Engagement methodology
Five steps, in order, because assurance work genuinely is a sequence.
You will know at every point what we are doing, what we have found so far, and what is left. There are no surprises kept back for the closing meeting.
01
Scope
We agree what is in scope, what is deliberately out, and what “good” looks like before any fieldwork starts. Scope creep on an assurance engagement is not generosity — it is how deadlines slip and findings arrive too late to act on.
You receive
Engagement letter with a fixed scope, timeline and named contacts.
02
Understand
We walk the process with the people who run it. Documented procedure and actual practice diverge in every organisation we have ever reviewed; we test against the second one, because that is the one carrying your risk.
You receive
Process walkthroughs, system inventory and a documented control set.
03
Test
Controls are tested, not discussed. Sampling is defensible, evidence is retained, and every finding is reproducible by your own team. Where we run a penetration test, you get the steps, not just the score.
You receive
Working papers, evidence file and reproducible findings.
04
Report
Findings are ranked by consequence, not by count. Each one names the control, the exposure, the owner and the fix. We clear factual accuracy with management before anything reaches the board — disagreement about facts belongs in the draft, not the meeting.
You receive
Risk-ranked report, management response and a board-level summary.
05
Close
A finding is not closed because it was accepted. We retest, we confirm in writing, and the evidence goes into your file for the next auditor who asks. Where remediation will take a year, we say so at the start.
You receive
Retest results and written closure confirmation.
Ground rules
What working with us is like.
The things clients usually find out late, stated up front.
Scope is fixed in writing
The engagement letter says what is in, what is out, and what changes the price. Expanding scope mid-engagement is a decision you make, not one that happens to you.
Findings arrive as we find them
Anything urgent reaches you the day we confirm it. Nothing serious waits for the report — a critical exposure is not a reveal.
Your evidence stays yours
Working papers are retained under our professional obligations and shared with you on request. We do not use client material as case-study content without written permission.
We work with your team, not around it
Your people know where the problems are. Interviews are short, scheduled in advance, and never used to catch anybody out.
Disagreement belongs in the draft
Management responds to every finding before the report is final. Where we still disagree, both positions are printed. The board reads the argument, not a summary of it.
The report is written to be used
One page for the board, a ranked list for the executive who owns remediation, and the technical detail for the people doing the work. Same findings, three depths.
Getting started
The first conversation is scoping, not selling.
Bring the problem, the constraint and the deadline. We will tell you whether it is a two-week piece or a two-quarter one before anyone writes a proposal.
+254 721 687846 taarifa@techrisk.co.ke