Flagship service

Internal audit that goes beyond compliance

We help organizations identify control gaps, understand their root causes, and implement practical improvements that strengthen governance, manage risk and support business performance.

Discuss your internal audit needs

When companies call us

The situations internal audit helps resolve

  • You are not sure key controls are actually being performed
  • Growth, new sites or a new system have outpaced your processes
  • Losses, stock differences or unexplained costs keep appearing
  • The board, shareholders or a parent company want independent assurance
  • Your internal audit team cannot cover the full audit plan
  • You need audit coverage but not a full in-house department

What the service covers

Assess, identify, recommend, follow up

Internal audit gives management an independent, evidence-based view of how processes and controls are working.

Assess controls

We test whether key controls are designed properly and operate consistently, using transaction samples and evidence.

Identify deficiencies

We report gaps, rate their significance and explain the root cause, so the fix addresses the cause and not only the symptom.

Recommend improvements

Recommendations are agreed with process owners and sized to your people, systems and budget.

Support remediation

We follow up on agreed actions and report progress. Management remains responsible for implementing them.

Engagement models

Choose how we work with you

Same methodology and standards in each model. What changes is the scope, who does the work, and how long we stay.

A

Project-Based Internal Audit

An independent, focused review of one process, function, location or risk area, run as a defined project.

Suits: Organizations that need a specific area examined but do not need continuous audit support.

We agree the scope, timeline and audit procedures before fieldwork starts. The engagement ends with evidence-based findings, root causes and a prioritized action plan that management can assign and track. Timelines depend on scope, so we confirm them once we understand the process and the data available.

What you get

  • Focused assessment of a specific risk area
  • Clear deliverables and defined engagement boundaries
  • Findings supported by documented evidence
  • Prioritized recommendations and action plans

Typical project scopes

  • Procurement and accounts payable
  • Sales and accounts receivable
  • Inventory and warehouse management
  • Production and manufacturing
  • Finance and accounting
  • Human resources and payroll
  • IT general controls and system access
  • Fraud risk and internal control reviews
Discuss an audit project
B

Co-Sourced Internal Audit

Additional capacity or specialist expertise for an internal audit team you already have.

Suits: Internal audit functions with a full annual plan, a complex process to review, or a skills gap on a specific area.

We work inside your audit methodology and alongside your auditors, on the engagements you select. Your Head of Internal Audit keeps ownership of the function and the audit plan; we add people, process knowledge and working papers your team can build on after we leave.

What you get

  • Additional audit manpower when the plan is stretched
  • Specialist expertise for complex business processes
  • Risk and Control Matrix (RCM) and audit program development
  • Data analysis, control testing and audit documentation
  • Knowledge transfer to your team
Explore co-sourcing
C

Outsourced Internal Audit

A structured, recurring internal audit service for organizations without a full in-house audit department.

Suits: Growing or established companies that need regular audit coverage without building a full audit team.

Based on an agreed risk assessment, we build the audit universe and a periodic audit plan, carry out the audits, report to management and the relevant oversight body, and follow up on agreed actions. Management and the board keep their responsibility for internal control and for the decisions taken on our findings.

What you get

  • Access to experienced internal audit professionals
  • Risk assessment, audit universe and periodic audit plan
  • Structured, recurring audit coverage
  • Consistent reporting and remediation tracking
  • No need to build a full audit team in-house
Discuss an outsourced audit function

The three models side by side

Comparison of internal audit engagement models
Project-basedCo-sourcedOutsourced
Primary purposeReview a defined scopeSupplement an existing teamProvide ongoing audit capability
EngagementDefined projectCollaborative arrangementRecurring service arrangement
Audit resourcesAssigned to the projectCombined with your teamProvided by Fiducia under the agreed arrangement
Typical needSpecific risk or control reviewCapacity or specialist expertiseLimited or no in-house audit function
ScopeAgreed project scopeSelected activities or audit planAgreed recurring audit coverage

Audit lifecycle

How a typical engagement runs

  1. 01

    Understand the business and risks

    Objectives, operations, prior findings and where things can go wrong.

  2. 02

    Define scope and objectives

    Agree processes, period, locations and what the audit must answer.

  3. 03

    Walkthroughs and testing

    Follow transactions end to end and test key controls against evidence.

  4. 04

    Findings and root causes

    Rate each issue by significance and identify why it happened.

  5. 05

    Report and agree actions

    Clear recommendations, owners and target dates agreed with management.

  6. 06

    Follow up remediation

    Check that agreed actions are implemented and working.

The exact approach depends on the agreed scope, the engagement model and your requirements.

Audit areas

Processes we commonly review

Examples only. Each engagement covers the areas agreed in its scope, selected by risk.

  • Procurement and accounts payable
  • Sales and accounts receivable
  • Inventory and warehouse management
  • Production and manufacturing
  • Finance and accounting
  • Human resources and payroll
  • IT general controls and system access
  • Other processes selected through risk assessment

Deliverables

What you receive

The exact set depends on the agreed scope and engagement model.

See an illustrative dashboard
Audit planning memo
Objectives, scope, approach and timeline
Process walkthrough notes
How the process runs today, with key controls marked
Risk and Control Matrix
Where appropriate to the scope
Testing documentation
Audit procedures, samples and evidence
Findings with root cause and impact
Each rated by significance
Prioritized action plan
Owners and target dates agreed with management
Final audit report
For management and, where relevant, the board or audit committee
Follow-up report
Status of agreed actions

Benefits to management

What changes after a good internal audit

A clear view of control gaps
Based on tested evidence rather than assumptions.
Priorities you can act on
Findings rated by significance, so effort goes where it matters.
Accountability for fixes
Every action has an owner and a date, and follow-up confirms progress.
Better information for the board
Independent reporting that supports oversight and decisions.

Results

What our audits have found

Results from Fiducia engagements. Client details are confidential.

  • Billions of rupiahin fraud uncovered through our internal audit work
  • Up to Rp1 billion a yearin business process inefficiencies identified through our reviews

Case example · Project-based internal audit

Procure-to-pay controls in a growing construction business

Client details withheld for confidentiality.

Situation
The company was growing quickly, but procurement and payment ran without standardized controls. Management was concerned about inefficiency, transparency and the possibility of leakage or conflicts of interest.
What we found
A focused internal audit of end-to-end procure-to-pay identified unvalidated budget price benchmarks, procurement access to customer billing mark-ups, fictitious vendor records, missing segregation of duties, goods receipts not acknowledged by site teams, payments without proper approval, and inaccurate journal entries.
What changed
We helped the client formalize a procurement policy, set minimum quotation requirements, restrict access to sensitive data, introduce routine price benchmarking and a standard Goods Receiving Note, and clarify segregation of duties between procurement and finance.
Outcome
Management reported better cost control, more transparent procurement and lower risk exposure across ongoing projects.

Questions

Frequently asked questions

What is the difference between internal audit and external audit?

An external audit gives an opinion on whether the financial statements are fairly presented, for shareholders and regulators. Internal audit works for management and the board: it examines how processes and controls operate across the business and recommends improvements. Fiducia provides internal audit and advisory services; we do not issue external audit opinions.

Which engagement model is right for us?

If you have a specific concern, start with a project-based audit. If you have an internal audit team that needs more capacity or expertise, co-sourcing fits. If you need regular audit coverage without an in-house team, consider outsourcing. We can recommend a model after an initial discussion.

How long does an internal audit take?

It depends on the number of processes, locations and the availability of data. We agree the timeline with you when we define the scope, before any work starts.

Will the audit find fraud?

Internal audit assesses whether controls reduce the risk of error and fraud, and reports red flags when they arise. It cannot guarantee that every irregularity will be detected. Where fraud is suspected, a specific fraud risk review can be scoped.

Who is responsible for fixing the findings?

Management. We recommend actions, agree them with process owners and follow up on progress, but decisions and implementation remain with your organization. This keeps our assessment independent.

How do you handle our confidential information?

Access to your data is limited to the engagement team and the agreed scope. Confidentiality terms, such as a non-disclosure agreement, can be put in place before you share detailed information.

Discuss your internal audit needs

A short initial conversation is enough for us to suggest a model, a scope and the information we would need.

Arrange an initial discussionWhatsApp