Risk and assurance services in Edinburgh cover internal audit, enterprise risk management, governance, technology and cyber assurance, internal controls, regulatory compliance and external audit. The city has a particularly strong concentration of accountancy and professional services firms working with financial services, public sector organisations, charities and commercial businesses.
This guide provides a practical overview rather than a ranking. It includes a UK-wide risk and assurance specialist together with firms that maintain established offices in Edinburgh.
Acumon
Acumon is a UK firm of chartered accountants and registered auditors providing risk and assurance services to companies, charities, regulated organisations and international corporate groups. Its Risk & Technology Assurance practice covers internal audit, risk management, corporate governance, IT risk, anti-fraud work, health and safety assurance and wider business reviews. Assignments can be delivered on an outsourced, co-sourced or individual-project basis.
The firm works with organisations ranging from growing owner-managed businesses and charities through to larger corporate groups and regulated entities. Audit engagements are delivered in accordance with International Standards on Auditing (UK) and supported by a structured risk-based audit methodology.
Acumon holds a Public Interest Entity (PIE) audit licence, allowing the firm to audit listed companies and other entities subject to enhanced regulatory oversight in the United Kingdom. PIE audits are subject to additional regulatory supervision and quality requirements, and only a limited number of firms are authorised to undertake this type of work. Acumon is also registered for UK statutory audit work and holds recognised auditor status in Jersey and the Isle of Man. Its current website also identifies audit licences covering the Cayman Islands and British Virgin Islands.
Risk and assurance assignments can address board-level assurance requirements or specific areas such as cyber controls, technology risks, fraud prevention, governance structures, enterprise risk frameworks and operational processes. Acumon’s technology assurance work also extends to IT general controls and application controls, while dedicated cyber security reviews can examine technical and organisational safeguards.
Risk and Assurance Capabilities
Acumon provides risk and assurance services for organisations across a wide range of structures and sectors.
These include:
- UK limited companies and corporate groups
- Public Interest Entities (PIEs) and regulated organisations
- UK subsidiaries of international groups
- charities and not-for-profit organisations
- owner-managed businesses approaching statutory audit thresholds
- offshore holding companies and investment vehicles
Risk and assurance engagements are typically led by senior risk and assurance professionals with direct involvement throughout the engagement.
Regulatory Licences and Registrations
Acumon’s published audit registrations and licences include:
- UK statutory audit registration
- Public Interest Entity (PIE) audit authorisation
- Jersey recognised auditor status
- Isle of Man recognised auditor status
- Cayman Islands audit licence
- British Virgin Islands audit licence
These registrations support external audit work involving UK entities and international group structures.
Core Services
Alongside risk and technology assurance, Acumon provides:
- statutory external audit
- group and subsidiary audits
- Public Interest Entity audits
- charity and not-for-profit audit
- audits of international group structures
- internal audit and governance reviews
- risk management and compliance support
- IT and technology assurance
- anti-fraud services
Contact Information
- Website: acumon.com
- Phone: 020 8567 3451
- Email: [email protected]
- Address: 1-2 Craven Road, Ealing, London, W5 2UA, UK
Johnston Carmichael
Johnston Carmichael combines external audit with a dedicated Risk Assurance and Internal Audit practice. Its work covers internal audit, process and controls reviews, corporate governance, risk management, third-party risk and technology assurance. Organisations can use the team for individual reviews or broader assurance programmes covering several operational and governance risks.
The firm has a central Edinburgh office on Melville Street. Its assurance work extends across private businesses, public and third-sector organisations and financial services, with specialist support available where technology systems or control frameworks form an important part of the risk environment.
Key Facts
- Ideal for: Organisations requiring internal audit alongside financial and technology assurance
- Core services: Internal audit, controls reviews, governance reviews, risk assurance, technology assurance, external audit
- Specialization: Risk-based internal audit and control assessment
- Notable strength: Broad assurance capability covering both business processes and technology
Contact Information:
- Website: johnstoncarmichael.com
- Facebook: www.facebook.com/JohnstonCarmichael
- Twitter: x.com/JC_Accountants
- LinkedIn: www.linkedin.com/company/johnston-carmichael-chartered-accountants-and-business-advisers
- Instagram: www.instagram.com/johnston_carmichael
- Address: 7-11 Melville Street, Edinburgh, EH3 7PE
- Phone: 0131 220 2203
Henderson Loggie
Henderson Loggie provides audit and assurance services from its Edinburgh office, with internal audit forming a distinct part of the firm’s offering. The practice works across private, public and third-sector organisations and has experience delivering internal audit programmes within areas such as education and healthcare.
Its assurance portfolio also includes statutory audit, SOC 1, SOC 2 and ISAE 3402 reporting. Internal audit assignments can examine governance, risk management, operational processes and fraud prevention, giving organisations options beyond conventional year-end financial assurance.
Key Facts
- Ideal for: Public bodies, education providers, charities and businesses requiring structured internal audit
- Core services: Internal audit, statutory audit, risk management, governance reviews, SOC reporting
- Specialization: Internal audit and independent controls assurance
- Notable strength: Combines financial audit with internal audit and service-organisation controls reporting
Contact Information:
- Website: hlca.co.uk
- E-mail: [email protected]
- Facebook: www.facebook.com/HendersonLoggie
- LinkedIn: www.linkedin.com/company/hendersonloggie
- Instagram: www.instagram.com/hendersonloggie
- Address: The Stamp Office, Level 5, 10-14 Waterloo Place, Edinburgh, EH1 3EG
- Phone: 0131 226 0200
AAB
AAB’s Edinburgh team provides external audit, internal audit, risk management and governance services. Its internal audit approach can involve individual reviews or wider programmes reporting to senior management and boards, with work structured around the risks most important to the organisation.
Risk management support includes work on risk registers and assurance mapping, while the wider audit and assurance practice covers financial reporting, outsourced internal audit and targeted contract or forensic assignments. This range is useful where assurance requirements cross financial, operational and governance areas.
Key Facts
- Ideal for: Businesses, public bodies and not-for-profit organisations
- Core services: External audit, internal audit, risk management, governance, forensic assurance
- Specialization: Internal audit and organisational risk frameworks
- Location: Edinburgh
- Notable strength: Local risk and audit specialists with experience across public, private and third-sector organisations
Contact Information:
- Website: aab.uk
- Facebook: www.facebook.com/AABLLP
- Twitter: x.com/AABGroup_
- LinkedIn: www.linkedin.com/company/aab-accountants
- Instagram: www.instagram.com/_aabgroup
- Address: 81 George Street, Edinburgh, EH2 3ES
- Phone: +44 (0)131 357 6666
Saffery
Saffery has an Edinburgh office at Haymarket and provides audit and assurance services to businesses, private clients, charities and other organisations. Risk Assurance forms a specific part of the firm’s offering, focusing on how organisations identify, assess, mitigate, monitor and report the risks affecting their objectives.
Internal controls reviews can examine the systems used to manage financial reporting, business, compliance and operational risks. This gives management and boards an independent view of whether controls have been appropriately designed and how they are functioning in practice.
Key Facts
- Ideal for: Businesses and not-for-profit organisations reviewing risk and control frameworks
- Core services: External audit, risk assurance, internal controls reviews, financial assurance
- Specialization: Risk management and internal-control assessment
- Notable strength: Risk assurance can be combined with established external audit capabilities
Contact Information:
- Website: www.saffery.com
- E-mail: [email protected]
- LinkedIn: www.linkedin.com/company/saffery
- Instagram: www.instagram.com/saffery_uk
- Address: Level 4, 9 Haymarket Square, Edinburgh, EH3 8RY
- Phone: +44 (0)131 221 2777
PwC UK
PwC’s Edinburgh office provides organisations with access to audit, assurance, consulting and cyber security expertise. Its Internal Audit practice supports fully outsourced functions, co-sourced arrangements, managed services and advisory projects, allowing the scope to range from a specific review to ongoing assurance across an organisation.
Specialist work includes internal controls and SOX, technology risk, cyber security, data, governance and risk management. Internal audit teams can also bring specialist knowledge into areas such as major transformation programmes, ESG, mergers and acquisitions and digitally enabled business processes.
Key Facts
- Ideal for: Large, regulated and operationally complex organisations
- Core services: External audit, internal audit, controls assurance, technology risk, cyber and data assurance
- Specialization: Multidisciplinary risk and assurance
- Notable strength: Access to specialist risk teams across financial, operational and technology areas
Contact Information:
- Website: www.pwc.co.uk
- Facebook: www.facebook.com/PwCUK
- LinkedIn: www.linkedin.com/company/pwc-uk
- Instagram: www.instagram.com/pwc_uk
- Address: Atria One, 144 Morrison Street, Edinburgh, EH3 8EX
- Phone: +44 (0)131 226 4488
KPMG
KPMG’s Edinburgh operation provides external audit and internal audit support alongside advisory services in risk management, technology, forensics and transformation. The office also works extensively with Scottish public-sector organisations and serves financial services businesses in banking, insurance and investment management.
Its wider Internal Audit and Risk practice covers enterprise risk management, outsourced and co-sourced internal audit, regulatory compliance, project assurance and specialist reviews. Technology and cyber expertise can be brought into assignments where control effectiveness depends on IT systems, digital processes or information security.
Key Facts
- Ideal for: Financial institutions, public bodies and large organisations
- Core services: External audit, internal audit, enterprise risk management, regulatory assurance, technology risk
- Specialization: Complex and regulated risk environments
- Notable strength: Established Edinburgh operation with audit, advisory, technology and forensic expertise
Contact Information:
- Website: kpmg.com
- Twitter: x.com/kpmguk
- LinkedIn: www.linkedin.com/company/kpmg-uk
- Facebook: www.facebook.com/KPMG
- Address: Saltire Court, 20 Castle Terrace, Edinburgh, EH1 2EG
- Phone: +44 131 222 2000
Deloitte
Deloitte operates from Haymarket Square in Edinburgh and offers internal and external assurance together with specialist risk advisory capabilities. Internal audit engagements can be fully outsourced, co-sourced or structured as advisory support to an organisation’s existing function.
The internal audit practice covers conventional financial and operational risks as well as cyber security, third-party risk, GDPR, digital risk, major technology programmes and ESG. Deloitte also works on internal audit function design and effectiveness, including cases where an organisation needs to establish or restructure its assurance model.
Key Facts
- Ideal for: Large organisations with complex financial, operational or technology risks
- Core services: Internal audit, external audit, controls assurance, technology risk, cyber and regulatory assurance
- Specialization: Enterprise-wide internal audit and specialist risk reviews
- Notable strength: Broad subject-matter coverage for internal audit programmes
Contact Information:
- Website: www.deloitte.com
- Facebook: www.facebook.com/deloitteuk
- Twitter: x.com/deloitteuk
- LinkedIn: www.linkedin.com/company/deloitte
- Address: 9 Haymarket Square, Edinburgh, EH3 8RY
- Phone: +44 (0)131 221 0002
EY
EY’s Edinburgh team spans assurance, consulting, tax, and strategy and transactions, with a substantial part of the local market focused on financial services. Within assurance, the firm’s capabilities include financial audit, forensic work, technology risk and other forms of independent assessment.
Internal Audit Transformation services address the operating model, methodology, technology and data used by internal audit functions. Technology risk specialists can also assess IT controls, digital risk and governance where business processes depend heavily on technology platforms.
Key Facts
- Ideal for: Financial services companies and large organisations transforming their assurance functions
- Core services: External audit, internal audit transformation, technology risk, forensic services, controls assurance
- Specialization: Financial and technology assurance
- Notable strength: Strong combination of assurance and technology risk capabilities
Contact Information:
- Website: www.ey.com
- Twitter: x.com/EYnews
- Facebook: www.facebook.com/EY
- LinkedIn: www.linkedin.com/company/ernstandyoung
- Address: Atria One, 144 Morrison Street, Edinburgh, EH3 8EX
- Phone: +44 131 240 1351
BDO
BDO maintains an Edinburgh office on Semple Street and provides audit and assurance together with a dedicated Risk Advisory practice. Its internal audit services can be outsourced or co-sourced, while additional support includes internal audit effectiveness reviews and advice for audit committees.
The broader Risk Advisory portfolio includes enterprise risk management, corporate governance, controls assurance, technology risk, SOX work, contract and commercial risk, and data-related assurance. Continuous auditing, monitoring and analytics can also form part of internal audit programmes.
Key Facts
- Ideal for: Mid-market, listed and regulated organisations
- Core services: Internal audit, enterprise risk management, controls advisory, governance, technology risk, external audit
- Specialization: Business and technology risk assurance
- Notable strength: Wide range of internal audit and controls services from a dedicated Edinburgh office
Contact Information
- Website: www.bdo.co.uk
- LinkedIn: www.linkedin.com/company/bdo-llp
- Instagram: www.instagram.com/lifeatbdo
- Address: 30 Semple Street, Edinburgh, EH3 8BL
- Phone: 0131 347 0347
RSM UK
RSM’s Edinburgh office supports organisations through external audit and a separate Risk Assurance practice. Its internal audit and controls work focuses on identifying important risks, assessing the design and effectiveness of controls and providing assurance to boards and audit committees.
The wider risk portfolio includes enterprise risk management, technology risk, financial services compliance and fraud risk. This allows internal audit programmes to incorporate specialists where financial, regulatory and technology risks overlap rather than treating those areas as isolated reviews.
Key Facts
- Ideal for: Mid-market companies and regulated organisations
- Core services: Internal audit, controls assurance, enterprise risk management, technology risk, fraud risk
- Specialization: Risk-based internal audit and controls
- Notable strength: Specialist risk disciplines can be integrated into broader assurance programmes
Contact Information:
- Website: www.rsmuk.com
- LinkedIn: www.linkedin.com/company/rsm-uk
- Instagram: www.instagram.com/rsm.uk
- Address: 3rd Floor, 2 Semple Street, Edinburgh, EH3 8BL
- Phone: +44 (0)131 659 8300
Grant Thornton
Grant Thornton has an Edinburgh office on Castle Street and provides audit and assurance together with business risk and forensic services. Its risk work covers internal audit, enterprise risk management, controls advisory and technology risk, allowing organisations to combine financial assurance with reviews of operational and digital control environments.
Other capabilities include project and programme assurance, supplier and contract assurance, SOC reporting, data assurance and analytics, and model risk. These services can be used for targeted assignments or incorporated into broader risk and internal audit programmes.
Key Facts
- Ideal for: Businesses and organisations requiring assurance across controls, technology and operational risk
- Core services: External audit, internal audit, enterprise risk management, technology risk, controls advisory
- Specialization: Business risk and controls assurance
- Notable strength: Range of targeted assurance services covering programmes, suppliers, systems and data
Contact Information:
- Website: www.grantthornton.co.uk
- LinkedIn: www.linkedin.com/company/grant-thornton-uk
- Instagram: www.instagram.com/gt_trainees
- Address: 7 Castle Street, Edinburgh, EH2 3AH
- Phone: +44 (0)20 7383 5100
Forvis Mazars
Forvis Mazars operates an Edinburgh office at Capital Square and provides audit alongside a broad risk consulting practice. Risk services include enterprise risk management, governance, internal audit, internal controls, technology assurance, regulatory compliance and third-party risk.
The firm’s internal audit work can assess governance structures, risk management arrangements and control effectiveness, while specialist technology and regulatory teams can be brought into more technical assignments. Its Scottish risk consulting leadership also includes expertise in internal audit, governance and strategic risk.
Key Facts
- Ideal for: Organisations requiring integrated governance, risk and internal audit support
- Core services: Internal audit, ERM, governance, internal controls, technology assurance, regulatory compliance
- Specialization: Risk consulting and independent assurance
- Notable strength: Risk services span organisational governance, technology and regulatory requirements
Contact Information:
- Website: www.forvismazars.com
- Twitter: x.com/ForvisMazarsUK
- LinkedIn: www.linkedin.com/company/forvis-mazars-in-the-uk
- Instagram: www.instagram.com/forvismazarsuk
- Address: Capital Square, 58 Morrison Street, Edinburgh, EH3 8BP
- Phone: +44 13 13 13 79 00
Armstrong Watson
Armstrong Watson expanded its Scottish presence with a new Edinburgh office in 2026. The local offering includes accounting, audit and assurance, tax, financial planning, corporate finance and strategic advice, giving Edinburgh organisations access to the firm’s wider assurance practice from within the city.
Its audit and assurance services include statutory audit, independent assurance engagements and internal audit. Internal audit can be delivered on an outsourced or co-sourced basis, with reviews covering governance, operational processes, internal controls and risk management.
Key Facts
- Ideal for: Owner-managed businesses and organisations requiring audit with broader business advisory support
- Core services: Statutory audit, internal audit, independent assurance, accounting and advisory
- Specialization: Financial and operational assurance
- Notable strength: Physical Edinburgh presence supported by a wider Scottish and northern UK practice
Contact Information:
- Website: www.armstrongwatson.co.uk
- E-mail: [email protected]
- Facebook: www.facebook.com/armstrongwatson
- Twitter: x.com/armstrongwatson
- LinkedIn: www.linkedin.com/company/armstrong-watson
- Instagram: www.instagram.com/armstrongwatsonllp
- Address: Spaces, 92-98 Fountainbridge, Edinburgh, EH3 9QA
- Phone: 0131 255 0130
Conclusion
Risk and assurance firms serving Edinburgh vary from practices focused primarily on financial audit and controls to multidisciplinary teams covering internal audit, enterprise risk management, governance, cyber security, technology risk, regulatory compliance and programme assurance. The city also has a particularly strong selection of firms able to work with financial services and public-sector organisations.
There is no single provider that fits every organisation. The appropriate choice depends on the type of assurance required, the complexity of the risk environment, regulatory obligations, budget and whether the work calls for a one-off review, an outsourced internal audit function or continuing support across several areas of risk.
For organisations where technology, regulation and governance increasingly overlap, it is also useful to compare the specialist expertise available behind the core audit team. A provider with the right combination of financial, operational and technology assurance can reduce the need to coordinate separate advisers for interconnected risks.