Governance, risk and internal controls
Internal controls are the checks that stop errors and fraud from reaching your financial statements. For companies above the exemption limits, the Companies Act requires the auditor to report on whether adequate internal financial controls exist and operate; for everyone else, they are what lenders and investors probe in diligence.
When you need this
- Your statutory auditor has raised control weaknesses, or you expect a qualified report on internal financial controls.
- A lender, investor or acquirer wants evidence of how your finance function is controlled.
- You have had a fraud, a large write-off or a repeated error and want to find the cause.
- You are setting up an audit committee, a vigil mechanism or related-party procedures.
What we do
Internal financial controls
Process walkthroughs, a risk and control matrix, testing of design and operation, and a rated list of gaps.
Standard operating procedures
Purchase-to-pay, order-to-cash, payroll, treasury, fixed assets and close, with approval limits written in.
Internal audit
A risk-based plan agreed with the board or audit committee, with findings tracked to closure and re-tested.
Enterprise risk management
Risk register, appetite and ownership, reviewed on a set cycle.
Fraud risk
Assessment of where fraud can occur and the red flags to monitor.
Whistleblower and ethics programmes
Vigil mechanism and policies the board can defend.
Related-party controls
Identification, approval and disclosure procedures.
Board and committee support
Charters for the audit, nomination and remuneration, and CSR committees, and agenda support. The practice is led by a partner who serves as an independent director.
How an engagement runs
- Scope the processes and entities, and rank them by risk.
- Walk each process with the people who run it, and document it.
- Test a sample of transactions against each control.
- Report findings rated by severity, with an owner and a date for each fix.
- Re-test after the fixes.
What we need from you
- Process owners' time, existing policies, the organisation chart, delegation of authority and access to the accounting system.
Questions people ask
- What is the difference between internal financial controls and internal audit?
- Internal financial controls are the checks built into your processes. Internal audit is the independent function that tests whether those checks work. You need the first to run the business; the second tells the board whether it does.
- Do private companies need internal financial controls reporting?
- The requirement applies to companies in general, with exemptions for certain private companies below prescribed turnover and borrowing limits. We check which applies to you.
- Can you do our internal audit if you are our statutory auditor?
- No. Section 144 of the Companies Act bars it. We would take one role or the other.
- How often should the controls matrix be updated?
- When a process, system or approval limit changes, and in any case once a year before the audit.
Related practices
Engagement terms and fees are agreed after the first conversation, based on scope and complexity.
Contact the Office