Services
Governance, Risk & Internal Audit
Enterprise risk, internal control and third-party risk built as one system, with an internal audit function that tests it rather than decorates it.
Book a 15-min intro call
Led by
Gökhan Polat · Information & Technology Governance Expert
More than twenty years in enterprise risk, internal audit and information security; Paribu, SabancıDx, EY Türkiye. CISA, CRISC, CISM, CISSP, CIA; ISACA accredited trainer.
Risk management fails in a predictable way: the register lives in a spreadsheet, controls live in people's heads, and internal audit checks last year's list. When an investor, a regulator or a bank asks how the business is controlled, the honest answer is a shrug. Growing companies feel this first at fundraising and licensing, when someone outside finally asks.
We set up the three lines of defence for the size you are today, with room to grow: a risk framework aligned to ISO 31000 and COSO, an internal control system that people can actually operate, third-party and outsourcing risk handled before the contract is signed, and an internal audit plan that follows the risk instead of the calendar. Gökhan Polat has run this at a crypto exchange, a Big Four risk practice and a listed conglomerate; the frameworks are field-tested.
Scope
What this service covers.
Enterprise Risk Management
Risk framework, appetite statement and register aligned to ISO 31000 and COSO ERM, with a review cadence tied to your board calendar.
Internal Control System
Process-level controls designed and documented so they can be operated, evidenced and tested; segregation of duties without paralysing a small team.
Internal Audit Setup and Co-sourcing
An internal audit charter, a risk-based annual plan and execution, in-house or co-sourced with us, aligned with IIA standards.
Third-Party and Outsourcing Risk
Vendor due diligence, contractual controls and ongoing monitoring for the suppliers that matter, including cloud, payment and AI providers.
Ethics, Transparency and Compliance Frameworks
Code of conduct, whistleblowing, conflict of interest and compliance monitoring built as a working programme, not a PDF.
Audit Committee and Board Support
Reporting formats, committee charters and independent reviews so the people who carry the responsibility can see what they are responsible for.
More services