
Sourcing Approaches for Internal Audit Services

Abstract
Introduction
The internal audit is a key function for any business. It provides the board of directors, the audit committee, senior executives, and stakeholders an independent view on whether the organization has an appropriate risk and control environment. The audit also acts as a catalyst for a strong risk and compliance culture and adds value to the organization’s operations.
An internal audit deals with issues crucial to the organization’s survival. While external auditors look into financial risks and statements, internal auditors consider wider issues such as the organization’s reputation, growth etc. Since the internal audit plays an integral role in the organization’s operations, companies generally adopt various sourcing approaches to perform internal audit functions.
This whitepaper will focus on the different sourcing approaches available for internal audit services and how to determine the most suitable option for each business.
Problem Statement
In recent years, the scope and importance of internal auditing as part of an organization’s management control structure has increased considerably. This expanding role has changed the responsibilities that are put on internal auditors.
This new role requires different skill sets and competencies. Therefore, many organizations are facing a choice: whether to develop these skills in-house or to outsource to external service providers.
Types of Internal Audit Sourcing
This white paper focuses on the various sourcing options available for internal audit services, such as:
- Advantages and disadvantages of various sourcing options
- Typical spend on internal audits as a percentage of total revenue
- Best practices when sourcing an internal audit
Role of the Internal Auditor
Traditionally, the role of internal auditor was mostly concentrated on the financial and compliance areas. However, in recent years, the internal audit has evolved to include more strategic functions such as risk assessment, IT assurance services, enterprise risk, and more.
This evolution has increased the role of the internal audit team in the organization’s structure. The new role requires different skills and competencies. Many organizations face the choice of whether to develop these functions in-house or outsource to external service providers.
The decision to use an in-house team, external service provider, or a combination, depends on various factors such as organization size, complexity, geographic presence, structure, and preferences of the executive board and management.
Types of Internal Audit Functions
Internal audit activity should be strategically aligned with the overall business objectives of the organization. It should help the organization improve its operations by evaluating the effectiveness of its risk management, control, and governance processes.
Organizations typically have three sourcing options for internal audit services. Their sourcing strategy selection is mainly driven by the model that meets its objectives and is the best fit for the organization’s requirements.
In-house Internal Audit Function
An in-house audit function needs to be proportional to the size and complexity of the organization. Large organizations with varied products require the in-house audit team to have special skill sets that meet the needs of the audit committee. Setting up an in-house audit team requires a huge amount of investment in resources, training, infrastructure etc.
Advantages |
Disadvantages |
Full Ownership The in-house staff has total ownership, resulting in clearly established responsibility and accountability |
Skills An in-house team may lack the diverse skills required to perform the work |
Familiarity Better understanding of organizational processes by the internal audit team |
Biased Inputs The loyalty of an in-house staff lies with the organization, therefore the outcome could be biased |
Customized Expertise The expertise of the staff can be customized for each business function |
Staffing Cost The cost of staffing with the specialized skills may not be equal to the audits conducted |
Risk Adoption The audit’s focus can be fine-tuned in accordance with changing risks |
Exposure to Outside Industry An in-house team has limited exposure to the outside industry, so their decisions may not be based on industry best practices |
Total Outsourcing of the Internal Audit Function
This process is adopted when organizations think that the process of setting up an in-house team is not cost efficient. This model is mostly adopted by new entrants and small firms who do not have sufficient resources to set up in-house teams. The audit committee appoints a professional services firm to execute the internal audit.
The following are the advantages and disadvantages of completely outsourcing the internal audit function.
Advantages |
Disadvantages |
Unbiased Inputs Independent assurance and access to a wide range of resources |
Lack of Company Knowledge Lack of in-depth understanding of the company by an external firm |
Focus on Strategic Activities The organization is not burdened with the task of setting up the team, funding it, training the staff, etc. Hence, it can focus on other strategic activities |
Quality Issues There could be quality issues due to constant resource changes, resulting in lack of continuity |
Savings The cost of outsourcing is generally less than the cost of maintaining an in-house team |
Data Confidentiality There could be a potential loss of data confidentiality when outsourcing |
Industry Best Practice An external firm is better equipped to know industry best practices, due to multiple assignments in the same industry or through its network. |
Co-sourcing of the Internal Audit Function
Organizations that adopt the in-house model face disadvantages in terms of investments and lack of industry best practices. Outsourcing prevents organizations from establishing their own knowledge banks.
In addition, issues regarding data confidentiality and quality could be major drawbacks to fully outsourcing. Hence, many organizations follow the middle path, which is co-sourcing the internal audit function.
Some of the advantages and disadvantages of co-sourcing are highlighted below.
Advantages |
Disadvantages |
Unbiased Inputs Access to professional skills and expertise, and the ability to cover unexpected resource needs |
Lack of Knowledge A lack of organizational knowledge by the outsourced provider |
Focus on Strategic Activities With an in-house team handling the key tasks, there is less chance of a data breach |
Cost The cost of hiring a specialized skill set could be higher than in-house staff |
Savings Since co-sourced staff has expertise in the area, they would learn more quickly than new employees |
Supplier Management Lack of business knowledge by external suppliers, extra time needed to manage the external staff |
Industry Best Practice Transfer of skills and knowledge to the in-house staff, thereby retaining the IP within the company. |
Intellectual Property Ownership Internal knowledge development and retention is not easy to manage |
Key Sourcing Considerations
When making the sourcing decision, organizations should consider the following.
- Access to best practices or insights
- Coverage of remote locations
- Retention, access to, and ownership of audit papers
- Cost
- Qualifications of service providers
- Flexibility in staffing resources to meet specific requests
- The external partners’ professional standards
- Independence of the external providers
- Retention of knowledge for future assignments
Key Decision Factors
No one decision is right for all organizations. Various factors, when taken into consideration, will help organizations determine whether to keep in-house, co-source, or outsource their internal audit needs.
Consider in-house when
- The organization has the budget to set up the team properly
- The organization’s structure and processes are critical
- The organization wants to maintain the confidentiality of the audit tasks performed
- The organization wants to align its internal audit function with strategic objectives
Consider co-sourcing when
- The internal audit work flow is too great for in-house staff
- An internal audit is not sufficient to address the various risks faced by the organization around the globe
- The organization would like to retain the institutional knowledge that is built over time
- Resources for an internal audit are not available in all the geographies where the firm operates
- Projects are constrained by a lack of internal audit resources
- The organization needs subject matter professionals for in-depth analysis
Consider outsourcing when
- The organization does not have the resources to rapidly adjust to changing business requirements
- The internal audit team is a cost center
- The organization does not plan to develop an internal audit team as a core competency
- The organization does not want to invest in high quality resources as a fixed cost
- The organization requires support beyond its compliance and process-related tasks
Benefits and Challenges of Co-Sourcing/Outsourcing
Benefits
|
Challenges
|
Risks of Fully Outsourcing Internal Audit Functions to External Providers
Organizations typically keep their internal audit function in-house. In 2015, only nine percent of audit budgets were spent on outsourcing or co-sourcing.
Because of this, many companies have seen outsourcing functions fail to achieve their objectives, resulting in organizations bringing the work back in-house after a couple of years.
The following are some of the reasons.
It is hard to get a qualified supplier and stick to a budget |
|
It is tough to set up a suitable outsourcing contract |
|
It is difficult to get a qualified audit firm and stick to a budget |
|
How to Overcome the Risks of Fully Outsourcing
Gain clarity on permissible budget overruns, work variations, travel and expenses, and additional costs |
The organization must have good clarity on the termination clause, the trigger for termination, and the process to transfer the work in-house or to another supplier |
The contract must clearly define the ownership of the audit papers, the knowledge bank, and others, and who can access the content post-termination |
How Much Should a Company Spend on Internal Audit Services?
The cost, focus, and size of the internal audit function should be customized for each company’s individual needs. The amount invested into the internal audit mainly depends on the level and complexity of the risks an organization faces, the industry it is in, and the responsibilities given to the internal audit function.
A study conducted by a research foundation indicated that internal audit budgets correlated with company size, in terms of revenue and complexity.
The following table shows the typical spend of organizations on internal audit services based on company size.
Revenue |
Spend as a percentage of total revenue |
<$1 billion |
0.13 percent |
$1–2 billion |
0.11 percent |
$2–3 billion |
0.07 percent |
$3–5 billion |
0.07 percent |
$5–10 billion |
0.04 percent |
$10–20 billion |
0.03 percent |
>$20 billion |
0.03 percent |
How to Measure the Performance of an Internal Audit Team
Organizations must select a number of performance measures (approximately four to eight) which the internal audit team, audit committee, and management agree upon. A balanced measurement scorecard should focus on cost, quality, and timelines. This will help the internal audit function drive more effective results for the organization. These KPIs should be customized to the specific needs of the organization.
The following are some possible performance measures:
Suitable Pricing Models Adopted While Sourcing Internal Audit Services
The Sarbanes-Oxley Act (SOX), enacted in 2002, mandates that executive officers and audit committees (regulated entities) are directly responsible for the oversight of the company’s independent auditors. This mandate includes the type of fees paid for audit engagements.
Pricing Model |
Suitability |
Description |
Time and Material |
High |
|
Fixed Fee |
Medium |
|
Conclusion
There are various advantages and disadvantages related to each sourcing arrangement. They vary in terms of control over the internal audit function, business knowledge, costs, and objectivity. An organization must consider getting an external perspective when the audit function is of high quality, and the associated risk is high.
Most companies have successful in-house consulting teams with fully dedicated resources. However, in today’s complex business environment, it is very cost-prohibitive to have all the necessary resources and skill sets in-house.
Hence, organizations can choose to co-source the internal audit function by keeping the most confidential and strategic work in-house and having the in-house team constantly monitor the external consultants to ensure the quality of the outsourced work.
References
Related Insights:
View All
Get more stories like this
Subscirbe for more news,updates and insights from Beroe