Starting position
Operations investigated its own irregularities. Waivers, voids and discounts at point of sale sat behind privileges that had grown with the business rather than been designed. Inventory, recipe costing and cash handling ran on habit. There was no risk universe to plan from and no reporting line that gave assurance work standing with the executive.
Approach
The first month went to a charter and a reporting line to the Managing Director, so that everything after it had authority. From there: a risk universe and a risk-based annual plan, an investigation protocol that fixed how allegations are received, evidenced, interviewed and reported, and reporting standards so that findings read the same way regardless of who they were about.
Assurance and advisory were separated deliberately. Where the function was asked to help design controls, that work was run under written safeguards, so that later audits of the same area were not compromised. A three-person compliance and documentation team was supervised to produce the controlled document set.
What was built and run
- Six audit cycles: accounts payable, procurement, inventory, roastery, central production and outlet operations.
- Fraud and misconduct investigations taken to findings: cash-sale suppression, unexplained cash variances, unauthorised inventory use, food-safety breaches, misstated recipe costing.
- Point-of-sale privilege redesign for discounts, voids and waived bills, with a waived-bill SOP piloted at one outlet before roll-out.
- HR onboarding control design assessed against UAE labour law: 183 employees, 32-file judgmental sample, 21 observations across three regulatory tiers.
- Audit gate reviews on four concurrent outlet conversions, from pre-opening compliance through Day-30 and Day-60 post-opening review.
- A remote outlet compliance monitoring programme using CCTV and system data, and AI-assisted tooling for risk assessment and briefing.
Result
Investigations reached sustained findings with executive-endorsed remediation, and remediation was tracked to closure rather than noted. Independence was documented and remained intact through advisory work. The function now has a standards register of 27 sub-categories and a controlled document set of more than fifty items that will outlast the person who wrote them.
Case details are generalised to protect the employer. Specifics, including redacted working papers where appropriate, can be discussed at interview.
