Outsourcing Your Internal Audit Function May Be a Viable Proposition

According to The Institute of Internal Auditors, “internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.”


Today, you can outsource almost everything. Including your internal audit function. There are two scenarios you may want to consider here, outsourcing and co-sourcing. With pure outsourcing you’re looking at a comprehensive service, where the entire function is performed by the service provider with a focus on risk. With co-sourcing, some sharing occurs. Usually you would employ this service if you need assistance with, say, non-routine  engagements that could require deeper and more profound experience and expertise.


Through outsourcing your internal audit function, you will benefit from a number of otherwise hard to get results. Your organization stands to be evaluated in a more independent and unrestricted manner, thus management will receive more objective and unbiased assistance and advice. You will also benefit from a new level of assurance and coverage of risks and will probably be able to reduce costs in the short and in the long run as well. If you want to align organizational governance with risk and compliance and be able to proactively identify and manage emerging risks, then you  may want to consider outsourcing. Last, but not least, you may be able to free up some of your people to other, more important tasks.


Outsourcing is always good for situations when a broader skills set and deeper industry specialization is needed. You could receive additional  intellectual capital that will give you insights and recommendations on leading practices though access to leading-edge tools and methodologies. All of these will effectively transfer new knowledge and build new capabilities into your company.


There’s quite a debate over the pros and cons of outsourcing Internal Audit function. The concerns are mainly derived from the risk, responsibility and reliability issues connected with the choice of external consultants. And that’s exactly how it should be. A good team would address these concerns by giving you and fulfilling a checklist of things to demand from an outsourced internal audit service arrangement where:


  • All objectives are clearly defined
  • The scope of the service will be transparent
  • Th expertise level needed will be properly identified
  • You would be able to review and agree on the performance metrics
  • Together you will be able to plan for and establish who does what for remediation and follow up
  • You get assistance to create your own quality assurance and improvement programs
  • Define clear rules for deliverables, i.e. the work papers when the service terminates
  • You are in control to limit, if applicable, on work we your vendor may do for your competitors


With the right people, methodologies, and technologies, the process and the professionals involved in the outsourcing should represent a true and objective alternative to an in-house solution. Through a business approach and cost-efficiency, the service company you hire should become your partner in risk for your business.


A typical outsourced internal audit project will have five phases:





  • Selection – organization-wide or pre-selected area/project risk assessment to define audit surface and objective
  • Planning – gather relevant information, stipulate chain of command/reporting and draft plan with scope and timing
  • Execution – fieldwork commences, with regular status meetings to discuss observations, potential findings, and recommendations
  • Reporting – communicate draft and final report of findings, conclusions, and recommendations
  • Follow-Up – on findings and approved remediation action plans; and re-audit where applicable


The costs for an outsourced internal audit service will depend on the size, project complexity and the industry sector of your company. Based on an initial and ongoing assessment, the vendor should provide flexible, tailored pricing to achieve and maintain internal audit standards.

The service ideology should be based on affordability with a maximized value-for-money approach. Depending on your company’s needs for internal audit involvement, the complexity of one-time or ongoing projects, you should look for a vendor that will devise the most cost-effective plan to make sure your business model is adequately protected.