Risk Advisory Services

Are you looking to mitigate risk?

At Rehmann, we work with clients of all sizes providing a depth of experience and best practices to manage risk. Our risk advisory services include:

• Enterprise Risk Management
• Internal Audit
• SOX and Internal Controls
• IT Audit
• Vulnerability Assessments and Penetration Testing
• Cybersecurity
• Compliance
• Corporate Investigative Services

Enterprise Risk Management

Organizations must effectively manage risk. All relevant risks and the potential likelihood and impact should be considered. If your entity is looking to gain better insight into Enterprise Risk Management (“ERM”), Rehmann can assist with our team of experienced professionals.  We can provide value by:

• Performing an enterprise risk assessment
• Assisting management with prioritizing risks
• Providing recommendations for enhanced governance
• Improving processes and controls to respond to your changing risk landscape
• Conducting ERM awareness training

Internal Audit

Whether your organization has an established internal audit (“IA”) function or is assessing the need to perform audits, Rehmann can assist. We serve organizations of all sizes including private companies, public companies including Fortune 500 SEC registrants, and public sector entities.  Each solution is tailored to your entity’s specific risk profile and focuses on the three core elements of IA: assurance, insight and objectivity.

Our experienced team of professionals is prepared to assist your organization in the following areas:

• Performing a comprehensive risk assessment
• Consulting on processes and controls
• Development of audit programs
• Documentation and testing of processes and internal controls
• Audit Committee education
• Quality assurance reviews

SOX and Internal Controls

The integrity of your financial reporting is only as strong as your internal controls (“ICFR”). A solid internal control system ensures more reliable financial data, which can help companies prevent, detect, and correct costly financial misstatements — and minimize the potential for fraud.

Our team of professionals is experienced with Sarbanes-Oxley 404 (“SOX”) and Federal Deposit Insurance Corporation Improvement Act of 1991 (“FDICIA”) requirements. We serve organizations of all sizes private companies, public companies including Fortune 500 SEC registrants, and public sector entities. We customize our approach to ensure alignment with expectations from internal stakeholders (e.g. C-Suite, Audit Committee, Internal Audit) and external stakeholders (e.g. External Auditors, Shareholders) as applicable.

Our professionals have specialization across a variety of industries and are experienced in understanding complex information systems and organizational structures which makes us better able to develop solutions to even the most nuanced challenges our clients face including mergers and acquisitions, new system implementations, and new accounting standards. We are prepared to assist you in the following areas:

• Initial implementation of SOX 404 or FDICIA
• Development of process and control documentation
• Internal control design and operational effectiveness testing
• Control remediation
• Program management organization assistance
• ICFR training programs

IT Audits

We can perform IT internal audits to test the effectiveness of your controls or assess your existing IT environment and provide recommendations for improvement.  We  assess the security environment against industry standards, including policies, security, access control, data integrity, continuity plans, and more to help you better understand your IT landscape and how it can be further strengthened. Get a comprehensive evaluation of your environment that covers:

• Information Security Program
• Logical Access Processes
• Access Review Processes
• Access Administration Processes
• Password Settings
• Network Architecture
• Security Log Monitoring
• Antivirus Implementation
• Mobile Device Administration Processes
• Backup Processes
• Physical Security
• Change/Patch Management
• Contingency Planning/Disaster Recovery