Risk AdvisoryRisk Advisory

Build in-house when the company has hit a scale where a permanent function pays for itself — usually past 300 employees or multiple business units.

Bring in external internal audit when the audit committee wants independent assurance, when there's a regulatory trigger (IFC / ICFR for listed entities), or when in-house attempts have created findings without action. We are also brought in to bootstrap an internal audit function — set the methodology, build the team, hand over in twelve to eighteen months.

Risk-based — derive the plan from a current risk-and-control register, not from last year's checklist.

We typically cover the top eight to twelve cycles in year one: procure-to-pay, order-to-cash, payroll, treasury, fixed assets, inventory, IT general controls and the two or three cycles material to your sector. The audit committee approves the plan; we deliver it across the year with quarterly status updates.

Annual retainer scoped to the approved plan, billed monthly.

The retainer covers fieldwork, reporting and the action-tracker reviews. Out-of-scope special audits (forensic, fraud, M&A-related) are scoped and billed separately at engagement-level rates. We don't bill by the hour — predictable annual budgeting matters more to CFOs than precise time tracking.

Sixteen to twenty weeks for a mid-sized listed entity to reach a documented, tested and remediated control environment.

The first six weeks are scoping and walkthroughs; weeks seven to fourteen are design and operating-effectiveness testing; the final six weeks are remediation, retesting and the audit-committee report. After year one, the maintenance cadence drops to roughly forty percent of that effort annually.

Findings go to the audit committee and management — never to anyone else inside or outside the firm.

We sign mutual NDAs at engagement letter stage. Our workpapers are stored on access-controlled servers, separated from other client engagements, and destroyed seven years after engagement close as professional standards require.

Same staffing point as our other practices — Big-4 teams sell with partners and deliver with junior consultants.

We staff partner-deep, run fewer engagements, and the partner you meet is the partner who signs the report. Our methodology is the same as Big-4 (IIA standards, risk-based audit, IFC / ICFR aligned to SOX-equivalent rigour) — what differs is who is actually in the room.

Yes, and often that's the structure that works best.

We co-source — your team does the routine cycle audits, we cover the specialised or higher-risk areas, and our partner sits on the audit committee briefing. After eighteen to twenty-four months your team usually owns ninety percent of the work and we step into a quality-assurance role.

It belongs to you — we hand over the live tracker, the methodology, and the templates at the end of the engagement.

We continue to review the tracker quarterly during the retainer; after the retainer ends, you run it. Most clients keep the quarterly review going on a smaller retainer rather than letting the tracker go stale.

Not for the same company.

Independence rules in the Companies Act and ICAI's code prohibit it. If we already do your statutory audit, we cannot also do internal audit, and vice versa. We sometimes pair with another firm doing the audit we cannot — but the engagement letter makes that crystal clear from day one.

Mid-market — typically companies with revenue between INR 50 crore and INR 2,000 crore.

Smaller companies usually don't need a full internal audit function yet; larger companies often have built one in-house. The sweet spot for an external partner-led practice is that mid band, where the audit committee wants independent assurance but a full in-house function isn't yet warranted.