Governance, Risk & Transaction Advisory

The gap governance, risk and transaction advisory fills in California

Mid-market and private companies in Ventura County and Los Angeles County occupy an awkward position. They are large enough that a board, a lender, an insurer or an acquirer expects governance discipline, and small enough that hiring a full-time Chief Risk Officer or standing up an internal audit department is not a rational use of capital.

The options available to them are usually poor. A national firm will sell the engagement, staff it with people three years out of university, and bill accordingly. A local accounting practice will decline it, correctly, because governance advisory is not what it does. The result is that the work either gets done badly or does not get done until an event forces it, a covenant breach, a failed diligence process, a regulator's letter, a breach notification.

Four engagements, one underlying discipline

The four services in this pillar look different from the outside but rest on the same skill: the ability to look at a business process, identify where it can fail, and determine whether the control that is supposed to catch that failure actually operates.

That skill is what a Certified Information Systems Auditor is trained to apply to systems, what a CPA is trained to apply to financial reporting, and what a former CFO applies to the operating reality of a company that has to close its books while also shipping product. Holding all three is uncommon, and it is the reason this pillar exists in a practice of this size.

What a board actually gets

Deliverables in this pillar are written to be read by directors, not by other accountants. In practice that means:

• A findings register that ranks by consequence, not by count. Twelve observations sorted by severity, with an owner and a date against each, is useful. A hundred-page report listing every deviation found is not.
• A control matrix your team can maintain. If the documentation only makes sense while the consultant is in the building, it will be stale within two quarters.
• A short verbal briefing to the board or audit committee. Half an hour, no slides beyond a single page, questions answered directly, including the ones about what is not working.
• A remediation plan sequenced by dependency. Some fixes have to happen before others are worth attempting. Saying so is most of the value.

When independence changes the answer

A recurring situation: a company asks its external auditor to help design the controls the auditor will later test. Auditors generally cannot do that, and where they can, the value is compromised, nobody objectively audits structures they built themselves.

This practice is frequently engaged precisely because of that constraint. Where your audit firm cannot advise, an independent advisor can. Where this firm performs the attestation, the design work goes elsewhere. The rule is applied in both directions, and it is stated at the start of every engagement rather than discovered at the end of one.