Professional Governance Consulting (PGC) PGC is a founder-led independent advisory firm providing governance, internal audit, risk and integrity advisory to boards, audit committees and oversight leaders, delivered across the Middle East, Europe, Africa and Asia. Advisory services

Corporate Governance Advisory — board charters, board effectiveness, delegation of authority and accountability mechanisms. Also known as corporate governance consulting or board advisory.

Governance Frameworks — governance framework design, governance operating model, roles, responsibilities and committee structures.

Enterprise Risk Management — ERM frameworks, risk appetite statements, key risk indicators and risk registers, aligned with ISO 31000 and COSO ERM. Also known as risk management consulting.

Internal Control Design & Testing — internal control design, risk and control matrices, control documentation and testing aligned with the COSO framework.

Internal Audit & Quality Assessment — internal audit advisory, internal audit outsourcing and co-sourcing, risk-based audit planning and audit function set-up.

External Quality Assessment (EQA) — independent external assessment of the internal audit function against The IIA Global Internal Audit Standards, with a conformance opinion.

Internal & External Investigations — independent investigations of misconduct and fraud, internally and involving vendors, contractors and suppliers, including evidence packs for legal or regulatory proceedings. Also known as fraud investigation or forensic investigation.

Integrity Management & Ethics Programmes — integrity programmes, codes of conduct and anti-bribery and corruption compliance aligned with ISO 37001.

Hotline & Whistleblowing Management — whistleblowing hotline and speak-up channel design, confidential reporting and case management.

Third-Party Due Diligence — due diligence on vendors, suppliers, contractors and partners to mitigate integrity, compliance and reputational risk.

Regulatory Compliance Training — compliance training and programme support to meet regulatory obligations.

Data Privacy Advisory — data protection compliance, privacy programme design and responsible handling of personal information.

Cybersecurity Advisory — cyber governance, board cyber oversight and information security risk linked to internal control.

ESG Consulting — ESG governance and sustainability advisory integrated into governance, risk and reporting.

Crisis Management — crisis response planning and crisis governance for boards and executives.

Oversight Executive Search — search for governance, audit, risk and compliance leadership roles.

Training & Capacity Development — governance and internal audit training, certification preparation (CIA, CRMA) and oversight capacity building.

Training, assessments and tools

PGC Academy — professional training courses in AI for auditors, risk management, internal audit, fraud investigation and governance.

AI governance self-assessments — free governance diagnostics with tailored PDF reports.

Governance dashboards — governance maturity, risk heat map, fraud indicators, audit lifecycle, three lines model, internal control maturity and AI analytics.

Standards applied The IIA Global Internal Audit Standards, COSO ERM and Internal Control, ISO 31000, ISO 37001, ISO 37008, ISO 27001, ACFE frameworks, OECD anti-bribery principles, INTOSAI/ISSAI, UN best practices, NIST, COBIT and GRI/ISSB. More Services · Industries · Standards · Methodology · Credentials · Case studies · Insights · Knowledge Centre · Contact — info@professionalgc.org, Vienna (Austria) and Amman (Jordan).

ProfessionalGovernance Consulting

All InsightsInternal Audit

From Compliance to Assurance: Modernizing the Internal Audit Function

Internal audit functions that remain compliance-driven deliver low-value findings. Risk-based transformation is both a methodology shift and a cultural one.

Sami Jezrawi · July 27, 2026 · 6 min read

Many internal audit functions were built to verify compliance, not to provide risk-based assurance. The result is predictable: voluminous findings of limited value, strained relationships with management, and marginal influence on the risk agenda.

Modernizing the function requires alignment with the IIA Global Internal Audit Standards and a deliberate shift in how audit plans are built.

Start with risk, not activity. A risk-based audit plan targets the exposures that matter most to objectives, not the processes that are easiest to audit. Coverage should be expressed in terms of risk, not the percentage of locations or cycles reviewed.

Invest in the audit charter. A clear charter — endorsed by the audit committee — protects independence, defines reporting lines, and establishes the function's authority to access people, records and systems.

Coach, don't just instruct. Methodology reform fails when it stops at a new manual. Hands-on coaching on risk-based planning, scoping and reporting is what changes audit behaviour.

An external quality assessment provides an independent baseline and a credible roadmap. Conformance with the IIA Standards is not an end in itself, but it is the most reliable signal that the function is fit for purpose.

Back to Insights Discuss This Topic

Speak with an Expert

Have a governance, risk or integrity question? Speak directly with a founder-led advisor — every inquiry is reviewed personally and held in strict confidence.

Speak with an Expert Send a Message