Internal audit: to outsource or not?
Alan Simpson CA looks at the types of outsourcing arrangements often used and reviews the pros and cons of outsourcing internal audit.
Traditionally, internal audit work was undertaken mainly by in-house teams. Through time this has changed and now many organisations outsource, either completely or partially, their internal audit function.
Modern internal audit functions need a broad range of skills to provide an effective and comprehensive service.
An organisation may employ only a small number of internal auditors, but their responsibilities can require expertise in a growing range of specialist skills such as IT audit; data mining; data analytics and, (depending on the type of industry and size of the organisation), in depth knowledge of different regulatory regimes. It can be difficult and expensive to recruit, retain and invest in those people with specialist skills.
To circumvent this difficulty, many organisations carry out some degree of outsourcing of the internal audit function.
Some smaller organisations, required by a regulatory agency or by funding covenant to have an internal audit function, may find that they want to outsource internal audit wholly to an external provider rather than incurring the cost burden of recruiting and training their own in-house internal audit section.
Types of internal audit outsourcing arrangements
| Full outsourcing: | where the entire function is carried out by an external provider, who would usually be a public accounting firm, but generally a different firm from the organisation’s external auditor. |
| Partial outsourcing: | where less than 100% of the internal audit services are purchased from external sources. |
| Co-sourcing: | where the work in carrying out the internal audit plan is shared between the core team of in-house internal auditors and an outside provider, who once again would generally be an accounting firm, and a different firm from that of the external auditor. A need for this type of outsourcing can arise due a temporary shortage of internal audit staff coupled with the need to meet tight deadlines; special project work; difficulties perceived in recruiting suitably qualified internal auditors; coverage of remote business sites; skill shortages particularly those with experience of nascent or fast-moving technologies or for reviewing compliance with new pan-national regulatory regimes (e.g. GDPR or Sarbanes-Oxley). |
| Subcontracting: | this is where a specific engagement or part of an engagement is undertaken by a third party, usually for a limited period. |
The pros and cons of outsourcing internal audit v an in-house internal audit function
Some of the benefits of outsourcing the internal audit function include the following:
- In a small internal audit section, some degree of outsourcing may be needed to provide the audit committee and board of directors (or equivalent) with overall adequate assurance, particularly in key risk areas requiring a high level of specialist technical expertise not available internally. This would especially apply in connection with fast-developing technologies where a small in-house section may not have adequate access to the continual (and probably expensive) training needed to maintain competence in and keep abreast of new developments.
- Flexibility in staffing resources.
- The organisation could gain from co-sourcing by having access to specialist expertise, innovations in the latest audit techniques and technology and the opportunity for bench-marking.
- The perception that the independence of the internal auditor from management would be strengthened.
- Depending upon the circumstances, it may provide greater value for money to outsource internal audit.
- Some degree of outsourcing may help to revitalise a long – established internal audit function.
Some of the drawbacks of outsourcing the internal audit function include the following:
- The challenge of effectively managing contracts and service level agreements with an external service provider.
- Where internal audit is outsourced, at least to begin with, there will clearly be a lack of depth of internal knowledge and awareness of the culture of the organisation. There will be an inevitable acclimatisation period to get used to the organisation’s systems and processes.
- How receptive will people be to an external service provider?
- There is the risk of confusion over responsibility and accountability.
- There is a risk to the credibility of the internal audit function if a serious lack of a cultural “fit” develops between the organisation and the provider of the outsourced service.
- An unintended consequence is that by introducing an outside provider of internal audit services, the organisation loses some flexibility as it is tied into a per-agreed timetable and schedule.
- It may prove to be costly and time-consuming if the board decides to bring the outsourced internal audit function back in house.
- Internal audit is often used as a training ground for internal promotions. Depending upon the extent of outsourcing, the opportunities for this may disappear, or, at best, be significantly reduced if internal audit is outsourced.
Further points
It is important to emphasise that the oversight and responsibility for the internal audit function cannot be outsourced (per the Institute of Internal Auditors). The board, through the audit committee, is ultimately responsible for oversight of internal audit.
Consequently, there is a need for more formal documentation and channels of reporting and approval when a large part of the internal audit function is outsourced.