SERVICES
Risk-based internal audit, governance support, and training so boards, accounting officers, and programme leaders in Uganda can test how controls actually work, follow up findings, and build a function that can stand on its own.
Internal audit is the board’s own view of whether governance, risk management, and controls are working — not a year-end opinion on the financial statements. Kisaka & Company plans and performs risk-based reviews, helps organisations write a charter and an annual plan, and trains the people who will run the function after we leave. Work is scoped to your entity type: a company or SACCO answering to a board, a parastatal or vote under the Public Finance Management Act, or an NGO answering to donors and an audit committee.
We confirm independence before we start. Internal audit is not a substitute for statutory external audit, and we will not sell the two together where the IESBA Code as applied by ICPAU would create a self-review threat or have us assume management responsibility. Deliverables, reporting lines, and any training cohort are set out in an engagement letter so the audit committee knows what it will receive and what remains the organisation’s to own.
What you can expect when Kisaka & Company supports your internal audit mandate or trains the team that will own it.
Independent of external audit
Internal audit reports to the board or audit committee. It does not issue an opinion on the financial statements. We accept work only after conflict checks and will decline a mandate that would have us review our own statutory-audit work.
IIA-style, risk-based work
Reviews are planned and performed with reference to the IIA Global Internal Audit Standards, and, where relevant, COSO for control design. Public-sector votes also follow PFMA quarterly reporting to the Accounting Officer, audit committee, and Internal Auditor General.
Findings with owners
You receive a report, an audit-committee summary, and a tracker of agreed actions. Training is done on live workpapers where possible, so incoming staff can close recommendations after we leave.
Illustrative scope — the exact services available depend on your entity type, governance, and independence rules. We confirm deliverables in an engagement letter before work begins.
Walkthroughs and control tests of finance, procurement, payroll, inventory, grants, and operations. Reports include ratings, root causes, agreed management actions, and a follow-up tracker the audit committee can read.
Discuss scopeCharter, reporting lines, risk universe, annual plan, and file standards so a thin or new function can operate. We co-source specialist reviews while your head of internal audit — or an incoming counterpart — retains the mandate.
Discuss scopeGovernance and internal-control reviews requested by a board ahead of growth, a system change, a donor visit, or a PFMA reporting cycle. Packs are written for committee readers, not only for process owners.
Discuss scopeIn-house workshops and on-the-job coaching on risk-based auditing, evidence, finding writing, follow-up, and how an audit committee should read a report. We do not advertise open CIA exam courses.
Discuss scopeA predictable cadence keeps process owners informed and gives the audit committee visibility before the report is tabled.
01
We run conflict checks, agree the reporting line (usually the audit committee), and set out deliverables in an engagement letter. We will not assume management responsibility or act as your head of internal audit without a client counterpart.
02
We understand the entity, systems, and risks that matter — finance, procurement, grants, payroll, or operations — then agree a work programme or an annual plan so fieldwork targets those risks cleanly.
03
We walk through processes, test controls, discuss draft findings with process owners, and document evidence so reviewers can follow the path from risk to conclusion. Public-sector and NGO work respects PFMA and donor terms of reference you give us.
04
We issue the report and committee summary, agree owners and dates on the tracker, and — where training is in scope — close with a short coaching or workshop so the function can continue after we leave.
Discuss a review cycle, a function set-up, or training for your audit committee and incoming team.
