Internal control & risk

When a business grows from a handful of outlets to several dozen, or from one factory to three, controls that rely on familiarity and the founder's memory are no longer enough. Corvane's Internal Control and Risk team, led by Ms. Le Phuong Thao, helps companies build control systems that fit their size and risk appetite, rather than copying the model of another group.

Who the service is for

• Retail, food and beverage and clinic chains with many cash points and dispersed inventory.
• Manufacturers that need control over purchasing, material consumption standards and warehouse movements.
• Companies preparing to raise capital or list, or asked by their parent to report on their control environment.
• Companies preparing to implement ERP that want processes standardised before they are built into the system.

Scope of work

• Current-state assessment: interviews, walkthroughs and sample testing across the sales, purchasing, inventory, treasury, payroll and fixed asset cycles.
• Control design: process flowcharts, risk and control matrices, approval authorities and monitoring indicators.
• Outsourced internal audit: a risk-based audit plan, periodic fieldwork and reporting directly to the board or supervisory board.
• Fraud risk: analysis of unusual transaction data, whistleblowing channels and response procedures.
• ERP readiness: cleansing master data, standardising item and customer codes and defining the controls to be configured in the system.

How we work

A typical control design project runs for eight to twelve weeks in three phases: assessment, design and a pilot at one or two units before roll-out. Every proposed control states who performs it, how often, what evidence is kept and its estimated running cost, so management can weigh each one rather than accept a package wholesale. After implementation we test operating effectiveness again at three and six months.

Deliverables

• A current-state assessment report with findings ranked by risk.
• Procedures, flowcharts and a risk and control matrix approved by management.
• Training materials for department heads and front-line staff.
• A post-implementation review comparing indicators before and after, such as stock count variances or transactions lacking approval.

A good control is one that store staff understand the reason for, not just the steps of.

Why Corvane

Because Corvane also provides accounting, tax and legal services, the controls we design connect to the company's actual accounting documents, invoicing requirements and employment contracts. On projects we have measured again, stock count variances and exception transactions have typically fallen markedly after six to twelve months, although results always depend on the company's own commitment.