Corporate Solutions
Operational Audit & Internal Controls
Independent assurance on how your processes and controls work in practice, reported to management and the audit committee with clear actions and owners.
Overview
Financial statements show what happened. They rarely show where money leaks, where controls are bypassed, or why a process takes twice as long as it should. Those answers come from looking at how the business actually runs, transaction by transaction and location by location.
This service provides that view. We plan internal audits around the risks that matter to your business, test processes and controls using data analytics across full populations where data allows, and document processes so they run the same way everywhere. Findings are reported with risk ratings, root causes and agreed actions, and we follow them up until they are closed.
Where this helps
Common situations
Governance and the audit committee
- 01The company has crossed the Companies Act thresholds for mandatory internal audit and needs an internal auditor and an audit plan.
- 02The audit committee receives reports that list observations but not risks, root causes or owners.
- 03Promoters want independent assurance before bringing in investors, lenders or a new management team.
- 04The internal audit plan has not changed in years, even though the business has.
Leakages and efficiency
- 05Purchase prices for the same item vary across vendors and locations, and no one questions it.
- 06Discounts, credit notes and sales schemes are given without consistent approval.
- 07Stock losses, write-offs and slow-moving inventory keep rising.
- 08Payroll includes inactive employees, unapproved overtime, or incentives paid on wrong data.
- 09Capital projects run over budget, and completed assets are capitalised late.
Controls and compliance
- 10The statutory auditor asks for evidence of internal financial controls that management cannot produce.
- 11Controls are written into policies but are not followed in practice.
- 12Compliance with laws, licences and internal policies is assumed rather than checked.
Processes and documentation
- 13Processes have grown informally, and each location follows its own practice.
- 14There are no SOPs, so new staff learn the job from whoever is available.
- 15Procure-to-pay, order-to-cash and lead-to-sale cycles take longer each year, and no one can say why.
- 16There is no delegation-of-authority matrix, so approvals depend on who happens to be present.
Fraud and special situations
- 17A whistle-blower complaint or an unusual transaction needs an independent review.
- 18A vendor, distributor or employee is suspected of irregularities, and evidence must be gathered properly.
- 19A lender, investor, regulator or the board asks for a one-time special audit.
How we help
What we do and how we work
Risk-Based Internal Audit
We assess the risks facing your business, define the audit universe and agree an annual internal audit plan with management and the audit committee. Audits are carried out cycle by cycle, and results are reported every quarter with actions, owners and deadlines.
Includes
- risk assessment and audit universe
- annual internal audit plan
- cycle-wise audits
- quarterly audit committee reports
- action tracking
- outsourced or co-sourced internal audit
Operational & Management Audit
We review business cycles end to end to find leakages, delays and inefficiencies, and recommend practical corrective actions that management can implement.
Includes
- procure-to-pay
- order-to-cash
- inventory and warehousing
- payroll and HR
- capital projects
- logistics and distribution
Internal Financial Controls & Compliance Audit
We prepare risk and control matrices for key processes and test the design and operating effectiveness of controls, supporting management's assessment for the statutory auditor's reporting. Compliance audits check adherence to laws, licences, policies and approvals.
Includes
- risk and control matrices
- entity-level controls
- design and operating-effectiveness testing
- deficiency reporting
- compliance audits
- remediation tracking
Process Gap Analysis
Each year we walk through the procure-to-pay, order-to-cash and lead-to-sale processes to find errors, bottlenecks and control gaps. The processes are then revalidated against the findings, with a roadmap for improvement.
Includes
- process walkthroughs
- bottleneck and gap mapping
- control gap analysis
- revalidated process flows
- improvement roadmap
Business Process Re-engineering & SOPs
We map how each process should run and document it in standard operating procedures and process manuals, so that every location follows the same practice. A delegation-of-authority matrix sets out who approves what.
Includes
- process maps
- SOPs and process manuals
- delegation-of-authority matrix
- policy documents
- roll-out support
Special Audits & Fraud Risk Reviews
We carry out special-purpose audits and red-flag reviews, testing transactions in detail and documenting evidence carefully. Reviews follow ICAI's Forensic Accounting and Investigation Standards where they apply, and are reported to whoever appointed us.
Includes
- special-purpose audits
- fraud risk assessment
- red-flag and transaction reviews
- whistle-blower complaint reviews
- evidence documentation
- investigation support
Ways to engage
How we can work with you
Outsourced internal audit
You need a complete internal audit function, reporting to management and the audit committee
Co-sourced internal audit
You have an internal audit team and need added capacity or specialist reviews
One-time review
A process review, IFC testing, SOP project or special audit with a defined scope
Who this is for
Companies required to appoint an internal auditor under the Companies Act; companies with audit committees; family-owned businesses moving to professional management; multi-location manufacturing, retail and distribution businesses; and businesses preparing for investors, lenders or a change in management.
Frequently asked questions
Questions people ask
Is internal audit mandatory for my company?
The Companies Act requires listed companies, and unlisted and private companies above prescribed turnover, borrowing or deposit limits, to appoint an internal auditor. We can check your company against the current limits.
Can our statutory auditor also be our internal auditor?
No. For companies, the law does not allow the statutory auditor to provide internal audit services to the same company.
How is internal audit different from statutory audit?
A statutory audit reports on whether the financial statements are true and fair. Internal audit looks at how processes and controls work during the year and reports to management and the audit committee on risks and improvements.
How often do you report?
Usually every quarter to the audit committee, with cycle-wise reports to management as each audit is completed. The frequency is agreed in the audit plan.
Do you test every transaction or only samples?
Where data allows, we use analytics to test full populations. Physical checks and walkthroughs are done on a risk-based sample.
How are fraud reviews kept confidential?
They are handled by a small team, documented carefully and reported only to the board, audit committee or person who appointed us.
Services are offered subject to applicable independence requirements.