Risk Function Audit & Third-Line Assurance

Audit the risk function end to end

We provide independent reviews of risk functions and risk frameworks, either as specialist support to Internal Audit or, where the governance model and independence requirements permit, as an independent third-line assurance provider. The objective is not to confirm that documents exist. It is to determine whether the framework is appropriately designed, operating effectively and capable of standing up to regulatory, Board and audit scrutiny.

Regulatory alignmentMap policies, governance, controls and evidence to applicable rules, guidance and supervisory expectations.

Framework designAssess taxonomy, appetite, roles, committees, reporting, escalation and the three-lines model.

Operating effectivenessSample and test KRIs, controls, RCSAs, risk acceptances, incidents, actions and evidence.

Business embeddingChallenge first-line ownership, decision-making, escalation, risk culture and whether appetite is used in practice.

Data & reporting integrityReview lineage, reconciliation, governance, assumptions and consistency of risk and regulatory MI.

Board / Audit Committee reportingClear findings, severity, root cause, maturity view, management actions and prioritised remediation.

Stress the framework before someone else does

Our reviews deliberately test points where frameworks often fail: unclear ownership, stale risk registers, KRIs with no decision value, controls that cannot be evidenced, weak escalation, inconsistent data, committee reporting that hides the risk story, and policies that are not reflected in actual business processes.

Flexible assurance model

Engagements can be a focused thematic review, a full risk-function audit, pre-regulatory-review readiness, post-finding remediation assurance or recurring independent testing. Scope, reporting line and independence are agreed upfront. Where we have previously designed or operated the framework under review, we identify potential self-review threats and agree appropriate safeguards or separate assurance arrangements.

From findings to remediation

We do not stop at a red/amber/green report. Where appropriate, we can help management convert findings into a sequenced remediation plan while keeping assurance responsibilities appropriately separated.