Understanding Internal Audit Outsourcing vs. Co-sourcing

About 73% of CAEs use internal audit outsourcing to obtain critical services related to their internal audit activity.[1]

Years ago, I wrote about audit sourcing as a Chief Auditor with two decades in the trenches. Today, as a consulting CEO, I see these models from a new vantage point. This data confirms what I’ve always suspected: choosing the right internal audit outsourcing vs. co-sourcing model isn't just about finding extra "hands." It is a strategic investment in the structure that best protects you and your company.[3]

Internal Audit (IA) is a critical function for maintaining regulatory compliance and operational integrity.[2] It provides independent assurance that risk management, governance, and internal control processes are operating effectively, with an end goal of adding business value.[3] Whether your organization requires a full outsourcing solution or a co-sourcing partnership to augment your existing team, the structure you choose must be robust enough to handle modern compliance scrutiny.

Top Audit Recruiting Challenges in the US

• Misaligned compensation expectations between candidates and employers.
• Candidates lacking critical competencies.
• Not enough internal audit experience.

What’s the difference between Internal Audit outsourcing vs. co-sourcing? 

Insourcing the IA function is usually the best option. However, that is expensive and hard to accomplish. Therefore, outsourcing solutions can be an appropriate tool for many use cases.[4]

Outsourcing is often seen when companies start their journey of establishing an Internal Audit function. The companies outsource the administration and staffing to an external provider who reports results to management. 

Co-sourcing is fairly common in most companies, blending existing internal resources and a third-party provider. 

Outsourcing vs Co-sourcing Internal Audits

Both outsourcing and co-sourcing when implemented properly can help organizations maintain control of internal audit activities, deliver on their IA requirements and accomplish objectives.

Outsourcing

Pros

• Great starter kit for companies that do not have an existing IA function and do not know how to build one, or for smaller companies. [5]
• End to end management & execution of the IA function
• Access to expertise and tech skills that otherwise would not be available internally.
  

Considerations

• Challenges in finding the right vendor who can act as an extension of the company.
• Often, this is the most expensive option.
• Less internal acceptance of external providers (they are not always viewed as part of the team).
• Limited knowledge transfer once the auditors' work is complete.
  

Co-sourcing

Pros

• Can provide adequate level of assurance to audit committee / board of directors even with limited resources
• Gives greater flexibility & scalability with staffing resources and needed support
• Augments current IA capabilities with specialist expertise + skills 
• Can provide fresh perspectives and independent insights
  

Considerations

• Challenges finding the right vendor who can act as an extension of the company.
• External niche technical expertise can be costly.
  

If you need internal audit services, where should you look?

Large and Medium Firms 

Large firms and Big 4 accounting companies are reputable for a reason. They are known to deliver credible reports, offer a wide range of services and resources, and have strong quality assurance processes. 

On the other hand, they can be pricey and see high turnover, so it can be more difficult to establish a long-term relationship. It’s also more likely you’ll be working with a manager or senior associate as opposed to a partner, which can limit the depth or type of guidance you’ll receive. 

Typically, their employees have no experience as internal auditors.

Small Firms

Smaller firms can meet customers' IA needs without the hefty price tag. They tend to be more agile and can provide direct partnership with senior staff members who can offer valuable insight to your organization. You are more of a priority.

On the other hand, smaller firms may face resource constraints.

Modern internal audit functions need a broad range of skills to provide an effective and comprehensive service [6].

Alan Simpson

What to look for when selecting the right partner for your Internal Audit needs

There are a few important considerations to use when selecting the right firm for your use case: 

• Firms that can offer experienced internal auditors, NOT external auditors
• The team has the technical expertise relevant to the scope of work (IT, Finance, and Operations processes) and offers relevant industry insights. 
• Ability to communicate with internal and external stakeholders at every level.
• Experience building or streamlining internal audit processes and providing measurable outcomes of increased efficiency.
• Lastly, the price should be reasonable. There is no business need to pay the huge margins.

Call Advise Up, we can help. 

We’re not lifelong outside consultants. We are career internal auditors with technical expertise and industry experience. 

The team at AdviseUp provides hands-on experience in outsourcing, co-sourcing, and in-sourcing internal audit experience to clients of all industry types and sizes. 

Start preparing your business for the future today.

Resources