Risk and Compliance

Turning exposure into oversight

Risk doesn’t announce itself. It builds quietly in unclear approval chains, inconsistent reporting, procurement processes that no one fully monitors, and compliance obligations that shift faster than internal policies can keep up. By the time it surfaces — as a failed audit, a regulatory inquiry, or a financial irregularity — the cost of addressing it has multiplied.

At Finagon, we help organizations get ahead of that curve. We build risk and compliance frameworks that are proportionate, practical, and genuinely used — not binders of policy that sit disconnected from how the business actually operates.

Who This Is For

Our Risk and Compliance service is built for:

• Organizations operating in regulated, state-linked, or high-scrutiny environments, where governance and audit-readiness are non-negotiable
• Groups with multiple subsidiaries or business units that need consistent risk and compliance standards applied across the organization
• Leadership and boards who need independent assurance that internal controls are functioning as intended
• Companies responding to a specific incident — a procurement irregularity, a financial flow concern, or a governance failure — that need both a rigorous investigation and a framework to prevent recurrence
• Businesses preparing for external audit, investment, or regulatory review, who need to demonstrate credible risk management and anti-corruption practices

What We Help You Solve

• Weak or absent internal audit function. The organization has no independent mechanism to test whether controls are actually working.
• Governance and oversight gaps. Decision rights, approval authority, and accountability are unclear, especially across subsidiaries or business units.
• Procurement and financial flow irregularities. Spend is difficult to trace, approval processes are inconsistently applied, or red flags have already surfaced.
• Regulatory and compliance exposure. Obligations under evolving Bulgarian and EU regulation — including anti-bribery and anti-corruption standards are not systematically managed.
• Fraud risk and investigation needs. Indicators of fraud or misconduct require a structured, defensible investigative response.
• Fragmented risk management across a group. Subsidiaries manage risk inconsistently, leaving leadership without a reliable, consolidated view.

Our Approach

We structure Risk and Compliance engagements around four phases, adapted to the urgency and sensitivity of the situation.

1. Assess

We map the organization’s current risk landscape and control environment — reviewing governance structures, financial flows, procurement processes, and existing policies against relevant regulatory and best-practice standards. Where an issue has already surfaced, this phase includes a focused, evidence-based investigation into the facts.

2. Identify

We prioritize risks by likelihood and impact, distinguishing between control weaknesses, active irregularities, and regulatory gaps. We’re direct about where exposure is greatest, so leadership can make informed decisions about where to act first.

3. Build

We design the frameworks needed to close the gaps: internal audit functions, procurement and approval controls, anti-corruption management systems (including ISO 37001-aligned frameworks), subsidiary risk-monitoring structures, and clear escalation and reporting lines to the board or ownership.

4. Embed

Frameworks only reduce risk if they’re used. We support implementation, train the teams responsible for ongoing monitoring, and help establish the reporting rhythms that keep risk and compliance visible to leadership on an ongoing basis — not just at audit time.

What’s Included

Depending on the scope of your engagement, Risk and Compliance can include:

• Internal audit function design and implementation
• Governance and internal control review across the organization or group
• Procurement and approval process audits
• Financial flow tracing and irregularity investigation
• Anti-corruption and anti-bribery management systems (including ISO 37001 alignment)
• Subsidiary-level risk and compliance monitoring frameworks
• Fraud indicator investigation and formal reporting
• Board- and leadership-level risk reporting design

Why Finagon

We’ve built these functions from the ground up, not just audited them. Our experience includes designing internal audit capability and organization-wide oversight frameworks for complex, multi-subsidiary organizations — including in state-linked and regulated environments where scrutiny is high and margin for error is low.

We know what irregularities actually look like in practice. From procurement processes to financial flows across subsidiaries, our work has involved identifying and formally documenting governance concerns and fraud indicators — not just designing theoretical controls.

We build frameworks people can actually run. A control environment only works if the people responsible for it understand and use it. We design with day-to-day usability in mind, not just audit-report completeness.

We treat sensitive situations with the discretion they require. Investigative and compliance work often touches reputational and legal sensitivity. We handle it accordingly — precisely, discreetly, and with clear documentation at every step.

How We Start

Every engagement begins with an honest picture of where things stand. Tell us briefly about the risk or compliance challenge you’re facing — an area of uncertainty, a specific concern, or a framework you know needs to be built — and we’ll come back with an initial perspective on how to approach it.