Internal audit outsourcing services

Up through the 1980s, internal audit outsourcing was not popular. Most companies’ internal audit functions were staffed primarily in-house with full-time, dedicated employees.

This structure worked adequately and can still be effective today, but only if full-time internal auditors possess all of the skills needed to address key business risks faced by the organization.

If this is not the case, then the internal audit function places its employer company at risk by not being able to addressadequately the key risks that it has been asked to audit.

During the 1980s, as the concept of “core competency” gained more attention, companies evaluated many of their business functions and the potential for internal audit outsourcing.

Payroll, benefits, real estate, printing, information systems operation and maintenance, and even aspects of design or manufacturing, among other functions, were considered. Many companies found clear and tangible benefits, positive return on investment (ROI), and improved service levels as a result of internal audit outsourcing. In some cases, capital expenditures were reduced and the cost of these functions became more variable.

Internal audit functions were a part of this analysis, and several new internal audit outsourcing and co-sourcing organizations, including the large accounting firms, created newstructures to provide such services.

Today, all businesses, government and not-for-profit organizations face myriad risks due to the dynamic operating climates in which they operate.

New and fast-changing regulations; significant technology-related risks such as security, business continuity, and application and data integrity; heightened instances of or opportunities for fraud and abuse; and other issues such as Sarbanes-Oxley require internal audit functions to have at their disposal a larger and deeper talent pool.

These professionals must be able to address, react to and effectively audit and report on this more complex and faster-changing risk universe.

Given this dynamic risk environment, it is unlikely that a majority of internal audit functions have the continuous in-house capability to adequately address every risk they and their organizations must face.

Thus, contracting, partnering or working with outside organizations that can provide specialized resources improves an internal audit function’s ability to address risks and meet customer expectations.

Additionally, these co-sourcing arrangements often assist in the knowledge transfer process to in-house resources, raising the level of competency of the function’s full-time employees.

Likewise, many companies – especially public companies, large and diverse private companies, and even governmental entities and not-for-profit organizations may find that full or partial internal audit outsourcing makes sense, is cost-effective and provides significant short- and long-term benefits.

Benefits of internal audit outsourcing include:

• Quick start-up of the function and execution of work, including already-developed methodologies and audit tools provided by the outsourcing organization.

• A variable-cost arrangement rather than a fixed-cost function.

• Access to a greater number and wider range of resources

• Potentially greater objectivity and independence

The NYSE’s internal audit rule allows for internal audit outsourcing. In its commentary to the requirement, the NYSE stated, “A company may choose to outsource this function to a third-party service provider other than its independent auditor.”

Companies should also consider the potential negative impact of outsourcing or co-sourcing internal audit, which can include, but is not limited to, the potential loss of control since resources are not directly employed by the company.

From The IIA’s perspective, internal auditing, regardless of who provides the service, should be performed in accordance with The IIA Standards.

The IIA states in its position paper, Resourcing Alternatives for the Internal Audit Function, that a fully resourced and professionally competent staff is an integral part of the organization, whether in-sourced or outsourced.

The IIA recognizes that many “partnering” arrangements with outside providers have been effective in helping organizations obtain internal auditing services to help achieve management’s objectives.

While non-NYSE companies are not required to have an internal audit function, certain limitations apply to the nature and level of internal audit services that any public company’s external auditor can provide per SEC rules and regulations.

Ultimately, deciding whether to outsource internal audit is not a matter of considering the general pros and cons.Instead, each company should ask:

• If we currently do not have an internal audit function, are we better off taking the time and effort to start our own in-house internal audit function? Or should we initially outsource it to gain quick start-up and access to a greater level of expertise and broader level of resources, and then monitor this decision and delivery model to ensure it is effective?

• If we already have an internal audit function, do we have the resources we need to effectively address all of the key risks we face and in which internal audit should be involved? Do we need to have all of these resources in-house all of the time? Might we be better off considering an arrangement to have one or more outside organizations assist us with addressing our risks?

There are many excellent internal audit functions consisting of primarily in-house, fully dedicated employee resources. What makes these functions most valuable, effective and appropriate, however, is recognition of their own limitations.

Many large internal audit functions (more than 25 full-time employees) recognize that in today’s complex business environment, it would be cost-prohibitive to have all of the right resources at hand all of the time.

They also understand that various forms of co-sourcing arrangements have benefited them greatly along with the companies, management and audit committees they serve. It may be a daunting task to have an all comprehensive internal audit team cheaply hence the internal audit outsourcing makes sense.