Audit & Risk — Corwell

Overview

Fewer findings. Better ones.

An audit plan with 120 findings helps nobody. We start from the risks your committee loses sleep over, test the controls that matter and report in a form directors can act on in one meeting.

We begin with a risk assessment built from your strategy, your incidents and your external auditor’s letters, and agree a plan with the committee chair before any testing starts.

Every report ranks findings by impact, names an owner and a date, and is followed up until it is closed — not filed and forgotten.

Typical triggers

A listing, bond issue or new investor is 12–18 months away
Your external auditor has raised findings you cannot prioritise
The regulator wants evidence that risk appetite is applied

What’s included

Assurance your committee can rely on.

Risk assessment A ranked view of the risks that matter, agreed with management and the chair.
Risk-based audit plan A 12-month plan sized to your risks, not to last year’s plan.
Controls testing Design and operating-effectiveness tests across finance, IT and operations.
SOX & ICFR readiness Scoping, narratives, risk-control matrices and walkthroughs for listing.
Fraud risk assessment Where fraud could happen, how it would be hidden and how to detect it.
Committee reporting A two-page dashboard and findings tracker for every committee meeting.

Our process

Four steps to a plan the board trusts.

Scope
Weeks 1–2

Interviews with the chair, CFO and risk owners, plus a review of past findings and incidents.
Deliverable: Risk assessment
Plan
Weeks 3–4

A risk-based plan with timing, resources and fees, approved by the audit committee.
Deliverable: Annual audit plan
Test
Ongoing

Fieldwork on the controls that matter, with findings agreed with owners before reporting.
Deliverable: Audit reports
Report & follow up
Each committee cycle

We report to the committee and track every action until the owner shows it is closed.
Deliverable: Committee dashboard

Engagement options

Audit fees agreed before fieldwork.

Controls Health-check

A gap assessment against your framework with a prioritised remediation plan.

$36,000 fixed · 4–6 weeks

Up to 3 key processes
Gap assessment
Remediation roadmap

Choose Controls Health-check

Most chosen

Co-sourced Internal Audit

Our specialists alongside your team, on a risk-based plan agreed with the committee.

$18,500 per month · annual plan

Risk-based annual plan
Fieldwork & reporting
Quarterly committee attendance

Choose Co-sourced Internal Audit

Pre-IPO Readiness

Controls design, documentation and testing ahead of a listing or bond issue.

$210,000 fixed, staged · 6–9 months

SOX scoping & narratives
Dry-run testing
Auditor liaison

Choose Pre-IPO Readiness

Fees exclude VAT and travel. Monthly fees cover the hours in the agreed plan; extra reviews are quoted before they start.

FAQ

Questions audit chairs ask us.

Can you work alongside our in-house audit team?

Yes — co-sourcing is our most common model. We fill skill gaps such as IT, data or fraud, and your team keeps ownership of the plan.

Are you independent of our external auditor?

We are not your statutory auditor and we check for conflicts before every engagement, so our work can be relied on by the committee.

How quickly can you be ready for a listing?

Most clients need six to nine months to design, document and test controls. We give you a realistic date in the health-check.

Do you use data analytics in testing?

Where the data allows, we test full populations instead of samples, which finds more exceptions and takes less of your team’s time.

Request a proposal

Tell us what keeps the committee up at night.

A partner replies within one business day with a proposed scope and a fixed fee for the first phase. Fields marked with * are required.

Assurance scoped to what can actually hurt you.