What we do
| Stage | What you get |
|---|---|
| Risk assessment and planning | A risk register by process, an audit plan and a test programme for your approval |
| Process walkthroughs | Narratives and flowcharts for each process, with key controls identified |
| Control testing | Design and operating effectiveness tests on agreed samples, with evidence filed |
| Compliance reviews | Checks against policies, delegation of authority and agreed regulatory requirements |
| Findings and reporting | Draft observations with risk ratings, root causes and recommendations |
| Follow-up | A tracker of agreed actions, owners and due dates, re-tested when closed |
IFC, SOX and control frameworks
- Internal financial controls (IFC): risk and control matrices, and reviews of design effectiveness (is the control designed to address the risk?) and operating effectiveness (did it work throughout the period?), with deficiencies classified for management and the auditors.
- SOX support: process narratives, risk and control matrices, walkthroughs, and testing of key controls, including IT general controls, to the scope and sample sizes management or the auditors set, with remediation tracking.
- COSO Internal Control – Integrated Framework: reviews mapped to its five components (control environment, risk assessment, control activities, information and communication, and monitoring).
- COBIT: IT governance and IT general controls (access, change management and IT operations) reviewed against COBIT objectives.
- Enterprise risk management (ERM): risk registers, risk appetite and rating scales, and ERM reviews aligned to COSO ERM or ISO 31000, with reporting to the board or audit committee.
Common reviews
- Procure to pay: vendor set-up, approvals, three-way match and payment controls.
- Order to cash: pricing, credit limits, invoicing, collections and credit notes.
- Record to report: journal entries, reconciliations, close and reporting controls.
- Payroll and expenses: joiners and leavers, payroll changes, expense claims and corporate cards.
- Access and change controls in accounting and ERP systems, from system reports.
- Fraud risk reviews: red-flag analytics and targeted testing, led by a Certified Fraud Examiner.
How an engagement runs
- We agree the scope, the processes and the reporting line (internal audit head, audit committee or your engagement partner).
- We plan the work, request documents and hold walkthroughs by video.
- We test, document evidence and discuss exceptions with process owners as we go.
- A senior reviews the file; we issue draft findings for management responses.
- We track the agreed actions and re-test them when they are closed.
Frequently asked questions
Who uses internal audit support?
Companies without a full internal audit team, groups that want an outside view of a subsidiary's controls, and CPA and advisory firms that need extra hands for internal audit, controls or compliance engagements they run for their own clients.
Can you test controls for SOX or IFC?
Yes. We document processes, build risk and control matrices, and test design and operating effectiveness to the scope and sample sizes management or your auditors set, and prepare the testing workpapers for review. Conclusions on control effectiveness and any certification stay with management and your auditors.
Which frameworks do you work to?
COSO Internal Control – Integrated Framework for internal controls, COBIT for IT governance and IT general controls, and COSO ERM or ISO 31000 for enterprise risk management, or your organisation's own framework where it has one.
Do you work on site?
Most of the work is done remotely from documents, system reports and video walkthroughs. Where a site visit is needed, we agree it in the scope.
Who leads the work?
Prashanth Vellanki, who holds the CIA and CFE credentials and has more than 16 years in assurance and internal audit, leads internal audit engagements. Partners with audit backgrounds review the work.
How is it priced?
As a fixed fee per review or audit cycle, agreed from the scope and the number of processes and locations, or per chargeable hour for ongoing testing. See pricing.
General information only, not legal, tax, audit or professional-conduct advice. Rules, standards and software features change, so confirm the position that applies to your firm before you act. See our disclaimer.
