whitepaper

Sourcing Approaches for Internal Audit Services

by Swetha Lepakshi , Lead Analyst, Professional Services & Travel

31 January 2019

sourcing-approaches-internal-audit

Abstract

Introduction

The internal audit is a key function for any business. It provides the board of directors, the audit committee, senior executives, and stakeholders an independent view on whether the organization has an appropriate risk and control environment. The audit also acts as a catalyst for a strong risk and compliance culture and adds value to the organization’s operations.

An internal audit deals with issues crucial to the organization’s survival. While external auditors look into financial risks and statements, internal auditors consider wider issues such as the organization’s reputation, growth etc. Since the internal audit plays an integral role in the organization’s operations, companies generally adopt various sourcing approaches to perform internal audit functions.

This whitepaper will focus on the different sourcing approaches available for internal audit services and how to determine the most suitable option for each business.

Problem Statement

In recent years, the scope and importance of internal auditing as part of an organization’s management control structure has increased considerably. This expanding role has changed the responsibilities that are put on internal auditors.

This new role requires different skill sets and competencies. Therefore, many organizations are facing a choice: whether to develop these skills in-house or to outsource to external service providers.

Types of Internal Audit Sourcing

This white paper focuses on the various sourcing options available for internal audit services, such as:

Advantages and disadvantages of various sourcing options
Typical spend on internal audits as a percentage of total revenue
Best practices when sourcing an internal audit

Role of the Internal Auditor

Traditionally, the role of internal auditor was mostly concentrated on the financial and compliance areas. However, in recent years, the internal audit has evolved to include more strategic functions such as risk assessment, IT assurance services, enterprise risk, and more.

This evolution has increased the role of the internal audit team in the organization’s structure. The new role requires different skills and competencies. Many organizations face the choice of whether to develop these functions in-house or outsource to external service providers.

The decision to use an in-house team, external service provider, or a combination, depends on various factors such as organization size, complexity, geographic presence, structure, and preferences of the executive board and management.

Types of Internal Audit Functions

Internal audit activity should be strategically aligned with the overall business objectives of the organization. It should help the organization improve its operations by evaluating the effectiveness of its risk management, control, and governance processes.

Organizations typically have three sourcing options for internal audit services. Their sourcing strategy selection is mainly driven by the model that meets its objectives and is the best fit for the organization’s requirements.

sourcing-approches

In-house Internal Audit Function

An in-house audit function needs to be proportional to the size and complexity of the organization. Large organizations with varied products require the in-house audit team to have special skill sets that meet the needs of the audit committee. Setting up an in-house audit team requires a huge amount of investment in resources, training, infrastructure etc.

Advantages

Disadvantages

Full Ownership

The in-house staff has total ownership, resulting in clearly established responsibility and accountability

Skills

An in-house team may lack the diverse skills required to perform the work

Familiarity

Better understanding of organizational processes by the internal audit team

Biased Inputs

The loyalty of an in-house staff lies with the organization, therefore the outcome could be biased

Customized Expertise

The expertise of the staff can be customized for each business function

Staffing Cost

The cost of staffing with the specialized skills may not be equal to the audits conducted

Risk Adoption

The audit’s focus can be fine-tuned in accordance with changing risks

Exposure to Outside Industry

An in-house team has limited exposure to the outside industry, so their decisions may not be based on industry best practices

Total Outsourcing of the Internal Audit Function

This process is adopted when organizations think that the process of setting up an in-house team is not cost efficient. This model is mostly adopted by new entrants and small firms who do not have sufficient resources to set up in-house teams. The audit committee appoints a professional services firm to execute the internal audit.

The following are the advantages and disadvantages of completely outsourcing the internal audit function.

Advantages

Disadvantages

Unbiased Inputs

Independent assurance and access to a wide range of resources

Lack of Company Knowledge

Lack of in-depth understanding of the company by an external firm

Focus on Strategic Activities

The organization is not burdened with the task of setting up the team, funding it, training the staff, etc. Hence, it can focus on other strategic activities

Quality Issues

There could be quality issues due to constant resource changes, resulting in lack of continuity

Savings

The cost of outsourcing is generally less than the cost of maintaining an in-house team

Data Confidentiality

There could be a potential loss of data confidentiality when outsourcing

Industry Best Practice

An external firm is better equipped to know industry best practices, due to multiple assignments in the same industry or through its network.

Co-sourcing of the Internal Audit Function

Organizations that adopt the in-house model face disadvantages in terms of investments and lack of industry best practices. Outsourcing prevents organizations from establishing their own knowledge banks.

In addition, issues regarding data confidentiality and quality could be major drawbacks to fully outsourcing. Hence, many organizations follow the middle path, which is co-sourcing the internal audit function.

Some of the advantages and disadvantages of co-sourcing are highlighted below.

Advantages

Disadvantages

Unbiased Inputs

Access to professional skills and expertise, and the ability to cover unexpected resource needs

Lack of Knowledge

A lack of organizational knowledge by the outsourced provider

Focus on Strategic Activities

With an in-house team handling the key tasks, there is less chance of a data breach

Cost

The cost of hiring a specialized skill set could be higher than in-house staff

Savings

Since co-sourced staff has expertise in the area, they would learn more quickly than new employees

Supplier Management

Lack of business knowledge by external suppliers, extra time needed to manage the external staff

Industry Best Practice

Transfer of skills and knowledge to the in-house staff, thereby retaining the IP within the company.

Intellectual Property Ownership

Internal knowledge development and retention is not easy to manage

Key Sourcing Considerations

When making the sourcing decision, organizations should consider the following.

Access to best practices or insights
Coverage of remote locations
Retention, access to, and ownership of audit papers
Cost
Qualifications of service providers
Flexibility in staffing resources to meet specific requests
The external partners’ professional standards
Independence of the external providers
Retention of knowledge for future assignments

Key Decision Factors

No one decision is right for all organizations. Various factors, when taken into consideration, will help organizations determine whether to keep in-house, co-source, or outsource their internal audit needs.

Consider in-house when

The organization has the budget to set up the team properly
The organization’s structure and processes are critical
The organization wants to maintain the confidentiality of the audit tasks performed
The organization wants to align its internal audit function with strategic objectives

Consider co-sourcing when

The internal audit work flow is too great for in-house staff
An internal audit is not sufficient to address the various risks faced by the organization around the globe
The organization would like to retain the institutional knowledge that is built over time
Resources for an internal audit are not available in all the geographies where the firm operates
Projects are constrained by a lack of internal audit resources
The organization needs subject matter professionals for in-depth analysis

Consider outsourcing when

The organization does not have the resources to rapidly adjust to changing business requirements
The internal audit team is a cost center
The organization does not plan to develop an internal audit team as a core competency
The organization does not want to invest in high quality resources as a fixed cost
The organization requires support beyond its compliance and process-related tasks

Benefits and Challenges of Co-Sourcing/Outsourcing

Benefits

Fixed cost to variable costs: Shifting internal audit costs to external audit providers can reduce many of the fixed costs such as staffing, training, etc.
Facilitating greater focus on core competencies: Organizations today are focusing more on their core competencies and outsourcing non-core functions such internal audit, IT, etc. to external providers.
Access to specialized resources: Outsourcing can give organizations immediate access to specialized resources. The availability of subject matter experts could be helpful during changing business conditions and operational challenges.
Leveraging the supplier’s infrastructure: The major cost of developing and maintaining an internal audit team, from employees to training to developing systems, will be shifted to the external suppliers, thus freeing up the organization’s resources.

Challenges

Choosing the right supplier: While selecting a supplier, it is essential for organizations to find a best fit on many levels, such as cultural compatibility, industry expertise, prior knowledge, etc.
Setting Key Performance Indicators (KPIs): A sourcing agreement can be measured on several levels. One is financial management, whether the cost savings and efficiencies identified by the supplier are balanced against the potential increase in the resource cost. Another is performance measurement, such as internal customer quality and satisfaction.
Smooth transition plan: An experienced outsource provider must have a phased transition plan to ensure smooth and seamless transactions.

Risks of Fully Outsourcing Internal Audit Functions to External Providers

Organizations typically keep their internal audit function in-house. In 2015, only nine percent of audit budgets were spent on outsourcing or co-sourcing.

Because of this, many companies have seen outsourcing functions fail to achieve their objectives, resulting in organizations bringing the work back in-house after a couple of years.

The following are some of the reasons.

It is hard to get a qualified supplier and stick to a budget	Most firms would like engage with one of the big four for these types of services. The cost of engaging with these firms is almost equal to the amount spent on an in-house team. Though there are a lot of tier two and small vendors, organizations many not be willing to engage with them. The involvement of a big four firm in internal audit services will be questioned if the firm also acts as a tax advisor, external auditor, or consultant to the company.
It is tough to set up a suitable outsourcing contract	Organizations who find a qualified supplier, or collection of suppliers, must overcome many legal and regulatory hurdles. These include prior approval from regulators, audit firms that may be working with the organization’s competitors—at the same time or between assignments—and differences in working practices and policy norms between the auditor staff and the organization’s employees
It is difficult to get a qualified audit firm and stick to a budget	Organizations may select the outsourcing firm based on local factors such as language, culture, and legal and regulatory requirements. This will reduce the quality of the audit, as the audit firm may provide local consultants who may not have the necessary technical, operational, audit, and language skills.

How to Overcome the Risks of Fully Outsourcing

Gain clarity on permissible budget overruns, work variations, travel and expenses, and additional costs

The organization must have good clarity on the termination clause, the trigger for termination, and the process to transfer the work in-house or to another supplier

The contract must clearly define the ownership of the audit papers, the knowledge bank, and others, and who can access the content post-termination

How Much Should a Company Spend on Internal Audit Services?

The cost, focus, and size of the internal audit function should be customized for each company’s individual needs. The amount invested into the internal audit mainly depends on the level and complexity of the risks an organization faces, the industry it is in, and the responsibilities given to the internal audit function.

A study conducted by a research foundation indicated that internal audit budgets correlated with company size, in terms of revenue and complexity.

The following table shows the typical spend of organizations on internal audit services based on company size.

Revenue	Spend as a percentage of total revenue
<$1 billion	0.13 percent
$1–2 billion	0.11 percent
$2–3 billion	0.07 percent
$3–5 billion	0.07 percent
$5–10 billion	0.04 percent
$10–20 billion	0.03 percent
>$20 billion	0.03 percent

How to Measure the Performance of an Internal Audit Team

Organizations must select a number of performance measures (approximately four to eight) which the internal audit team, audit committee, and management agree upon. A balanced measurement scorecard should focus on cost, quality, and timelines. This will help the internal audit function drive more effective results for the organization. These KPIs should be customized to the specific needs of the organization.

The following are some possible performance measures:

sourcing-pricing

Suitable Pricing Models Adopted While Sourcing Internal Audit Services

The Sarbanes-Oxley Act (SOX), enacted in 2002, mandates that executive officers and audit committees (regulated entities) are directly responsible for the oversight of the company’s independent auditors. This mandate includes the type of fees paid for audit engagements.

Pricing Model	Suitability	Description
Time and Material	High	This is the most suitable model for independent audit engagements It is the most risk-averse fee arrangement, and is the preferred model for CFOs and audit committees requiring audit independence
Fixed Fee	Medium	Fixed fees are risky unless the audit firm is certain that the scope of the work is commensurate with the fixed fee quotes Risk arises when the client disagrees with unexpected work that exceeds the original fixed fee quote, which could jeopardize the quality and timeliness of the audit

Conclusion

There are various advantages and disadvantages related to each sourcing arrangement. They vary in terms of control over the internal audit function, business knowledge, costs, and objectivity. An organization must consider getting an external perspective when the audit function is of high quality, and the associated risk is high.

Most companies have successful in-house consulting teams with fully dedicated resources. However, in today’s complex business environment, it is very cost-prohibitive to have all the necessary resources and skill sets in-house.

Hence, organizations can choose to co-source the internal audit function by keeping the most confidential and strategic work in-house and having the in-house team constantly monitor the external consultants to ensure the quality of the outsourced work.