Risk Management and Internal Audit
Most losses inside a small organization are not sophisticated. They come from one person holding too many steps of the same process, an approval nobody performs, or a control that was designed years ago for a business half the size. Internal audit is the work of looking at those processes deliberately, before a loss or an auditor finds them for you.
We provide annual internal audit planning, risk assessment, process and internal control evaluation, issue tracking and resolution, and other risk management consultation. We keep the scope proportionate to the organization. For a small one that usually means confirming the handful of controls that matter are working.
Who we serve
- Organizations with a board or audit committee: Where someone is accountable for oversight and needs work performed independently of management
- Nonprofits and membership organizations: Where funds are held on someone else's behalf and segregation of duties is hard with a small staff
- Growing businesses: Where the informal controls that worked with five people stop working at twenty
- Businesses after an incident: Where something went wrong and the question is what else shares the same weakness
How we help
- Annual internal audit planning: Deciding what to look at this year, based on where the exposure lies
- Risk assessment: Identifying and ranking the risks the organization carries, rather than auditing whatever is easiest to test
- Process and internal control evaluation: Walking through how work is performed, which is often not how the procedure says
- Issue tracking and resolution: Following findings through to a fix, so the same item does not reappear next year
- Risk management consultation: Advice on specific exposures as they come up, without standing up a full engagement