Internal audit and outsourcing of the function
We run the internal audit function in full, or support your team on a specific engagement. To the standards, but in the language the board speaks.
Internal audit is the only function in an organisation with a mandate to look anywhere and tell the board what nobody else will. There is one condition: it must be independent and it must be competent. Outsourcing solves both at once.
We work to the International Standards for the Professional Practice of Internal Auditing. For Polish public sector entities we deliver audits in line with the Public Finance Act and the Ministry of Finance regulation on internal audit.
Three ways we can work
Full outsourcing
We take on the duties of the internal audit function: risk analysis, annual plan, delivery of engagements, reporting to the board and audit committee, follow-up on recommendations, annual report.
Suited to: organisations without an audit department, or where a full-time auditor is not economically justified.
Co-sourcing
We work alongside your team, bringing methodology, analytical tools and specialist competence where the team lacks it — IT audit, procurement, or the anti-fraud area.
Suited to: existing audit functions needing reinforcement in a specific area or additional capacity.
Single engagement
One precisely defined audit with an agreed scope and deadline, without commitment to further cooperation. From audit programme to presentation of the report.
Suited to: boards and supervisory boards wanting an independent look at a specific area or verification of a signal.
Areas we examine most often
-
Procurement and purchasing
How suppliers are selected, segregation of duties in the purchasing process, splitting orders below thresholds, matching invoices to contracts and deliveries, concentration with a single supplier, personal connections between buyer and vendor.
-
Expenditure and settlements
Preventive and post-hoc control, the flow of financial documents, payments without a basis, duplicate invoices, expense and corporate card settlements, advances not cleared on time.
-
Contracts and obligations
Completeness of the contract register, automatically renewing agreements, contractual penalties never enforced, securities not returned, commitments entered into without authority.
-
HR and payroll
Alignment of payments with contracts and policy, variable pay components, time recording, overtime, employment of related persons, system access retained after termination.
-
Assets and inventory
Reliability of records, stocktaking and reconciliation of differences, management of fixed assets, asset disposal, fuel and fleet, warehouse shrinkage.
-
Information security and IT systems
System permissions and segregation of roles, privileged accounts, access retained by leavers, logging and accountability of operations, backups, GDPR compliance in data processing.
-
Projects and grants
Eligibility of expenditure, alignment with schedule and budget, evidencing of indicator achievement, project durability, readiness for inspection by the funding institution.
-
The management control system
Completeness and realism of procedures, adequacy of controls against identified risks, how self-assessment functions, reliability of the management control statement.
What you receive
- Audit programme — scope, research questions, schedule and required access, agreed before work starts
- POP report — findings structured as Potential, Savings and Perspective, quantified, identifying root cause rather than symptom
- Priority map — recommendations ranked by effect against effort, with deadline and owner
- Presentation to the board or audit committee — results in a decision format, not a reporting one
- Working papers — complete engagement files, ready for external inspection or quality assessment
- Implementation check — verification after an agreed period that the recommendations worked
Full-population analysis
We do not test a random sample where the whole population can be tested. Transaction data is analysed in full — duplicate testing, value-distribution analysis, timing patterns, three-way matching of invoice, order and delivery.
That is why a finding reads „in the period reviewed there were 47 such cases totalling X” rather than „instances were identified”.
Do you need internal audit?
Tell us which area concerns you or which requirements you must meet. We will suggest the right engagement model, scope and an indicative timeline.
Get in touch