We design internal audit functions with the mandate, independence, access, methodology and resources required to provide credible third-line assurance. The model defines the relationship with the board, audit committee, senior management, risk and compliance functions.

For established functions, we assess governance, methodology, coverage, evidence, reporting, capability and conformance with applicable regulatory and professional expectations. Findings are translated into a practical function-development plan.

Our work covers:

• Internal audit charter, mandate and organisational position

• Independence, authority, access and reporting arrangements

• Audit methodology, working papers and evidence standards

• Quality-assurance and improvement framework

• Skills, capacity, technology and data requirements

• Function-maturity or quality assessment and improvement roadmap

  
  

We provide outsourced internal audit where permitted or co-source specialist capacity into an existing function. The engagement model is agreed with the board or audit committee and preserves institutional access, escalation, issue ownership and oversight.

Every mandate is screened for conflicts and prior involvement. Work is accepted only where the required independence and objectivity can be maintained, with separate governance and specialist providers used where necessary.

Our work covers:

• Outsourced internal audit-function delivery where permitted

• Co-sourced audits and specialist subject-matter coverage

• Audit committee plans, reporting and private sessions

• Engagement scoping, fieldwork, evidence and quality review

• Findings, agreed actions and issue follow-up

• Independence, conflict and continuity arrangements

We construct an audit universe that reflects the institution’s legal entities, regulated activities, processes, systems, products, outsourced services and material risks. Coverage decisions are based on risk, regulatory expectations, prior findings and the pace of change.

The resulting annual and multi-year plans state the rationale, frequency, scope, resources and dependencies for each review. The plan is designed for audit committee approval and can be revised as the risk profile changes.

Our work covers:

• Entity, activity, process, system and risk-universe mapping

• Internal audit risk assessment and coverage methodology

• Regulatory, financial, operational and technology coverage

• Annual and multi-year internal audit plans

• Resource, specialist and timing requirements

• Audit committee papers and plan-refresh triggers

We audit the design and operating effectiveness of governance, compliance and prudential arrangements against the institution’s regulatory obligations and approved operating model. Reviews are scoped to the applicable FSRA, DFSA, VARA, CMA or CBUAE requirements.

We distinguish isolated exceptions from structural weaknesses in ownership, data, systems, oversight or decision-making. Findings are rated by exposure and supported by clear evidence, root cause and actionable recommendations.

Our work covers:

• Corporate governance, board and committee effectiveness

• Compliance framework and regulatory-obligation audits

• Capital, liquidity, solvency and prudential-control audits

• Regulatory reporting, notifications and data-governance reviews

• Conduct, client-assets and consumer-protection audits

• Findings, root-cause analysis and remediation priorities

We provide independent audit of AML/CFT/CPF, sanctions and wider financial-crime arrangements. Reviews assess whether the framework is appropriately designed for the institution’s exposure and whether it operates consistently across customers, transactions, systems and reporting.

Scope is risk-based and can cover the full programme or a defined thematic area. Conclusions address governance, data, judgement, control performance and the sustainability of management actions.

Our work covers:

• Business-wide financial-crime risk-assessment audit

• AML/CFT/CPF governance, policies and MLRO oversight

• Customer risk, KYC, CDD and EDD controls

• Transaction monitoring and suspicious-activity governance

• Sanctions, TFS and screening controls

• Regulatory reporting, training and remediation effectiveness

We audit the control environments supporting critical operations, systems, data and third-party services. Reviews connect technical and operational evidence to regulatory obligations, customer outcomes and business continuity.

Specialist scope is defined according to the institution’s architecture and risk profile, including digital-asset and payment environments. Where formal technical certification is required, it is coordinated with an appropriately qualified provider.

Our work covers:

• Core operational processes and internal controls

• IT governance, general controls and change management

• Cybersecurity, access, data and information-security controls

• Outsourcing, cloud and third-party-risk management

• Business continuity, disaster recovery and resilience testing

• Digital-asset, custody, wallet and payment-control reviews

We undertake focused, non-statutory assurance over specific regulatory obligations, control themes or remediation programmes. Mandates may arise from board direction, a supervisory commitment, a transaction or the need for independent evidence before closure.

Regulator-requested independent reviews or TPV assignments are accepted only where Pnyx Hill meets the applicable eligibility, competence and independence requirements. Conclusions remain evidence-based and separate from management’s ownership of remediation.

Our work covers:

• Targeted regulatory and control-effectiveness reviews

• Thematic compliance, conduct, risk and governance assurance

• Pre- or post-authorisation readiness assurance

• Remediation-design and implementation validation

• Findings closure and sustainability testing

• Regulator-requested reviews where eligible and accepted