We help finance and operations leaders build an internal control framework that is proportionate, clearly owned and capable of withstanding testing by internal audit and statutory auditors.
Executive overview
Assessment, design and documentation of internal control frameworks built around key controls, named control owners and testable evidence.
Internal control is often stronger in practice than on paper, and weaker in practice than management assumes. Controls are performed by experienced people but are not documented, reviewed or evidenced consistently, and segregation of duties erodes as systems and teams change. The result is audit findings, management letter points and limited assurance for the audit committee.
We assess your current control environment by process, identify key controls against the risks they address, and design or strengthen the framework, drawing where relevant on COSO-style internal control principles. We test the design and operating effectiveness of controls, analyse segregation of duties conflicts and deliver a remediation plan and documentation your teams can maintain.
Business challenges addressed
- 01
Recurring audit findings
The same control weaknesses reappear in internal audit reports and auditor management letters year after year.
- 02
Key controls not identified
Many activities are labelled controls, but nobody has agreed which ones genuinely mitigate key risks.
- 03
Segregation of duties eroded
System access and organizational changes leave individuals able to initiate, approve and record the same transaction.
- 04
No evidence trail
Reviews and reconciliations happen, but evidence of performance and review is not retained in a form an auditor can test.
Services and solutions
- 01
Internal control assessments
Review of the control environment and key processes, such as purchase-to-pay, order-to-cash, payroll and financial close, to identify gaps against the risks that matter.
- 02
Internal control framework design
Design of the control framework, including control objectives, key controls, control owners, frequencies and review responsibilities, proportionate to your organization.
- 03
Control mapping
A risk and control matrix linking each process risk to the controls that address it, distinguishing preventive and detective, manual and automated controls.
- 04
Control effectiveness reviews
Testing of the design and operating effectiveness of key controls through walkthroughs, sampling and evidence review, with findings rated by severity.
- 05
Segregation of duties analysis
Definition of an incompatibility matrix and analysis of roles and system access to identify SoD conflicts, with remediation or compensating controls where separation is not practical.
- 06
Control remediation plans
Prioritised remediation plans that address control deficiencies with owners, deadlines and the evidence expected to demonstrate closure.
- 07
Internal control documentation
Process narratives, flowcharts, control descriptions and evidence requirements written so that control owners can perform and auditors can test each control.
Typical engagement approach
- 01
Scope
Select in-scope entities and processes based on materiality and risk, and agree the control framework of reference.
- 02
Assess
Walk through processes with control owners, map risks and controls and analyse segregation of duties.
- 03
Design and test
Define or strengthen key controls, then test their design and operating effectiveness.
- 04
Remediate and document
Agree remediation actions, support their implementation and finalise documentation for ongoing use.
Expected deliverables
- Internal control assessment report by process
- Risk and control matrix identifying key controls and owners
- Segregation of duties incompatibility matrix and conflict analysis
- Design and operating effectiveness test results
- Prioritised control remediation plan
- Process narratives, flowcharts and control descriptions
Outcomes you can target
- 01
Fewer recurring findings from internal and external auditors
- 02
Clear accountability for each key control
- 03
Segregation of duties conflicts identified and addressed
- 04
Greater assurance for the audit committee on the control environment
Related expertise
More in Governance, Risk & Compliance
- Enterprise Risk ManagementRisk frameworks, risk mapping, registers and appetite statements that give leadership a shared, prioritised view of the risks that matter.
- Organization & ProceduresOrganizational diagnostics, procedures, delegations of authority and governance structures that make roles, decisions and accountabilities explicit.
- Audit & Certification ReadinessReadiness assessments, gap analyses, evidence organization and remediation that prepare you for internal, external and certification audits.
Frequently asked questions
What is the difference between testing design and operating effectiveness?
Design testing checks whether a control, as described, would address the risk. Operating effectiveness testing checks, on a sample, whether the control was actually performed as designed throughout the period, with evidence.
Can a smaller organization achieve proper segregation of duties?
Full separation is not always practical in small teams. In those cases we design compensating controls, such as independent review of transactions or management sign-off on reports, so that the residual risk remains acceptable.
Do you replace our internal audit function?
No. We help management design and operate the control framework. Internal audit keeps its independent assurance role, and we coordinate with it and with your statutory auditors throughout.
Talk to an expert about Internal Control
Tell us where you are today and what you need to achieve. We will propose the right scope for a first engagement.