Internal controls review
Tested findings on whether your procure-to-pay, order-to-cash, inventory and payroll controls work in practice, with owners and practical fixes.
Testing of procure-to-pay, order-to-cash, inventory and payroll controls against how work is really done.
Controls that look sound on paper often fail in practice. Approvals are given in bulk, user access accumulates and workarounds become routine. An internal controls review tests what really happens.
We test the controls in procure-to-pay, order-to-cash, inventory and payroll against how the work is actually done. Data analytics runs on full populations rather than samples, so exceptions are found rather than estimated. Segregation of duties and system access are reviewed, and every exception is traced to its root cause.
Findings come with an owner, a priority and a practical fix. The aim is a set of controls that people follow because they fit the way the business runs.
Controls look sound on paper, but losses, audit findings or rapid growth suggest they are not working.
Signs we see most often
- 01Losses, audit findings or write-offs keep recurring in the same area.
- 02The business has grown quickly or changed its systems.
- 03Users hold access that lets them create and approve the same transaction.
- 04Auditors have raised observations on internal financial controls.
- 05Management wants comfort before signing the directors' responsibility statement.
Scoped in writing, run by one accountable team.
Every engagement starts with agreed questions, a reporting line and a confidentiality protocol. The steps below are how this service usually runs; we adapt them to your matter.
- 01UnderstandDocument each process and its key controls through walkthroughs.
- 02ExtractObtain full transaction and access data from your systems.
- 03TestRun analytics on whole populations and test controls against the evidence.
- 04Review accessCheck segregation of duties and system access rights.
- 05Root-causeTrace each exception to its cause.
- 06FixAgree practical remediation with owners and timelines.
Tested control findings with owners, priorities and practical fixes.
- Tested control findings with evidence
- Exception reports from full-population analytics
- A segregation-of-duties and access conflict report
- Root-cause analysis of material exceptions
- A remediation tracker with owners and priorities
The law and frameworks this work is aligned to
- Aligned to COSO Internal Control: Integrated Framework (2013)
- Companies Act, 2013 ss.134(5)(e) and 143(3)(i) on internal financial controls
- ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting
- Companies (Auditor's Report) Order, 2020
References show the standard the work is built to. They do not imply accreditation or endorsement by the bodies that publish them.
This is a summary of the service. For a deeper understanding of how it would work for your organisation, please reach out to us.
Talk to a BDI partnerWhere this service meets BDI's technology.
The platforms below record, monitor or act on the work this service produces.
Questions clients ask before we start.
Will this duplicate our internal or statutory audit?
It is designed not to. We can focus on the areas where those audits have raised concerns or where fraud risk is highest, and share results with your auditors if you choose.
Why full populations rather than samples?
Because fraud and control failures are rare events, and a sample may miss them. Testing every transaction finds the exceptions that matter.
Do you fix the controls or only report on them?
Both, if you wish. We agree remediation with owners and can support the redesign of processes, approval matrices and system access.