Start with the decision, not the product
Internal audit should target the processes with the highest operational and control risks.
This service is offered to growing companies and listed entities. That audience description is not a legal eligibility test. Identify your actual objective, such as a suitable business structure, reliable reporting, a specific registration or a response to a notice.
The facts your adviser needs
Prepare procedures, access records, transaction populations and management concerns.
Explain your entity, activities, locations, relevant period and any planned changes. Also disclose existing applications, filings or advisers so duplicated work and conflicting instructions can be avoided.
Ask about alternatives and trade-offs
Ask whether a narrower engagement, a different structure or better internal records would meet the same objective. Compare ongoing obligations as well as the first task. If a requirement is statutory, ask the adviser to identify the applicable official rule and relevant exceptions.
A report without action owners or follow-up dates rarely changes the control environment.
Make the readiness assessment concrete
Assess risk, agree tests, validate findings and assign corrective actions with owners.
Separate items you can resolve internally from those needing professional judgement or external approval. Record the dependencies and consider whether your team has enough capacity to maintain the resulting process.
Choose a next step you can verify
How are findings prioritised and how will remediation be retested?
Define processes covered, sampling, site visits and follow-up testing rather than promising every risk is eliminated.
Request a written recommendation that explains assumptions and the proposed scope. Where current eligibility or regulatory interpretation is uncertain, obtain case-specific advice before spending money or acting.
How to use this resource
