Services
Internal audit
Understanding processes, risks and controls to support better-informed decisions about how the organisation operates.
A well-written procedure does not always describe how work is performed in practice. As an organisation grows, responsibilities can overlap, controls can become informal and information may move differently between teams. Internal audit examines these relationships and provides a structured perspective on the risks and controls within the processes reviewed.
FORTEXPERT starts with the organisation's objectives and management's questions. An engagement may focus on one process, one area of activity or a defined set of controls, depending on the specific need. The objective is to understand how the activity works, where vulnerabilities may arise and what measures management may wish to consider.
Internal audit requires access to relevant information and open dialogue with the people involved. The review considers both how rules are designed and how they operate in practice. Conclusions relate to the scope examined and the evidence available; they do not imply that every transaction has been tested or that all organisational risks have been eliminated.
01
How we can help
- 01
Process assessment
We follow the steps of an activity, the documents used and the points where decisions are made. We identify dependencies between teams and consider whether responsibilities are sufficiently clear for the process to be monitored and managed consistently.
- 02
Risk and control analysis
We connect process risks with the controls designed to address them. We examine the purpose of each control, who performs it and what evidence supports its operation, distinguishing between a control described formally and one operating in day-to-day activity.
- 03
Identifying vulnerable points
We examine situations such as unclear approvals, incomplete documentation or reviews performed too late to support the process. Observations are explained together with their context, possible implications and supporting information.
- 04
Recommendations for improvement
Recommendations are proportionate to the observations and the operational reality. We discuss practical implications, resource needs and possible responsibilities, while management retains responsibility for deciding and implementing the measures adopted.
02
The FORTEXPERT approach
We define the objective, scope and assessment criteria together. An initial discussion about processes and management concerns helps establish priorities, required information, key contacts and the boundaries of the engagement.
We combine document review with discussions and examples from actual activity. The described process is compared with available evidence and differences are clarified before conclusions are formed. An isolated exception may have a relevant explanation, while a repeated practice may indicate a wider process issue.
Findings are presented in a form that explains the issue and its implications. Recommendations are discussed with the responsible people and confirmed observations are separated from matters that require further analysis. Any follow-up stage is defined against a clear objective.
03
Who this is relevant for
Growing organisations that want to understand whether their processes and controls still support the volume and complexity of their activity.
Companies that have identified differences between procedures and actual practice and need a structured assessment of the causes.
Management teams seeking to prioritise operational improvements on the basis of documented observations and clearly explained responsibilities.
A long-term partner