Internal Audit, Internal Controls & Risk Management
Internal audit and internal control work sized to the organization: evaluating risks, processes, governance, and controls; testing whether those controls actually operate as intended; and recommending the corrective actions that close the gaps.
The right fit
Growing businesses, nonprofits, and organizations handling client or donor funds who want to evaluate risk before it becomes a problem — and demonstrate strong governance to lenders, boards, investors, and grantors.
What's included
Internal Audit Engagements — planned reviews of selected processes, with walkthroughs, testing, written findings, and recommendations reported to management and the board.
Risk & Internal Control Assessment — gap analysis of current processes to identify where risk sits and where controls are missing, weak, or redundant.
Control Design Evaluation — assessing whether the controls in place would actually prevent or detect the risks they are meant to address.
Control Testing & Operating Effectiveness — sample-based testing of whether approvals, reconciliations, and safeguards were consistently performed.
Fraud Risk Assessment & Prevention Controls — structured evaluation of where fraud could occur, plus monitoring and anomaly-review protocols to catch problems early.
Internal Controls Design & Documentation — segregation of duties, approval workflows, SOPs, and a written internal controls manual your team can adopt.
Remediation & Corrective-Action Support — help implementing the fixes, not just a list of findings.
Reporting & Follow-Up — management and board reporting, plus follow-up assessments and quarterly reviews to confirm issues stay closed.
Please Note
Internal audit work here is performed for management and the board to evaluate processes, risks, governance, and controls. It is distinct from an independent financial statement audit or other external attest engagement (e.g., SOC 2, SOX 404 opinions), which must be issued by a licensed CPA firm and is not provided by Montgomery Advisory.
How the engagement runs
Every engagement follows the same path, so you always know where you are in it.
01
Consultation
We start with a conversation about what you're trying to decide. If we're not the right fit, we'll say so.
02
Scope & engagement letter
The work, the timeline, and the flat fee are written down and agreed before anything begins.
03
The work
We handle the preparation, review, and filing — in-house, with a single point of contact throughout.
04
Review together
We walk you through the result and what it means for the next decision, not just hand over a file.
Expected outcome
A finished piece of work you understand, records that hold up to scrutiny, and a clear view of what the next decision requires.
Pricing
Flat-fee engagements for each service; ongoing quarterly reviews are flat-fee per quarter. Every fee is confirmed in writing in the Engagement Letter before work begins.
Frequently asked
Anything not covered here is fair game during the initial consultation.
- Does Montgomery Advisory perform internal audits?
- Yes. When it is included in the engagement scope, we perform internal audit work: process and control walkthroughs, control design evaluation, operating-effectiveness testing, fraud-risk assessments, and written findings with corrective-action recommendations reported to management and the board.
- What is the difference between internal audit and an independent financial statement audit?
- An internal audit engagement is performed for management and the board to evaluate processes, risks, governance, and controls, and to recommend improvements. An independent financial statement audit is performed by an external auditor to express an opinion for outside users such as lenders, funders, and regulators. Montgomery Advisory does not perform independent financial statement audits or other external attest engagements.
- Do you work with nonprofits?
- Yes. Nonprofits handling donor funds are a common fit, especially those preparing for growth, a new executive director, or board-driven policy improvements.
- What does an engagement look like?
- We start with a risk and control assessment, walk through the processes in scope, evaluate control design and — where scoped — test whether controls operated as intended. You receive written findings, a documented controls manual, and corrective-action recommendations, with follow-up assessments available.
- Can you help implement the controls, not just recommend them?
- Yes. Remediation support is part of the scope on many engagements, and clients often pair this work with our Financial Management service so we can operate the workflows we design on an ongoing basis.
Let's start with a conversation — no obligation beyond it.
Prefer to read first? Browse our insights and resources.