Home/Internal Audit, Governance, Risk & Controls

Vertical one

Internal Audit, Governance, Risk & Controls

Audit functions are being asked to cover more ground: new risk domains, tighter regulatory expectations, leaner teams, all while still delivering robust core assurance. We supply the people who can do that work and we deliver the work itself when capacity runs short.

Discuss a requirement What we cover
Two ways to engage
  • Permanent & interim hiring, managers to Chief Audit Executive
  • Outsourced delivery, a defined scope we own end to end
  • Co-sourced delivery, our people on your methodology
  • Training, included rather than sold separately
How to choose
The picture How we engage What we cover Data analytics & AI Sustainability assurance Roles we place Selected work Questions

The picture

More scope, the same headcount.

The remit of internal audit has widened faster than any function has been resourced to absorb. Climate, third-party risk, AI governance, ECCTA and culture have all been added to a plan that still has to deliver dependable core assurance over finance, operations and IT.

Two things follow. The first is a hiring problem: the market for auditors who can cover a new domain credibly and challenge an executive on it, is thin and it does not get less thin by advertising harder. The second is a delivery problem: some of this work needs doing once, properly, by someone who has done it before and does not justify a permanent head.

Most firms will sell you whichever of those two they happen to sell. We do both, so we can tell you which one you are actually looking at and we have no commercial reason to give you the wrong answer.

Talk it through with a partner

How we engage

People or projects.

Every requirement in this vertical resolves into one of these four modes. The first conversation is usually about working out which.

We supply the people

Specialist recruitment led by practitioners who have held the roles. Every brief is shaped and every CV read, by someone who has done the job.

Permanent
Roles that shape long-term capability. From Internal Audit Managers to Chief Audit Executives. Single hires, team builds and phased hiring plans.
Interim
Specialist resource for peaks, projects and gaps. Typically three to twelve months. Fast to mobilise, without lowering the technical bar.
How our recruitment works

We deliver the work

Audit engagements owned end to end or our consultants embedded alongside your team, delivered by the same partners who scoped them.

Outsourced
A defined scope, a named team, an agreed outcome. From a single specialist review to a full internal audit outsource. We carry the delivery risk.
Co-sourced
Our consultants inside your function, on your methodology, reporting to your Head of Audit. Ideal for topping up a lean team through a busy period.
How our delivery works

What we cover

The full assurance remit.

We staff and deliver across the whole internal audit and controls agenda. These are the areas we are asked for most often.

Core assurance

Internal audit delivery

Risk-based annual plans, individual reviews and full outsource of the function. Fieldwork, reporting and audit committee papers, on your methodology or ours.

Regulatory

ECCTA & failure to prevent fraud

Companies House and identity verification readiness, plus the reasonable procedures defence: risk assessment, controls, policy, training and independent assurance over the lot.

Controls

Internal controls over reporting

Controls design and documentation, walkthroughs and testing, remediation tracking and readiness for the UK's tightening corporate governance expectations.

Governance

Governance & board effectiveness

Governance framework reviews, committee terms of reference, three-lines-of-defence design and the Provision 29 declaration on risk management and internal control effectiveness.

Risk

Enterprise risk management

Risk framework design and refresh, appetite statements that survive contact with a board, risk register rebuilds and assurance mapping across the three lines.

Technology

IT, cyber & change audit

IT general controls, cyber resilience, third-party and cloud risk, data governance and assurance over major change and transformation programmes.

Quality

External quality assessment

Independent EQA against the Global Internal Audit Standards, self-assessment with independent validation and the improvement plan that should follow one.

Where the verticals meet

Auditing sustainability data & assurance training

Assurance over ESG and carbon reporting: boundaries, emission factors, data lineage, evidence and review. The discipline that needs both of our practices at once.

A note on ECCTA

The deadline is doing the work for you.

The Economic Crime and Corporate Transparency Act has given boards a hard date and a personal-consequence framing that most compliance programmes never get. Identity verification at Companies House and the failure to prevent fraud offence are now the two items most likely to be on an audit committee agenda without anyone having asked for them.

Our ECCTA work runs in two phases. Companies House and identity verification readiness comes first, then the reasonable procedures defence is built and independently assured. The second phase matters more: a defence that has never been tested is not a defence.

Read the ECCTA case study

Roles we place

From the manager layer to the audit committee.

Permanently and on an interim basis. The manager layer is where most functions succeed or fail, so it is where we spend most of our time, but we run the senior appointments too.

How our recruitment works Send us your CV
  • Chief Audit Executive / Head of Internal Audit
  • Internal Audit Director & Senior Manager
  • Internal Audit Manager
  • IT & Cyber Internal Audit Manager
  • Head of Risk & Enterprise Risk Manager
  • Head of Internal Controls / SOX Manager
  • Head of Compliance & Financial Crime
  • Governance Manager & Company Secretarial
  • Non-Executive Director & Audit Committee Chair

Data analytics & AI

Two jobs and most functions only have one of them.

Internal audit has to use these tools and assure them. Building the capability and auditing the organisation's use of it are different disciplines and we work on both.

Building the capability

Getting analytics and AI into the audit process itself, so testing moves from samples toward populations and the routine work stops consuming the plan.

Alteryx
Repeatable data workflows built with your team rather than for them. Data preparation, continuous controls monitoring and full-population testing on the areas where sampling was never telling you much.
Copilot
Practical Copilot training for audit teams. Where it genuinely saves time, where it quietly introduces risk and how to evidence the use of it in a working paper.
Agentic AI
Agents built in Copilot Studio for the repetitive parts of an audit cycle: request chasing, evidence triage, first-pass document review and reporting drafts, with a human decision point kept where it belongs.

Auditing AI use

The other side of the same question. Your organisation is already using these tools, very often without a register, an owner or a control.

Governance
What is actually in use and who owns it. Inventory, approval routes, accountability and whether policy reflects what people do rather than what they were told to do.
Controls
Data handling, access and output review. What goes into a prompt, where it goes, who checks what comes back and whether a decision made with model output can be explained afterwards.
Assurance
A review the audit committee can act on. Proportionate to how the organisation actually uses AI, rather than a maturity model scored against a framework nobody will apply.

Why we run both

An audit function that has never built anything with these tools tends to audit them badly. It asks about policy rather than practice and it accepts answers it has no way to test.

Teams that have built a workflow in Alteryx or an agent in Copilot Studio ask sharper questions: where the data came from, what the tool does when it is uncertain and who reviewed the output before someone relied on it.

Discuss a capability build
0102030405

Sustainability assurance preparedness

Limited assurance under CSRD and ISSB.

Sustainability disclosures are moving into scope for external assurance and internal audit is usually the function asked to get the organisation ready for it.

Limited assurance is a lower bar than the audit of a financial statement, which is exactly why it catches people out. The assurer is not testing everything. They are asking whether anything has come to their attention suggesting the disclosure is materially misstated and the fastest route to that conclusion is finding out that nobody can evidence how a number was produced.

We prepare organisations for that engagement: mapping disclosures to source data, documenting methodology, putting review and sign-off in place and running a dry-run against the evidence the assurer will actually ask for.

  • Readiness assessment against the assurance standard your assurer will apply.
  • Data lineage and evidence traced from the published figure back to source.
  • Controls over the reporting process, designed to be testable rather than described.
  • Internal audit capability built so your team can assure this work in future cycles.
  • Dry run before the assurer arrives, so the findings are ours rather than theirs.
Discuss assurance readiness The sustainability view

Selected work

Recent Internal Audit & GRC engagements.

Full programme

ECCTA compliance programme

A two-phase programme for a financial services group: Companies House and identity verification readiness ahead of the November 2026 deadline, then the failure to prevent fraud defence built and independently assured.

2 phases
Companies House, then fraud
6 stages
Gap analysis to board reporting
Read the case study
Interim placement

Internal Audit Manager, Provision 29

Supplied an Internal Audit Manager to a mid-size accountancy firm for a six-month Provision 29 engagement. The same client then took on a further Internal Audit Manager for broader business audits.

6 months
Initial engagement
Repeat
Second placement followed
Read the case study
Recruitment

IT Internal Audit Manager, London insurer

Supplied an IT Internal Audit Manager to a large insurance business in London, covering technology, cyber and change risk across the annual audit plan.

IT Audit
Scarce specialism
Insurance
London market
Read the case study
All case studies

Questions

The ones we get asked first.

Yes and we are explicit about where the line sits. We will not place a candidate into a function and then audit that person's work without telling you and we will not use an advisory engagement as a route to a hiring brief. Where both are in play, we set the boundary in writing at the start of the engagement.

Usually one of three things: cover a specialism your team does not hold (IT, cyber, sustainability data), absorb a peak so the annual plan still lands or provide the independent element for something your own team cannot assure, such as a Provision 29 declaration, an EQA or the assurance layer over an ECCTA defence. Co-sourcing means we work on your methodology and report to your Head of Audit, so the function stays yours.

For delivery work, days rather than procurement cycles. The constraint is normally your access and data, not our availability. For interim placements, we would expect to present a shortlist within a fortnight of an agreed brief, sooner where the specialism is one we cover routinely.

Yes. We operate from London and Dubai and our UAE practice trades as Middle East Advisory Partners. Our partners have worked across multiple jurisdictions and a good part of our current work is with sovereign investors, banks and corporates across the GCC.

It is. Every advisory engagement includes handing over the methodology, templates and reasoning so your team can run the next cycle themselves. We would rather be engaged again because you have a new problem than because you never learned to solve the last one.

Tell us what is on the plan.

A hire, a review or a deadline you are not going to make with the team you have.

I need people

Permanent or interim, manager to Chief Audit Executive. Briefs are shaped by a practitioner who has held the role.

Our recruitment practice

I need this delivered

Outsourced or co-sourced. A named partner, a written scope and a deliverable you can take to the audit committee.

Our delivery practice