Most control frameworks are written for companies with forty people in finance. With three, the question is narrower and more useful: which handful of controls would actually have caught the thing that went wrong, and can one person run them without the month taking twice as long.
The most common gap we find, and the one with the largest downside.
Everyone remembers agreeing to it. Nothing records who, or when, or how much.
A number is adjusted outside the ledger and the reason lives in somebody head.
What an engagement includes depends on scope. These are the parts that come up most.
Sized to the team you have, not to the team a framework assumes.
In the system that already holds the transaction, so the evidence is where the auditor looks.
Every adjustment traceable from the statement back to the source, with the reason attached.
No, and we cannot. A statutory audit is the work of a licensed CPA firm. We get the books, the trail and the schedules into the state where an audit goes smoothly, and we work with the auditors through it.
Usually yes. Controls put in after an auditor asks are controls with no history behind them, and history is most of what they are checking.
Done properly, not much. Most of the cost is deciding the rules once. Running them is a few minutes a transaction.
We will say plainly whether this is work we should be doing for you, and what it would cost.