Who This Is For:

• Companies wanting effective governance and control oversight
• Boards and Audit Committees seeking independent assurance
• Management wanting early warning of control failures
• Organizations scaling up from ad-hoc to structured governance

What We Deliver:

• Annual risk assessment and Internal Audit Plan
• Risk-based audit execution (highest risk areas first)
• Control testing - design adequacy and operating effectiveness
• Graded findings (Critical, High, Medium, Low)
• Root cause analysis for each finding
• Management response and action plan
• Quarterly Audit Committee reporting pack
• Year-end internal audit effectiveness assessment

Our Risk-Based IA Methodology:

1. Universe Definition: Map all auditable entities, processes, and functions
2. Risk Assessment: Score each area by likelihood × impact
3. Annual Audit Plan: Prioritize highest-risk areas
4. Pre-Audit Planning: Process documentation and control identification
5. Fieldwork: Walkthroughs, control testing, transaction testing
6. Finding Development: Root cause, impact, recommendation
7. Management Response: Agree actions and timeline
8. Draft and Final Report: Management letter and Board pack
9. Follow-Up: Verify implementation of prior audit actions

FAQ:

Q: How often should internal audit be done?

A: At minimum annually. High-risk organizations (banks, NGOs, manufacturing, healthcare) benefit from quarterly or rolling audit cycles.

Q: Who receives the internal audit report?

A: Reports are issued to the Audit Committee / Board of Directors and Management. For donor-funded organizations, copies may be shared with key donors.