Sourcing options for Internal Audit services: your house, your rules
Author: by Hisham H. Zeitouny, partner, Enterprise Risk
Today’s dynamic business environment requires internal auditors to wear many hats and change them often. For internal auditors to deliver on their mandate and meet the expectations of oversight bodies, they need broader skill sets, the ability to add the most value and the flexibility to properly respond to changes caused by internal and external factors.
Internal audit activities should, ideally, be strategically aligned with the overall organizational goals and should help in improving the organization’s operations by evaluating and improving the effectiveness of risk management, control and governance processes.
To enable the internal audit function to achieve these objectives, it needs to have leading edge technology, tools and a constantly updated arsenal of specialized skill sets, techniques and leading practices. Acquiring and retaining the necessary and often specialized capabilities internally can pose quite a challenge, particularly in light of changing priorities and the costs involved.
The current Institute of Internal Auditors’ International Standards for the Professional Practice of Internal Auditing (“IIA Standards”) reflects the following changes in the definition of internal audit (see table below):
|Former standards||Current standards|
|Independent function established within an organization||Independent, objective activity performed by Internal Audit|
|Appraisal function||Assurance and consulting activity|
|Examine and evaluate the organization’s activities as a service to the company||Designed to add value and improve organization’s operations|
|Assist members of the organization in the effective discharge of their responsibilities||Help a company achieve its objectives|
|Analyses, appraisals, recommendations, counsel and information concerning the activities reviewed and promoting effective control at reasonable cost||Bring a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes|
Below are several internal audit sourcing strategies that organizations have at their disposal to build their arsenal of internal audit expertise, transfer knowledge and build the capabilities of their internal audit functions.
Organisations have three main internal audit sourcing strategies to choose from. The selection of a sourcing strategy will be driven by the model that best fits the organization’s requirements and meets its objectives. The models presented below are based on leading corporate governance practices. Central to leading corporate governance practices is the requirement that management must retain responsibility for the system of internal controls and that the Board, through the Audit Committee, must retain oversight of the internal audit function. This includes approval of the vision, values, strategic objectives, internal audit delivery structure, allocation of financial resources and the respective performance measurements.
The alternative sourcing strategies are:
- Internal Sourcing: Resources* are provided by the organization to achieve the strategic objectives of the Internal Audit Function
- Co-sourcing: A blend of resources from within the organization and a third party provider of services. Resources* are developed and provided based on the organization’s unique needs in order to achieve the strategic objectives of the Internal Audit Function.
- Outsourcing: Resources* are entirely provided by a third party provider of services to the organization in order to achieve the strategic objectives of the Internal Audit Function.
*The term “resources” as used within the above context, is defined as the people, processes, methodologies, technologies and tools required to carry out the internal audit activities.
Advantages and disadvantages of sourcing options
A key advantage of the Internal Sourcing model is that it provides the arena for developing future leaders within the organization. Members of the Internal audit department are trained on various functions within the organization and obtain a comprehensive understanding of the key risks and challenges that face the organization, enabling individuals to enhance their decision-making process. Other advantages include a higher level of ownership of the internal audit function and a better understanding of the organization’s culture that permits internal auditors to master the relationship with various process owners.
The key disadvantage of the Internal Sourcing strategy or model is the difficulty internal auditors face in acquiring or maintaining the depth and breadth of specialized skills due to the high cost associated in investing in the skills required. Another drawback is the lack of flexibility to accommodate the increasing demands from oversight bodies to provide control assurance on certain areas due to the lack of resources available.
In an Internal Audit Co-sourcing model, management retains control over the internal audit function while at the same time leveraging the internal audit resources of the third party service provider, which provides access to valuable and diverse specialised skills as needed. The organization will have access to leading practices as well as the Intellectual Capital of world-class Internal Auditors resulting in a higher return on investment. A co-sourcing model is usually accompanied by a knowledge transfer framework through which the inhouse internal audit skills and expertise are augmented by the knowledge and leading practices introduced by the third party service provider.
One of the key deficiencies of the Internal Audit Co-sourcing model is that it requires continuous coordination from the organization to ensure seamless delivery of the internal audit services, as the responsibility of managing the internal audit function remains with the organization. Also, continuous investment in the in-house internal audit department is required with respect to training, recruitment and the technology used.
The key benefit of a fully outsourced internal audit service model is that the service provider is ultimately responsible for the internal audit function; management direction is limited but still required. The organization has the ability to request proficient and qualified staff with core competencies from the service provider in the pursuit of adding value to the organization. The service provider bears the investment costs for training, tools, technology and the Intellectual Capital required and internal auditors are able to maintain financial independence.
The main drawback of this option is that expertise does not reside in-house and accordingly, there is an evident limitation on the ability to transfer knowledge and build the capabilities of the internal audit function within the organization.
Selection criteria of service providers
Organisations should set the specific criteria for the selection of the internal audit service providers that will form the basis of the organization’s sourcing selection strategy. Individual criteria will not have equal importance thus requiring organisations to apply respective weights based on their vision of the organization’s internal audit function.
Diagram 1 presents the key sourcing options criteria organizations should consider when assessing respective sourcing options.
When considering different sourcing options, organizations must consider which model best addresses their organization’s needs. As with all strategies, there is no “one size fits all” solution, and the aforementioned sourcing option criteria only provides organizations with a starting point on what key issues need to be analyzed, as these will need to be tailored depending on the organization’s requirements. The underlying principle guiding organizations to re-evaluate their internal audit functions is the need to enhance the value that internal auditors provide, and the fact that the internal audit function is increasingly becoming an advisor to the business and an example of leading practices.
Download a pdf copy of this article