Risk Advisory Services

An effective internal audit function provides management and those charged with governance with independent insight into the effectiveness of processes, controls and risk management.

Our internal audit services help organizations evaluate and strengthen their internal control environment, identify opportunities for improvement and enhance the efficiency of business processes. We work with management to understand key business risks and provide practical recommendations that support the achievement of strategic and operational objectives.

Our services include:

- Internal Audit Outsourcing and Co-sourcing – We provide fully outsourced internal audit services or specialist support to complement and strengthen existing internal audit teams.

- Internal Controls and Business Process Reviews – We evaluate the design and effectiveness of internal controls and business processes, identify weaknesses and recommend practical improvements.

- Operational and Compliance Audits – We assess operational efficiency, compliance with applicable laws and regulations, and adherence to internal policies and procedures.

- Risk-Based Internal Audits – We develop and conduct risk-based internal audits, focusing on the most significant risks affecting business operations and strategic objectives.

- Corporate Governance and Control Framework Reviews – We assess corporate governance structures, accountability mechanisms and internal control frameworks against recognised standards and good practices.

- Process and Control Improvement – We provide practical, prioritised recommendations to optimise business processes, strengthen internal controls and enhance operational effectiveness.

Professional Credentials: ACCA, Certified Internal Auditors (CIA) 

Fraud, misconduct and other forms of financial and corporate crime can result in significant financial losses, regulatory consequences and reputational damage. Organizations need effective measures to prevent fraud and the right expertise to respond when concerns arise.

RSM supports organizations in identifying fraud risks, strengthening preventive controls and conducting independent investigations when potential fraud or misconduct is identified.

Our services include:

- Fraud Risk Assessment and Prevention – We identify and evaluate fraud risk exposures across business processes, assess the adequacy of existing preventive and detective controls, and recommend practical measures to reduce the likelihood of fraud.

- Fraud and Misconduct Investigations – We conduct independent, objective and confidential investigations into suspected fraud, corruption and employee misconduct, establish the facts and provide management with well-documented findings.

- Forensic Accounting and Analysis – We apply forensic accounting techniques and data analytics to examine financial records and transactions, trace funds and identify anomalies, patterns and indicators of irregularity.

- Investigation of Suspected Financial Irregularities – We review suspected misstatements, unauthorised transactions, misappropriation of assets and other irregularities, and determine how they occurred and which control weaknesses allowed them.

- Review of Internal Controls and Anti-Fraud Measures – We evaluate the design and effectiveness of internal controls, whistleblowing mechanisms and anti-fraud policies, identify weaknesses and recommend practical improvements.

- Support in Quantifying Financial Losses – We assist in determining the amount and nature of financial losses resulting from fraud or misconduct and prepare supporting analysis to assist management in recovery efforts and in dealings with insurers and other stakeholders.

- Recommendations for Strengthening Fraud Prevention Frameworks – We provide practical, prioritised recommendations to build or enhance anti-fraud frameworks, including governance, policies, controls, awareness and ongoing monitoring.

Professional Credentials: Certified Fraud Examiners (CFE)

As organizations become increasingly dependent on technology and digital information, information security, cybersecurity and technology risk continue to grow. Weak IT controls, unauthorised access, system vulnerabilities and inadequate processes can affect business continuity, data protection, financial performance and reputation.

Our IT audit and IT risk assessment services help organizations assess their information security and technology controls, identify vulnerabilities and strengthen their overall internal control environment and IT governance.

Our services include:

- ISO/IEC 27001:2022 Readiness Assessment – We assess your organisation's readiness for ISO 27001 certification, identify gaps against standard requirements and provide practical recommendations to achieve compliance.

- ISO/IEC 27001:2022 Pre-Certification Audit – We conduct pre-certification audits to evaluate the effectiveness of your Information Security Management System (ISMS), identify areas requiring improvement and help prepare your organisation for certification.

- ISO/IEC 27001:2022 Implementation Support – We support the development and implementation of an ISMS, including information security policies, procedures, risk assessments and controls aligned with ISO 27001 requirements.

- PCI DSS Compliance Assessment – We assess your organization’s compliance with the Payment Card Industry Data Security Standard (PCI DSS), identify control gaps and recommend measures to strengthen payment card data security.

- SWIFT Customer Security Programme (CSP) Compliance Assessment – We assess compliance with the SWIFT Customer Security Controls Framework (CSCF), identify security control deficiencies and provide recommendations to address compliance gaps.

- Information Security and IT Risk Assessments – We conduct targeted IT risk assessments of information security controls, policies, procedures and practices to identify vulnerabilities, assess technology risk and highlight opportunities for improvement.

- IT Audit and Comprehensive Information Security Audits – We perform comprehensive, risk-based IT audits and information security audits to evaluate the effectiveness of IT and security controls, identify weaknesses and assess the organization’s overall information security posture.

- IT Governance and Information Security Process Reviews – We evaluate IT governance and information security governance frameworks, roles and responsibilities, policies and processes to assess their effectiveness and alignment with recognised standards and industry good practices.

- Cybersecurity Risk Assessments – We identify and evaluate cybersecurity risks, assess existing security measures and provide practical recommendations to mitigate threats and strengthen organizational resilience.

- IT Compliance and Regulatory Assessments – We assess IT compliance with applicable information security, cybersecurity and data protection laws, regulations and regulatory requirements, identify gaps and recommend appropriate corrective actions.

- Penetration Testing and Vulnerability Assessments – We conduct penetration testing and vulnerability assessments of IT infrastructure, networks, systems and applications to identify security weaknesses, evaluate potential risks and provide practical recommendations to remediate vulnerabilities and strengthen cybersecurity resilience.

Professional Credentials: Certified Information Systems Auditors (CISA), Certified Information Security Managers (CISM), PCI DSS QSA, SWIFT CSP Assessors, OSCP (OffSec Certified Professionals), CREST Registered Penetration Testers (CRT), Certified Information Systems Security Professionals (CISSP) and others.

Strong governance and effective risk management provide the foundation for sustainable business performance. Organizations need clear responsibilities, effective oversight and structured processes for identifying, assessing and managing risks.

We support boards, management and risk functions in developing practical governance, compliance and enterprise risk management frameworks that are aligned with the organization’s objectives.

Our services include:

- Governance Framework Assessment and Development – We assess existing governance structures, roles, accountability and decision-making processes, and support the design and implementation of frameworks aligned with recognised standards and good practices.

- Enterprise Risk Management (ERM) – We help organizations design, implement and embed ERM so that risks are managed consistently across the business and linked to strategy and objectives.

- Risk Identification and Assessment – We facilitate structured risk identification and assessment, evaluate the likelihood and impact of risks and prioritise them, enabling management to focus attention on the risks that matter most.

- Development of Risk Management Frameworks and Policies – We develop risk management frameworks, policies and methodologies, including risk appetite, risk categories, and clearly defined roles, responsibilities and escalation procedures.

- Compliance Assessments – We assess compliance with applicable laws, regulations and internal requirements, identify gaps and non-compliance risks and recommend appropriate corrective actions.

- Review and Enhancement of Internal Policies and Procedures – We review internal policies and procedures for completeness, clarity and alignment with business needs and regulatory requirements, and recommend improvements to make them practical and consistently applied.

- Risk Reporting and Monitoring Frameworks – We design risk registers, key risk indicators and reporting mechanisms that give the board and management a timely and reliable view of risk exposure and the effectiveness of mitigating actions.

- Support in Strengthening the Overall Control Environment – We work with management to strengthen the structures, accountabilities and controls that underpin effective oversight, and to embed a culture of risk awareness and compliance.

Professional Credentials: Certified Compliance and Ethics Professionals (CCEP), Certified Governance, Risk, and Compliance (CGRC).

Mergers, acquisitions and other strategic transactions create significant opportunities for growth, but they can also introduce financial, operational, regulatory and integration risks. Identifying these risks early is essential for making informed investment and transaction decisions.

RSM support clients throughout the transaction lifecycle, helping them assess risks, understand potential issues and make informed decisions.

Our services include:

- Pre-Transaction Risk Assessment – We assess the key financial, operational, regulatory and strategic risks associated with a planned transaction, helping clients decide whether, and on what terms, to proceed.

- Due Diligence Support – We support due diligence processes by reviewing available information on the target, highlighting key findings and red flags that may affect valuation, deal structure or negotiations.

- Review of Financial and Operational Processes – We review the target’s key financial and operational processes and controls to assess their reliability and efficiency and their ability to support the business after the transaction.

- Identification of Potential Regulatory and Compliance Risks – We identify regulatory, legal and compliance exposures of the target, including non-compliance with applicable laws and regulations, and assess their potential impact on the transaction.

- Post-Acquisition Support – We help the acquirer stabilise and monitor the acquired business, address issues identified during due diligence, and align processes, controls and reporting with the group’s requirements.

- Support with Integration Planning and Risk Management – We help plan the integration of processes, systems, policies and controls, and identify and manage the risks that arise during the integration period.