Internal Audit and Risk

Overview

Controls that work on paper do not always work in practice.

Internal audit checks whether the controls a company has defined are actually performed and whether the relevant risks are covered. SGEx maps processes, prioritizes risks, tests controls on documented samples and reports each failure with its cause, impact and recommendation. The work can replace or reinforce the internal audit function and serves boards, audit committees and management.

When clients call on SGEx

• Companies without an internal audit function or with a small team.
• Risk-based annual audit plan for the board or the audit committee.
• Review of purchasing, payments, sales, inventory and payroll.
• Preparation for external audit, investors, financing or corporate transactions.
• Failures, losses or concerns that call for a review of controls.

How SGEx works

• Risk first. Scope follows the company’s risk matrix, not a standard list of processes.
• Evidence-based testing. Each control tested on a sample, with workpapers and supporting documents.
• Independence. Direct reporting to the board, the committee or management, with no ties to the areas audited.

Each finding states the cause, the estimated impact, the owner and the deadline for correction.

What We Solve

• Which risks matter most? Risk matrix by process, with likelihood, impact and existing controls.
• Are the controls performed? Design and operating effectiveness tests, with samples and evidence.
• Where is the company losing money? Review of purchasing, payments, discounts, inventory and receivables.
• Who can approve what? Review of approval limits, segregation of duties and system access.
• Were the failures corrected? Follow-up of action plans through final validation.
• Are there signs of fraud? Data testing and, where needed, referral for investigation.

How We Approach It

1. Risks and scope

   Interviews, process map and risk matrix.

2. Plan

   Prioritized processes, tests and timetable approved.

3. Testing

   Samples, workpapers and evidence.

4. Report

   Findings, recommendations and action plan.

SGEx methodology stages →

What we examine

Policies and procedures, flowcharts, approval matrices, system reports, supplier and customer master data, contracts, purchase orders, invoices, payments, reconciliations and prior audit reports.

Possible Deliverables

The format is defined according to the agreed scope and the purpose of the work.

• Risk and control matrix
• Annual audit plan
• Process reports
• Report to the board or committee
• Control testing
• Action plan follow-up