Investment and capital project audits
Business cases, investment committee decisions, approvals, due diligence, payments against milestones and post-investment monitoring.
Co-Sourced Internal Audit for Investments, Procurement and Approvals
Your internal audit team knows the organisation. It may not have the time or the specialist depth for an investment portfolio, a major procurement or an approvals review. We work alongside your auditors, under your audit committee, on the areas where the risk is highest.
Co-Sourced Internal Audit
What it is
A co-sourcing arrangement in which Orbix auditors join your internal audit function for specific audits or a share of the annual plan. You keep ownership of the function and its methodology; we add capacity and specialist skills in the areas your team covers least.
Why organisations need it
Recent public findings on investment losses and unapproved payments in public entities show where internal audit coverage is often thinnest: investment decisions, capital projects, related-entity funding and the approvals behind them. Listed issuers must maintain an internal audit function under Bursa's listing requirements, and statutory bodies and GLCs face similar expectations from their ministries and the Auditor-General. Co-sourcing lets the function cover these areas properly without permanent headcount.
What the engagement covers
Audits are scoped with your chief audit executive and fit into your annual plan and methodology.
Procurement and contract audits
Tender processes, evaluation, conflicts of interest, variation orders and payment controls, including data analytics on vendor payments.
Approvals and limits of authority audits
Whether decisions and payments were approved by the right body within delegated authority, with evidence.
Subsidiary and related-entity audits
Funding flows, management fees, related-party transactions and governance in subsidiaries and joint ventures.
Integrity and anti-corruption audits
Testing controls behind your OACP, ISO 37001 system or Section 17A adequate procedures.
Data analytics support
Payment, vendor and journal analytics that point the audit at the transactions most likely to matter.
What the business gets out of it
Coverage where risk is highest
Specialist audits of investments and procurement, the areas behind many of the largest public findings.
You keep control of the function
Your chief audit executive owns the plan, methodology and reporting. We work inside it.
Capacity without headcount
Flex up for the audit plan's peak or for a specific high-risk review without a permanent hire.
Skills transfer
Your auditors work alongside ours and keep the methods and work programmes.
Independent perspective
External auditors bring fresh eyes to areas where internal relationships make challenge harder.
Audit committee confidence
The committee sees high-risk areas covered with the depth they need.
How it works
How the engagement runs
01
Planning with the chief audit executive
Agreeing the audits, scope, resourcing and reporting lines within your annual plan.
02
Audit planning
Risk assessment, work programme and data requests for each audit.
03
Fieldwork
Testing, interviews and analytics carried out jointly with your team.
04
Findings discussion
Agreeing facts and management responses with the auditee.
05
Reporting
Reports in your format, presented to the audit committee with your chief audit executive.
06
Follow-up
Verifying that agreed actions have been implemented.
Deliverables
What you receive
Audit work programmes
Risk-based programmes your team can reuse.
Audit reports
Findings, ratings and management responses in your format.
Analytics outputs
Payment and vendor analytics with the exceptions investigated.
Audit committee papers
Summaries for the committee, presented with your chief audit executive.
Follow-up reports
Status of agreed actions.
Methodology notes
Approaches for investment, procurement and approvals audits left with your team.
Who it is for
Who this is built for
Industries
Company sizes
Departments
FAQ
FAQ
In co-sourcing, your organisation keeps its internal audit function and its head, and we add auditors for specific work. In outsourcing, the whole function is provided externally. Co-sourcing keeps ownership and knowledge inside the organisation.
To your chief audit executive, and through them to the audit committee, following your methodology and reporting format.
Yes. Many clients co-source only the audits their team lacks the skills or capacity for, such as investments, capital projects or procurement.
Yes. Our work is performed in line with the Institute of Internal Auditors' Global Internal Audit Standards and your own methodology.
Yes. We analyse payment, vendor and journal data to target testing, under your data security requirements.
We do not audit work we designed or delivered. Where we have advised on an area, another team or your own auditors cover it.