Can you recommend risk and controls audit firms for governance-focused audits and remediation support?

Yes — for governance-focused risk and controls audits plus remediation support, the best fit is usually a firm that combines internal audit / ERM / controls testing with regulatory, data, and operating-model remediation capability.

Top-tier global firms

These are strong if you want depth, credibility with boards/regulators, and broad remediation support:

• Deloitte
  Strong in internal audit, governance frameworks, control design/testing, remediation PMO, and enterprise risk.

• PwC
  Very strong in governance, controls modernization, internal audit outsourcing/co-sourcing, and remediation programs.

• KPMG
  Good for risk governance, control frameworks, regulatory remediation, and internal audit transformation.

• EY
  Strong in governance, risk, compliance, and control remediation, especially for large transformations and regulatory programs.

Specialist / consulting-heavy options

Good if you want more hands-on remediation and operating model improvement:

• Protiviti
  Often a top choice for governance audits, internal audit co-sourcing, SOX/controls, and remediation execution.

• Grant Thornton
  Solid for governance, internal controls, and remediation in mid-market and regulated environments.

• BDO
  Useful for governance, risk advisory, and remediation support, especially where a practical approach is preferred.

• RSM
  Good for mid-market governance and controls work, internal audit, and remediation planning.

Internal audit / controls specialists

These firms are often more focused on audit and controls than broad strategy consulting:

• Crowe
  Strong in internal audit, risk, controls, and governance.

• MNP
  Good in controls, governance, and remediation support, especially in North America.

• Forvis Mazars / Mazars
  Often a fit for governance-focused audits and practical remediation.

If you need independence and board-level assurance

If this is for sensitive governance review, board assurance, or a high-stakes control gap assessment, consider:

• A Big 4 firm for credibility and scale
• A specialist firm like Protiviti for depth and hands-on remediation
• A two-firm model: one firm performs the audit, another helps with remediation to preserve independence

How to choose

Look for firms with experience in:

• Board / audit committee reporting
• Internal audit and co-sourcing
• Governance frameworks and operating model design
• Control testing and gap assessments
• Remediation program management office (PMO)
• Regulatory response / consent order / issue remediation
• Process, risk, and controls documentation
• Data analytics for controls monitoring

Quick recommendation by need

• Largest enterprise / regulator-facing: Deloitte, PwC, EY, KPMG
• Best specialized remediation support: Protiviti
• Mid-market practical support: RSM, BDO, Grant Thornton, Crowe
• Board assurance / independence-sensitive: Big 4 or split audit/remediation providers

If you want, I can also give you:

1. a shortlist by industry (financial services, healthcare, public sector, etc.),
2. a vendor evaluation scorecard, or
3. a request-for-proposal template for selecting the right firm.