Internal audit & controls

Internal audit & controls

Internal audit looks inward. It examines whether the controls and processes that management relies on are designed and operating in a way that supports the organization’s objectives, its reporting and its compliance obligations. The addressee is usually management and those charged with governance, not the external users of the financial statements.

We provide outsourced or co-sourced internal audit, focused reviews of particular cycles — such as procurement, payroll, cash, inventory or project expenditure — and walkthroughs of the control environment that a board or audit committee can use to understand where the weaknesses are.

Where something unusual has occurred, we can also undertake a targeted review of transactions, documentation and control breakdowns to establish what happened and what should be tightened. If a formal forensic investigation or legal process is required, we will tell you and, where appropriate, work alongside the specialists or counsel you appoint. We do not present this work as a substitute for legal advice or for a statutory audit.

Who it is for

Internal audit and control reviews are for boards, audit committees and management teams that want an independent view of risk and controls, and for organizations that do not maintain a full-time internal audit function of their own.

• Boards and audit committees seeking a risk-based internal audit plan
• Organizations that want an outsourced or co-sourced internal audit function
• Management teams that need a focused review of a process or a control breakdown
• Entities preparing for a statutory audit or a lender or donor review

What is included

• A risk-based plan agreed with those charged with governance
• Walkthroughs and tests of controls in the cycles selected for the period
• Targeted reviews of unusual transactions or control failures, where requested
• Practical recommendations that distinguish prompt actions from longer-term improvements
• Reporting in a format the audit committee or the board can use

What you receive

• An agreed internal audit plan for the period
• Reports on each review, with findings, risk ratings and recommended actions
• A summary for those charged with governance, where this is part of the scope
• Follow-up on previously agreed actions, on request, in a later cycle

Why it matters

A statutory audit is not a substitute for a working control environment, and a board that only hears about problems at year-end is hearing about them late. Internal audit, done on a risk basis and reported in plain language, gives leadership time to act.

Our internal audit work is shaped by the same evidence-led habits as our external audit practice. Findings are supported, recommendations are practical, and we remain independent of the processes we review.

Risk reviews and unusual transactions

From time to time management asks us to look at a set of transactions, a suspected control failure, or a pattern that does not make sense. We will scope that work carefully, preserve the records we examine, and report what the evidence shows. Where the matter may have legal, regulatory or criminal implications, we will say so and recommend the further steps you should consider.

How we work

Whether the engagement is a statutory audit or another assignment, we follow a clear sequence so that both teams know what happens next.

• Planning: Every engagement begins with planning. We take time to understand the entity or project, the applicable reporting framework, the people who will rely on the report, and the dates that matter to the board, lenders or funders. Scope, responsibilities and a realistic timetable are agreed in writing before detailed testing begins. We also agree the information we will need from management, and the points at which we will update you as work progresses. Good planning reduces last-minute pressure and helps both teams work in an orderly way.
• Risk assessment: Once we understand the entity, we assess the risks of material misstatement in the financial statements or, for a project review, in the expenditure and compliance areas covered by the terms of reference. This includes considering the business and its environment, the design of relevant internal controls, and areas that typically require judgment — such as revenue recognition, estimates, related-party transactions and going concern. The audit or review plan is then focused on those risks, so effort is concentrated where it will make the most difference rather than spread thinly across every account.
• Fieldwork: Fieldwork is the stage at which we obtain the evidence that will support our report. Depending on the engagement, this may include inquiry of management, inspection of documents, analytical procedures, confirmations, observation and substantive testing of transactions and balances. We work as far as possible from records that are already organized, and we raise questions and interim findings as they arise so that surprises are dealt with during the assignment, not in the final week. Fieldwork may take place at your premises, at our office in New York, or through a combination of on-site and remote work, agreed during planning.
• Reporting: When testing is complete, we evaluate the evidence as a whole, form our conclusions and discuss significant findings with management and, where appropriate, those charged with governance. For a statutory audit, the formal deliverable is the independent auditor’s report on the financial statements, usually accompanied by a management letter that records control observations and recommendations. For project or special-purpose work, we issue the report format required by the funder or the agreed terms of reference. We aim to explain our findings in clear language, so the report is useful as well as compliant.
• Follow-up: Issuing the report is not the end of a useful engagement. We walk management through the observations in the management letter or project report, distinguish between matters that need prompt attention and those that can be planned into the next cycle, and remain available to clarify our findings. Where we are reappointed, lessons from the current period inform planning for the next one — including information requests, cutoff procedures and any control improvements you have made. Follow-up is practical: the aim is a clearer file, fewer recurring adjustments, and a more orderly engagement the next time around.