
Related parties and management override
The transactions least likely to be tested are often the ones the tester reports to. Where that risk sits has to be settled when the programme is written, not when a finding appears.
A board asking for usable assurance
Reporting written for auditors rather than for the people who have to make a decision on the strength of it.
How the work runs
What an engagement looks like
Scope and fees are agreed in advance and in writing, before any of this starts. Where a step turns out not to be needed, it is dropped rather than billed.
-
01
Risk assessment
Understanding the business, where value and exposure actually sit, and agreeing what the programme should cover in the period.
-
02
Annual plan
A written plan tied to that assessment, with coverage, timing and reporting lines agreed before fieldwork starts.
-
03
Fieldwork and testing
Walkthroughs, sample testing and system-based testing of the controls that were agreed, evidenced as the work goes.
-
04
Reporting
Findings ranked by risk, giving the cause rather than only the exception, and a recommendation somebody can act on.
-
05
Follow-up
Tracking agreed actions through to closure and reporting what remains open, so the same finding does not reappear next year.
Scope
What an engagement can cover
A list of what the work can include, not a package. What is actually needed is settled after the first conversation and written into the engagement letter.
- Risk assessment and a written annual audit plan
- Process walkthroughs and controls documentation
- Testing of controls configured inside the ERP, including user access and approval limits
- Stock, procurement, payroll and revenue cycle reviews
- Reporting for management and for the board or audit committee
- Follow-up on agreed actions through to closure
Reported for the people who have to decide something
Board-level experience as a serving company director sits behind the internal audit work. Someone who has sat on a board knows what a board actually needs from internal audit; most auditors have only ever reported to one.
Who this is for
Where this work usually comes from
Retail
Chains running an ERP and a point of sale, where stock, margin and every invoice are now reported in real time.
Pharmaceutical
Manufacture and distribution sold through a trade that settles half its margin outside the invoice — in bonus stock, credit terms, discounts and credit notes.
Alongside this
What this work usually sits next to
One practice handles all of it, so nobody is coordinating between a systems consultant, a tax adviser and a bookkeeper.
Systems & Assurance
ERP Advisory
Selection, implementation and migration
Systems & Assurance
Statutory Audit
Companies Act 2017 audits
Compliance & Outsourcing
Corporate Compliance
Company formation and SECP filings