One evidence-led method. Six ways to engage.
Every engagement follows the same method, so findings stand up and improvements last.
How we deliver
Five steps, every time.
- 1
Scope & plan
Objective, scope, criteria and reporting line agreed; workplan mapped to your risks.
- 2
Evidence
Document review, data interrogation, walkthroughs and interviews where the work is done.
- 3
Analyse
Findings rated on a defensible risk basis, root cause separated from symptom.
- 4
Report
Decision-ready findings, business impact and a corrective action plan with owners and dates.
- 5
Embed
Capability transfer so your team sustains it; actions and KPIs handed over in StrategyX.
How we engage
Engagement models
Fixed scope · fixed fee
Project engagement
A gap assessment, single internal audit, process mapping exercise or management system build.
Retainer or per audit cycle
Retained & co-sourced internal audit
We act as, or supplement, your internal audit function under an annual plan.
Gap to surveillance
Certification programme
Gap assessment, system build, internal audit, pre-certification readiness, then surveillance support.
Short notice · day rate
Investigation engagement
Mobilised at short notice, scoped to the allegation, reported to stand up in a disciplinary, insurance or regulatory process.
Pre-agreed rates
Panel & call-off arrangement
Pre-agreed rates and terms for recurring audit, risk or process demand across multiple sites.
Alongside any of the above
Capability transfer
Training and coaching so your people can run the framework, delivered alongside any of the above.
Standards & frameworks
What our work is measured against.
- ISO 9001
- Quality
- ISO 14001
- Environment
- ISO 45001
- Health & safety
- ISO/IEC 27001
- Information security
- ISO 31000
- Risk management
- ISO 22301
- Business continuity
- ISO 37001
- Anti-bribery
- COSO
- Internal control framework
- IIA IPPF
- Professional Practices Framework
FAQ
Your questions, answered.
What does an engagement cost?
It depends on the model. Projects such as a gap assessment or a single internal audit are quoted at a fixed fee for a fixed scope. Retained and co-sourced internal audit is billed as a retainer or per audit cycle, and investigations at a day rate. Tell us what you need and we will send a written proposal.
Do you issue ISO certificates?
No — certificates are issued by accredited certification bodies, and staying independent of them is the point. We prepare you for certification: gap assessment, system build, internal audit and pre-certification readiness, and we represent you during the certification audit.
Can you act as our internal audit function?
Yes. We can run your internal audit function entirely (outsourced) or work alongside your team (co-sourced) under an annual risk-based plan, reporting to your audit committee and board.
What is a Section 17A adequate procedures review?
Under Section 17A of the MACC Act 2009, a company can be liable for corruption by people associated with it unless it shows adequate procedures were in place. We review your anti-bribery framework against the government's guidelines, assess bribery risk and close the gaps — with ISO 37001 where you want certification.
Who will actually do the work?
Our senior team in Kuala Lumpur, supported by the group's audit and compliance specialists in Australia and the Philippines where the work calls for it. You will know who is on your engagement before it starts.
How quickly can you start an investigation?
Investigations are mobilised at short notice and scoped to the allegation. Send an enquiry marked urgent and we will respond as a priority.
