Before you buy anything, see what it would have caught.
Send one quarter of the transfers you made between your own entities. Two weeks later you get a written review: every movement, whether it would have passed your own policy, and what an auditor would ask about each one.
It is not an audit and it is not our opinion. It is your data run through the system, and the findings are whatever the system flagged.
Reconciliation shows a transfer happened. It does not show what it was approved against.
Your AP process ties external spend to a decision. A purchase order or a bill goes through an approval chain, and a system records who approved it and what they were looking at.
Between your own entities, the ledger entry and the bank payment are two separate actions. The recharge or the loan gets booked, and the cash is released from a bank portal, often with the authorisation sitting in an email. A funding transfer, a drawdown, a margin call. The bank reconciliation proves each one was recorded. It never proves it was authorised.
That gap stays invisible until somebody outside the company asks about it. By then the transfer was eighteen months ago and someone is reconstructing it by hand.
Four findings, on your own transfers.
Each finding names the specific movement, the rule it touched, and the question an auditor would put to you about it. Written so it can be handed to someone else without translation.
Movements that would have been blocked
Every transfer tested against your own stated limits, approval authorities and approved counterparties. Not a generic benchmark: the rules you already have, applied to the transfers you already made.
Approvals with nothing behind them
Movements that were approved, where no record survives of what the approver was looking at. The approval exists. The basis for it does not.
Approvals that cannot be produced
Where the authorisation lives in an inbox, a chat thread, a bank portal, or nowhere at all.
Money that moved with no decision behind it
Every debit your bank reported, matched back to a decision or raised as an exception. No internal system can do this by construction, because it can only tell you about what passed through it.
If the review finds nothing, that is the finding, and it gets written up the same way. A quarter with no gaps is worth knowing.
Four things, and an hour of someone's time.
Nothing needs installing and nobody needs access to your systems. Nothing needs tidying up first either. The mess is the point, and cleaning it would hide the findings.
Files come through an encrypted upload link, never by email, and only after an engagement letter is signed. Everything you send is destroyed thirty days after the report is delivered, and we confirm that in writing on the day.
- One quarter of transfers between your own entities. A spreadsheet is fine.
- Your approval or delegation rules, in whatever form they exist. A policy document is ideal; an email describing who signs off is enough.
- Bank statements for the entity in scope, in whatever format your bank gives you.
- Forty-five minutes with whoever approves transfers today.
Fixed scope, fixed price, fixed end date.
Two weeks from the day the data arrives. One session in the middle to check the rules have been read correctly, one document at the end. Not a retainer and not an open engagement.
If the review tells you nothing you did not already know, it is refunded. No argument and no conditions.
One condition matters more than the rest.
Money has to move between your own entities. If it does not, there is nothing here for you and we will say so before you pay anything.
- Groups moving money between their own legal entities, where the approval for those movements lives in email, a bank portal, or someone's judgement
- Companies with an external party who can ask: a lender, an auditor, a sponsor, an incoming owner
- Post-acquisition groups, where new entities arrived faster than controls did
- Finance teams where the person who prepares a payment can also release it
- Anyone who has been through an audit finding or a penalty and resolved to be more careful
Three things this deliberately is not.
Not an audit. No opinion, no assurance, no sign-off, and nothing your auditor can rely on in place of their own work. It is a test run of a control on real transfers.
Not a software trial. Nothing to install, no integration, no access to your systems. The data comes to us and the document comes back.
Not something you have to take further. If you want these checks running continuously afterwards, that is a separate conversation and the review fee comes off the first year. If you do not, you keep the document and we are done.
One quarter of transfers, and two weeks.
Price depends on how many entities are in scope, so it is worth a short conversation first. If it turns out money does not move between your entities, we will tell you and there is nothing to pay.