Risk-Based Audit.
A risk-based audit starts from what could go wrong in your business rather than from a fixed checklist. We identify and rate risks by likelihood and impact, map the controls meant to address them, and focus testing where the remaining risk is highest. You end with a risk matrix and a clear view of which gaps need attention first.
Typically 3–6 weeks. The number of business units, the availability of process owners for interviews and whether a risk register already exists drive the time.
A partner — a chartered accountant or company secretary — from the first call to sign-off.
Based on your situation, and fixed in writing before any work starts.
Is this for you?
- Boards and audit committees that must report on or evaluate risk management under the Companies Act, 2013
- Businesses entering new markets, products or systems
- Companies whose internal audit has become a routine checklist
- Businesses whose lenders or investors ask for a risk assessment
What you receive at the end.
- 01Risk register with likelihood and impact ratings
- 02Risk matrix (heat map)
- 03Risk and control matrix with test results
- 04Prioritised mitigation plan with owners
Risk-Based Audit, step by step.
Typically 3–6 weeks. The number of business units, the availability of process owners for interviews and whether a risk register already exists drive the time.
- 1
Risk identification
Through interviews and data review, we list strategic, operational, financial, compliance and IT risks.
- 2
Risk assessment
We rate each risk for likelihood and impact and plot it on a risk matrix.
- 3
Control mapping
We link each significant risk to the controls meant to manage it and note where none exist.
- 4
Targeted testing
We test the controls over high and medium risks and assess the residual risk that remains.
- 5
Risk register report
We present the risk register, heat map and recommended mitigations, in order of priority.
What we need from you.
Don't have everything yet? We send a short checklist after the first call and work with what you have.
- Business plan, organisation chart and key policies
- Any existing risk register or risk management policy
- Previous audit and inspection reports
- Financial statements and MIS
- Access to process owners for interviews
The fee depends on your situation. After a short call, the partner who will do the work tells you what's involved and gives you a fixed fee in writing — before any work begins.
- Government fees and statutory charges are billed at actuals.
- When you pay — upfront, in stages or on completion — is agreed in writing with the fee.
Questions about Risk-Based Audit.
Ready to discuss Risk-Based Audit?
30-minute confidential call — no proposal, no commitment. A partner will write back within one business day.