According to The Institute of Internal Auditors,
internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.
OUTSOURCING?
Today, you can outsource almost everything. Including your internal audit function. There are two scenarios you may want to consider here, outsourcing and co-sourcing. With pure outsourcing, you’re looking at a comprehensive service, where the entire function is performed by the service provider with a focus on risk. With co-sourcing, some sharing occurs. Usually, you would employ this service if you need assistance with, say, non-routine engagements that could require deeper and more profound experience and expertise.
Through outsourcing your internal audit function, you benefit from a number of otherwise hard-to-get results. Your organization stands to be evaluated in a more independent and unrestricted manner, thus management will receive more objective and unbiased assistance and advice. You will also benefit from a new level of assurance and coverage of risks and will probably be able to reduce costs in the short and in the long run as well. If you want to align organizational governance with risk and compliance and be able to proactively identify and manage emerging risks, then you may want to consider outsourcing. Last, but not least, you may be able to free up some of your people to other, more important tasks.
KNOWLEDGE TRANSFER
Outsourcing is always good for situations when a broader skill set and deeper industry specialization are needed. You could receive additional intellectual capital that will give you insights and recommendations on leading practices through access to leading-edge tools and methodologies. All of these will effectively transfer new knowledge and build new capabilities into your company.
IS INTERNAL AUDIT OUTSOURCING NECESSARY?
There’s quite a debate over the pros and cons of outsourcing the Internal Audit function. The concerns are mainly derived from the risk, responsibility, and reliability issues connected with the choice of external consultants. And that’s exactly how it should be. A good team would address these concerns by giving you and fulfilling a checklist of things to demand from an outsourced internal audit service arrangement where:
- All objectives are clearly defined;
- The scope of the service will be transparent;
- The expertise level needed will be properly identified;
- You would be able to review and agree on the performance metrics;
- Together you will be able to plan for and establish who does what for remediation and follow up;
- You get assistance to create your own quality assurance and improvement programs;
- Define clear rules for deliverables, i.e. the work papers when the service terminates;
- You are in control to limit, if applicable, the work your vendor may do for your competitors.
With the right people, methodologies, and technologies, the process and the professionals involved in the outsourcing should represent a true and objective alternative to an in-house solution. Through a business approach and cost-efficiency, the service company you hire should become your partner in risk for your business.
THE PROCESS
A typical outsourced internal audit project will have five phases:
- Selection – organization-wide or pre-selected area/project risk assessment to define audit surface and objective;
- Planning – gather relevant information, stipulate chain of command/reporting, and draft plan with scope and timing;
- Execution – fieldwork commences, with regular status meetings to discuss observations, potential findings, and recommendations;
- Reporting – communicate draft and final report of findings, conclusions, and recommendations;
- Follow-Up – on findings and approved remediation action plans; and re-audit where applicable.
WHAT TO LOOK FOR IN TERMS OF PRICING
The costs for an outsourced internal audit service will depend on the size, project complexity, and the industry sector of your company. Based on an initial and ongoing assessment, the vendor should provide flexible, tailored pricing to achieve and maintain internal audit standards.
The service ideology should be based on affordability with a maximized value-for-money approach. Depending on your company’s needs for internal audit involvement, and the complexity of one-time or ongoing projects, you should look for a vendor that will devise the most cost-effective plan to make sure your business model is adequately protected.