Advisory
Governance, Compliance & Risk Management
A charter describes how a board should work; the minutes record how it did. We work on the distance between the two - then build the risk framework, audit function and control documentation that keep it closed.
Our method
Engagement Method
- 01
Diagnostic
Board papers, minutes, charters and committee composition are reviewed against the applicable code and against observed practice.
- 02
Framework Design
Risk appetite, escalation thresholds and committee mandates are written to be usable at board level rather than filed.
- 03
Audit Execution
A risk-based plan built from the entity’s own risk universe, with coverage gaps stated explicitly and fieldwork evidenced to source.
- 04
Embedding & Assurance
We run the first cycles alongside management, then review independently after two cycles to test whether the framework is actually applied.
Tested against
International Professional Practices Framework (IPPF)
The Institute of Internal Auditors
The recognised authority for internal audit practice, and the basis on which an audit function is quality-assessed.
COSO Enterprise Risk Management
Committee of Sponsoring Organizations of the Treadway Commission
The reference framework for enterprise risk management and for the internal control model audit committees expect.
ISO 31000 - Risk management
International Organization for Standardization
Used where a client needs risk management expressed in a form that maps onto its other ISO management systems.
What is handed over
- 01A governance diagnostic against the applicable code, with findings ranked
- 02An ERM framework with a documented risk appetite statement
- 03A board-approved internal audit charter and risk-based annual plan
- 04Audit reports carrying an owner, a date and a verification step per finding
- 05A reviewed policy and SOP set with a control matrix
What we cover
- Corporate governance and board structure evaluation
- Committee effectiveness and fiduciary practice review
- Enterprise risk management frameworks tailored to the industry risk landscape
- Risk register design, calibration and escalation thresholds
- Internal audit function set-up, audit charters and annual plans
- Risk-based internal audit execution and audit committee reporting
- Policy, SOP and internal control framework development and review
- Governance and risk assessments
What you get
- 01
Board papers that support decisions instead of recording them
- 02
A risk register management maintains without being asked
- 03
Audit findings that close and stay closed on re-test
Typical engagements
- Board effectiveness evaluation
- ERM framework build
- Outsourced or co-sourced internal audit
- Policy and control framework review
Related training
Related Courses
ExecutiveGovernance & Compliance
Corporate Governance & Board Effectiveness
Fiduciary duty, committee mandates and the practice of running a board that decides rather than receives.
- 16 hrs
- 5 modules
- In person
Certificate In Corporate Governance & Board Effectiveness
IntermediateGovernance & Compliance
Enterprise Risk Management (ERM)
Design an ERM framework, set a risk appetite the board will actually use, and keep a risk register that management maintains.
- 24 hrs
- 8 modules
- Blended
Certificate In Enterprise Risk Management
IntermediateGovernance & Compliance
Risk-Based Internal Auditing
Plan and execute an internal audit programme driven by the entity’s real risk universe rather than by last year’s plan.
- 30 hrs
- 10 modules
- Blended
Certificate In Risk-Based Internal Auditing
Related reading
Recent Work
3 min readeTIMS: The Reconciliation, Not The Invoice
Onboarding onto eTIMS is a morning of work. Keeping the sales ledger tied to it, month after month, is the part that fails at audit.
Mohamed Ahmed
Managing Director
3 min
3 min readThe Clock On A KRA Assessment
An objection is a document with a deadline and a required form. Miss either and the merits of your position stop mattering.
Mohamed Ahmed
Managing Director
3 min
3 min readRegistration Is The Easy Part
Registering with the Data Commissioner takes an afternoon. Being able to answer what you hold, why, and for how long takes considerably longer.
Mohamed Ahmed
Managing Director
3 min