Work starts on the ground: how a supplier invoice is actually recorded, approved and paid, who has access to what, which documents are kept. Weaknesses are ranked by severity, and every proposed control has an owner and an expected piece of evidence.
What the engagement covers
Process diagnosis
Description of key processes (purchasing, sales, cash, payroll, fixed assets) as they actually operate, strengths and weaknesses included.
Risk mapping
Risks identified and rated process by process, a criticality matrix and a ranked list of priorities.
Segregation of duties
Analysis of incompatible role combinations and reorganisation of access rights, including in IT tools.
Remediation plans
For each weakness retained: a control, an owner, a deadline and the evidence expected, followed through to implementation.
Approach
- 1 · Scoping
- Processes to cover (purchasing, cash, payroll…) and interview schedule.
- 2 · Fieldwork
- Interviews, observation and walkthrough tests on real documents, to describe how things actually work.
- 3 · Reporting
- Risk map, findings ranked by severity and a remediation plan discussed with management. Every control retained has a named owner.
- 4 · Follow-up
- Progress reviews on implementation, at the frequency set in the proposal.
Typical deliverables
Risk map
The criticality matrix and its rating method, reusable the following year.
Diagnostic report
Findings ranked by severity, each linked to its supporting documents and its impact.
Segregation-of-duties matrix
Incompatible functions, combinations found and proposed reassignments.
Remediation plan
Controls, owners, deadlines and expected evidence, as a tracking table.
A first call to locate your risks.
Describe how your purchasing, payments or cash management work today.