Six practices. One gold standard of performance!

Governance policies and procedures define how authority is exercised within an organization. They set out what the board reserves to itself, what is delegated to management and at what thresholds, how committees operate, how conflicts of interest are managed, and how decisions are recorded and reported.

Many organizations operate with policy suites that are either inadequate or over time diverge from actual practice, creating a gap between how the organization says it is governed and how it is genuinely run. That gap is where governance failures originate.

Polaris Advisory drafts, reviews and rebuilds governance documentation so that it is accurate, proportionate and usable. Services include:

A governance and board effectiveness assessment is an independent evaluation of how well a board and its committees are functioning, measured against both regulatory expectations and recognized good practices. It examines structure, composition, information flow, meeting dynamics, committee performance, decision quality and the relationship between the board and management.

Internally administered self-assessments are common but frequently produce generic conclusions, because directors are understandably reluctant to raise sensitive observations through an internal process. An independent assessment allows candid input to be gathered and consolidated, and allows difficult findings to be reported constructively.

Polaris Advisory conducts these assessments as a structured engagement combining document review, director and executive interviews, meeting observation where appropriate, and benchmarking, resulting in a written report and board presentation. Services typically include:

An ethics program establishes the standards of conduct expected within an organization and the mechanisms through which concerns can be raised and addressed. It typically comprises a code of conduct, supporting policies, training, a confidential reporting/whistleblower channel and a defined process for investigating and resolving reports.

The existence of these components is not evidence that a program is working. In relevant cases, regulators, auditors and courts increasingly look for demonstrable effectiveness: whether employees know the program exists, whether they trust it, whether reports are received and acted upon, and whether the board receives meaningful reporting on outcomes.

Polaris Advisory designs ethics and fraud risk programs and assesses the effectiveness of existing ones, with attention to fraud risk specifically, including where the organization is exposed and which controls mitigate those exposures. Services typically include:

Business continuity planning addresses how an organization maintains or rapidly restores critical operations following a disruptive event. Disaster recovery planning addresses the restoration of the technology and data infrastructure those operations depend on. Together they determine how long an organization can be interrupted and how much information it can afford to lose.

Sound planning begins with a business impact analysis that establishes which processes are genuinely critical, what their maximum tolerable downtime is, and what dependencies they rely on.

Polaris Advisory develops, reviews and tests continuity and recovery arrangements, with emphasis on plans that have been exercised rather than plans that have only been written. Services typically include:

Environmental, social and governance (ESG) oversight has moved from a voluntary disclosure exercise to an area of board responsibility, driven by investor expectations, lender requirements, customer procurement standards and, in a growing number of jurisdictions, mandatory reporting regimes.

The governance question is distinct from the reporting question. It concerns which committee holds oversight, how sustainability commitments are approved and monitored, what data underpins public statements, and what controls exist over that data. Organizations that make public commitments without governance behind them create exposure rather than reduce it.

Polaris Advisory helps boards establish proportionate oversight structures for sustainability matters and assess the reliability of the information supporting external commitments. Services typically include:

Outsourcing fully places an organization's internal audit function with an external provider who delivers the annual audit plan and reports directly to the audit committee. Co-sourcing supplements an existing in-house team, either to provide specialist skills it does not hold or to add capacity for a defined period. Both models are widely used by organizations that require a credible assurance function but cannot justify, or cannot recruit for, a full in-house department. They also suit organizations whose audit needs vary significantly from year to year, and those whose in-house teams need support in technical areas such as controls, treasury, supply chain or regulatory compliance.

Polaris Advisory delivers internal audit on a retained basis, working to an audit plan approved by the audit committee and reporting to it directly. Services typically include:

Not every internal audit requirement calls for an ongoing function. Boards, chief executives, owners and investors frequently need a clear answer to a specific question within a defined timeframe, without establishing a permanent arrangement.

Project-based reviews address a defined scope: the health of the overall control environment, the integrity of a particular process, the state of readiness ahead of a transaction, or the circumstances surrounding a specific issue or concern. They conclude with a written report and, where required, a board or committee presentation.

Polaris Advisory delivers these engagements on a fixed scope and fixed fee basis, with findings that are specific and actionable rather than general. Services typically include:

Internal control over financial reporting and operational internal controls are the set of processes designed to provide reasonable assurance that financial statements are reliable, that assets are safeguarded, that operations are efficient and effective, and that the organization complies with applicable laws and regulations.

Organizations subject to the Sarbanes-Oxley Act (SOX), or to equivalent regimes in other jurisdictions, must document, test and report on the effectiveness of financial controls, and must disclose material weaknesses where they exist. Organizations not subject to those requirements still depend on controls to produce reliable numbers and prevent loss.

Two failure patterns are common. Some control environments are too thin to detect real problems. Others have accumulated so many controls, often in response to past findings, that the cost and effort outweigh the risk being addressed. Polaris Advisory works on both, designing controls that are proportionate to risk, testing whether they operate as intended, and rationalizing environments that have grown unwieldy. Services typically include:

Fraud risk services cover both the proactive identification of where an organization is vulnerable to fraud, and the response when a concern has been raised. The two are connected: organizations that have assessed their fraud exposures are considerably better positioned to respond when an allegation arises.

How an investigation is conducted matters as much as what it finds. Investigations that are poorly scoped, inadequately documented, or conducted without regard to legal privilege and evidential standards can create liability and can compromise subsequent action against a perpetrator.

Polaris Advisory conducts fraud risk assessments, advises boards and audit committees on investigation scope and governance, and coordinates specialist forensic accounting and legal resources for complex matters requiring them. Services typically include:

The Global Internal Audit Standards issued by the Institute of Internal Auditors require every internal audit function to maintain a quality assurance and improvement program, and to undergo an external assessment at least once every five years by a qualified, independent assessor from outside the organization. Functions that do not conform cannot state that their work is conducted in accordance with the Standards.

The assessment evaluates the function against the full framework of domains, principles and standards, examining independence and positioning, the competency and development of the team, methodology and working paper quality, the risk assessment and planning process, engagement execution, reporting, and the function's relationship with the board and audit committee.

Polaris Advisory conducts external quality assessments and independent validation of self-assessments, producing a conformance rating supported by evidence, together with practical recommendations for improvement. This is a defined, recurring requirement with a clear consequence for non-conformance, and it applies to internal audit functions in every sector and jurisdiction. Services typically include:

Turnaround work begins with an accurate diagnosis. Organizations under pressure commonly respond with proportionate cost reductions across all functions, which reduces capacity in areas that are performing alongside those that are not, and rarely addresses the underlying cause.

A structured diagnostic examines revenue and margin performance by product, channel and customer, the composition and flexibility of the cost base, working capital and cash conversion, capital allocation history, and the organization's ability to execute against plans it has already set. The output is a clear view of where value is being lost and what can realistically be recovered, over what timeframe.

From that basis, Polaris Advisory supports the development of a recovery plan with defined actions, owners, milestones and measures, and provides ongoing oversight of execution where required. Services typically include:

A public listing subjects an organization to reporting timetables, control requirements, governance expectations and levels of external scrutiny that most private companies have never faced. Readiness work identifies the gap between current state and listed company requirements, and closes it in advance of the transaction rather than during it.

The assessment covers financial reporting capability and close timetable, internal control over financial reporting and SOX preparedness where applicable, board and committee composition and independence, governance documentation, disclosure controls, and the capacity of the finance function to sustain public company reporting.

Polaris Advisory conducts readiness assessments and supports remediation, working to the transaction timetable so that findings are addressed before they affect the process. Services typically include:

Cost structures accumulate over time. Roles, systems, vendors, processes and reporting lines are added in response to specific circumstances and are rarely removed when those circumstances change. The result, over time, is a cost base that no longer reflects how the organization creates value.

Effectiveness work examines where cost and effort are concentrated relative to the value produced, identifies duplication across functions, and assesses whether processes, spans of control and support structures are appropriate to the current scale of the business. It applies equally to organizations under cost pressure and to organizations that have grown quickly and never rationalized.

Polaris Advisory identifies specific, quantified opportunities and builds a prioritized plan for realizing them, distinguishing between cost that is essential, cost that is discretionary, and cost that no longer serves a purpose. Services typically include: