How a Steel Company Strengthened its Risks and Processes through Strategic Internal Audit

One of our clients, a leading steel manufacturing company with two steel mills and four production plants, was undergoing a process of professionalization and institutionalization. Although they had already made progress in corporate governance, the challenge was to ensure that their growth was backed by solid risk and control management.

Internal Audit as a Strategic Ally

At Baker Tilly, we implemented a comprehensive approach that combined diagnosis, execution, and continuous improvement:

1. GRC Diagnosis (Governance, Risk, and Compliance) We evaluated the group's maturity level to understand:

• How it manages uncertainty.
• How well its processes align with regulations and best practices.
• Where control gaps exist.

2. Outsourcing the Internal Audit Function We assumed the Internal Audit role and executed an annual plan aligned with the Audit Committee, focusing on:

• Risk Assessment: financial, operational, technological, and fraud risks.
• Design and Effectiveness Review of Controls
• Identification of Fraud Red Flags
• Follow-up on Action Plans to ensure continuous improvement.

3. Coverage of Critical Processes We conducted audits in specific business areas:

• Procure to Pay (P2P)
• Order to Cash (O2C)
• Inventory
• Payroll
• Financial Information

Thanks to this approach, the organization achieved: ✔ Greater visibility of its risk exposure ✔ Identification of gaps in priority controls ✔ Strengthening of the internal control environment ✔ Clear guidelines to advance in corporate governance ✔ Strategic information presented directly to the Audit Committee

Outsourcing Internal Audit allowed this industrial group to have an independent function, aligned with best practices, and focused on the business, resulting in more robust supervision of risks and controls during its expansion.

Is your company ready to take this step? At Baker Tilly, we can help you transform your Internal Audit into a value-driven engine that ensures compliance:

• Evaluate your GRC maturity level.
• Identify risks before they impact your business.
• Strengthen your corporate governance.