Sarah Morris

I’m a director in Business Risk Services at Grant Thornton, where I specialise in defining and embedding transformative and industry leading approaches in internal audit and risk management across financial services. I help asset businesses understand risk, make better decisions and deliver change with confidence whilst ensuring strategic alignment of any assurance focus and outcomes. I’ve spent more than 25 years in risk and assurance, mostly as an internal auditor in financial services but also draw from experience gained in first line delivery roles.

I’ve worked across banking, payments, asset management, insurance, investment management, investment platforms and wealth management, helping firms build and deliver assurance that stands up to regulatory scrutiny and gives their boards real insight. That includes investment governance and mandate compliance, valuation and pricing, best execution, liquidity risk, client assets and client money, product governance and Consumer Duty, and oversight of administrators, custodians and other third parties. 

Organisations rarely stand still, and I’ve spent much of my career providing assurance through major change. I’ve led internal audit through multiple strategic transformations including a bank’s exit from financial services, as well as divestments and Part VII transfers under the Financial Services and Markets Act 2000. I build integrated assurance roadmaps across all three lines of defence, so we cover the right risks at the right time using an agile audit reporting approach, which gets insight to the business quickly and helps agree actions fast. 

I’m increasingly focused on fintech, particularly payments providers. Building on my earlier payments experience, I help these firms strengthen governance, risk management and control as they scale. My focus areas include safeguarding of customer funds, e-money and payment services regulation, outsourcing and agent oversight, financial crime controls, and operational resilience. I’ve also helped embed known safeguarding pitfalls into how teams audit IT general controls.

Before joining Grant Thornton, I held senior leadership roles in a bank and a business consulting firm. I’ve held regulated head of internal audit positions in both the UK and Ireland, including SMF5 under the UK Senior Managers and Certification Regime and PCF13 under the Central Bank of Ireland’s regime.

I’m passionate about getting the best out of teams. I set a clear strategy, then give people the space, coaching and confidence to deliver. I’ve worked with teams that were disengaged and helped them become energised, empowered and focused on quality, by creating psychological safety so people feel able to speak up and challenge me. Risk culture is a particular interest too. I’ve led culture reviews and helped leaders turn the findings into change. I’m known for asking the “so what” question: what’s the risk, what’s the control, and what happens if it fails?

I believe internal audit should offer timely insight, challenge and perspective, so leaders can act before a risk becomes an issue. Outside client work, I mentor colleagues and peers and give guest lectures at universities, to help the next generation of internal auditors see what the job really looks like.