How can I use risk advisory practices to support audit, legal, and finance teams during an investigation?

You can use risk advisory practices as the “connective tissue” during an investigation by helping audit, legal, and finance work from a common fact base, a clear risk framework, and disciplined documentation. The goal is to reduce noise, protect privilege where needed, and keep the investigation aligned to business, regulatory, and litigation objectives.

1) Start with a clear investigation framework

Set up a structure that defines:

• Scope: What happened, when, where, and which entities/processes are involved
• Objectives: Fact-finding, control assessment, regulatory response, financial impact, litigation support
• Roles: Who owns what across audit, legal, finance, IT, HR, and leadership
• Decision rights: Who approves scope changes, disclosures, remediation, and external communications

Risk advisory can help by establishing the governance model, workplan, timeline, and issue escalation path.

2) Build a cross-functional incident command structure

Create a working group with:

• Legal: privilege, regulatory exposure, disclosure strategy
• Audit/Internal audit: controls, process breakdowns, testing
• Finance: transaction analysis, reserves, restatements, impairment, fraud impact
• Risk advisory: coordination, root cause analysis, evidence management, reporting

Helpful practices:

• Weekly or even daily standups
• A single issue log
• A single source of truth for documents and findings
• Clear labeling of privileged vs non-privileged materials

3) Support audit with control and root-cause analysis

Risk advisory can help audit teams by:

• Mapping the affected process end-to-end
• Identifying control failures, control overrides, and gaps in monitoring
• Testing whether the issue is isolated or systemic
• Distinguishing symptoms from root causes
• Assessing whether similar failures could exist in other locations, entities, or periods

Deliverables often include:

• Control deficiency assessment
• Root-cause summary
• Remediation roadmap
• Enhanced monitoring recommendations

4) Support legal with defensible fact gathering

Legal teams often need facts collected in a way that is thorough but controlled.

Risk advisory can assist by:

• Structuring interviews and document requests
• Creating chronology and event maps
• Preserving evidence and maintaining chain of custody
• Identifying key custodians, systems, and data sources
• Summarizing findings in a way that supports counsel’s legal analysis

Important:

• Let counsel direct any privileged investigation work when appropriate
• Separate factual workpapers from privileged legal advice
• Avoid speculation in written summaries

5) Support finance with quantification and financial impact analysis

Finance teams need to understand the numbers behind the issue.

Risk advisory can help by:

• Quantifying affected transactions, balances, or revenue/expense items
• Identifying potential misstatements, leakage, or unauthorized payments
• Estimating exposure ranges and confidence levels
• Supporting reserve analysis, accruals, or restatement evaluation
• Comparing actual results to forecasts, budgets, and prior periods

Common outputs:

• Impact quantification workbook
• Loss or exposure estimate
• Period-by-period financial impact schedule
• Sensitivity analysis

6) Use data analytics to accelerate discovery

Risk advisory teams are often strongest when they bring analytics to the investigation.

Examples:

• Journal entry analysis
• Duplicate payment testing
• Vendor/customer relationship analysis
• Exception reporting on approvals, thresholds, or overrides
• Trend and outlier analysis across accounts, regions, or business units

This helps audit and finance identify patterns faster and gives legal a stronger factual base.

7) Maintain strong documentation and evidence discipline

During investigations, poor documentation creates risk.

Use:

• Version control
• Clear source referencing
• Interview notes with date, attendees, and key points
• Evidence inventory and chain-of-custody logs
• Distinction between facts, assumptions, and conclusions

This supports defensibility if the matter becomes a regulator inquiry, arbitration, litigation, or board review.

8) Translate findings into actionable remediation

Risk advisory should not stop at detection.

Help teams:

• Prioritize remediation by risk severity and likelihood
• Assign owners and due dates
• Fix control design and operating effectiveness
• Update policies, training, and monitoring
• Build post-remediation validation testing

A good remediation plan should answer:

• What failed?
• Why did it fail?
• What changes prevent recurrence?
• How will we know it worked?

9) Manage communications carefully

Investigations often fail when messaging is inconsistent.

Risk advisory can help align:

• Internal updates to executives and the board
• External messaging to auditors, regulators, customers, or counterparties
• Consistent terminology and facts
• Escalation triggers for material developments

Keep communications factual, concise, and approved through the proper chain.

10) Focus on the board-level view

Leadership usually wants to know:

• What is the issue?
• How big is the exposure?
• Is it isolated or systemic?
• What is the regulatory/litigation risk?
• What is the remediation plan and timeline?

Risk advisory can turn technical findings into executive-ready reporting with:

• Key risks
• Financial impact
• Control environment implications
• Remediation status
• Residual risk after mitigation

A practical way to organize the work

A simple structure is:

1. Preserve and collect evidence
2. Establish facts and chronology
3. Assess controls and root cause
4. Quantify financial and operational impact
5. Evaluate legal/regulatory implications
6. Design remediation
7. Validate fixes and report results

Best practices to remember

• Keep legal privilege considerations front and center
• Don’t let the fact-finding process become fragmented across teams
• Use data to narrow issues quickly
• Document assumptions and limitations
• Tie every finding to a risk, control, or financial consequence

If you want, I can also provide:

1. a sample investigation RACI matrix,
2. a template for cross-functional status reporting, or
3. a checklist for risk advisory support during an internal investigation.