Risk & Compliance Services in London

Internal audit gives boards and management independent assurance that risks are being managed and controls are working — before problems reach the accounts, the regulator or the press. Many organisations are too small to justify an in-house internal audit function, yet still need one: because a regulator expects it, a parent company requires it, or the board simply wants to sleep at night.

We provide fully outsourced and co-sourced internal audit. That means building a risk-based internal audit plan with your audit committee or board, delivering the reviews across financial, operational and compliance areas, and reporting findings with clear ratings and practical recommendations — then following up to confirm actions are actually closed. Where you already have an internal audit team, we supplement it with specialist skills or extra capacity at peak times.

Effective risk management is not a register that gets dusted off once a year — it is a working framework that shapes decisions. We help organisations design and embed proportionate risk management: identifying and assessing the risks that genuinely threaten your objectives, setting risk appetite, assigning ownership, and building reporting that keeps the board informed without drowning it in detail.

Our governance, risk and control (GRC) work extends this to the structures around risk: board and committee effectiveness, delegated authorities, policy frameworks, the three-lines model, and the control environment that sits underneath it all. For growing businesses, we focus on right-sizing — enough structure to satisfy investors, lenders and regulators, without bureaucracy that slows you down.

Fraud thrives where controls are weak and nobody is looking. Our fraud solutions cover the full cycle:

• Prevention — fraud risk assessments that map where your organisation is exposed (payments, payroll, procurement, expenses, revenue leakage), followed by targeted control improvements such as segregation of duties, supplier verification and payment authorisation controls.
• Detection — data-driven testing of transactions to surface anomalies, duplicate payments, ghost employees and unusual patterns, plus advice on whistleblowing arrangements that actually get used.
• Response — when something has gone wrong, discreet investigation support: establishing the facts, quantifying losses, preserving evidence and reporting in a form suitable for insurers, regulators or legal proceedings.

Whether you suspect a specific problem or simply want confidence that your defences are sound, we scope the work to the concern at hand.

Anti-money laundering obligations under the UK Money Laundering Regulations apply to a wide range of businesses — accountants, estate agents, legal firms, financial services businesses, art market participants and more — and supervisors have become markedly more active in enforcement. Non-compliance risks fines, censure and, for principals, personal consequences.

We help regulated firms build and maintain a defensible AML framework:

• A firm-wide risk assessment tailored to your services, clients and geographies
• AML policies, controls and procedures documentation that reflects how you actually work
• Client due diligence (CDD) and enhanced due diligence processes, including source of funds and PEP handling
• Suspicious activity reporting procedures and guidance for your MLRO
• Independent review of your existing AML arrangements ahead of a supervisory visit

Alongside this we deliver compliance and AML training for principals and staff — practical, scenario-based sessions that satisfy the regulatory training requirement and genuinely change how people spot and escalate red flags.

Technology risk is business risk. Our technology and cyber risk assurance reviews examine the controls that protect your systems and data: access management, change control, backup and recovery, third-party and cloud provider risk, and the basic cyber hygiene — patching, privileged accounts, staff awareness — where most real-world incidents begin. We report in business language, prioritising fixes by the damage a failure would actually cause.

We also provide business continuity management (BCM) assurance: reviewing whether your continuity and disaster recovery plans are complete, current and tested, whether recovery time objectives are realistic, and whether the organisation could genuinely operate through the loss of premises, systems, suppliers or key people. A plan that has never been tested is a hope, not a plan — we help you find the gaps before an incident does.

UK subsidiaries of US-listed groups carry Sarbanes-Oxley obligations that local finance teams often inherit with little support. We provide SOX quality assurance: reviewing process documentation and risk-control matrices, assessing whether key controls are well designed and evidenced, performing independent testing of operating effectiveness, and preparing your team for group and external auditor walkthroughs.

Our quality assurance role also covers remediation — helping control owners fix deficiencies properly rather than cosmetically — and advising on rationalising over-engineered control sets so compliance effort concentrates on the controls that matter.

Regulated businesses face a steady stream of returns, filings and disclosures — and the pace of regulatory change means the goalposts rarely stay still. We support clients with the preparation and review of regulatory reporting, building reliable processes so submissions are accurate, evidenced and on time, and acting as an independent check before returns go out of the door.

When new regulations land, we run structured implementation projects: a gap analysis of your current arrangements against the new requirements, a prioritised implementation plan, drafting of the necessary policies and procedures, changes to systems and data capture, and training so the new obligations stick. Because we work across audit, tax and advisory, we see how a regulatory change ripples through the whole business — not just the compliance manual.

Risk and compliance services are too often delivered as generic frameworks that look impressive and change nothing. Our approach, refined since 1991, is different: understand the business first, focus on the risks that could genuinely hurt it, and recommend controls the organisation can realistically sustain.

From our New Eltham office we serve owner-managed businesses, regulated firms and subsidiaries of larger groups across Eltham, Sidcup, Bromley, Greenwich and the wider London area. Engagements are partner-led, fees are agreed up front, and reporting is written for the people who must act on it.