Many aspects of business organizations today are challenged to do more with less, and the internal audit activity is no exception. As executive management and boards are increasingly recognizing the criticality of managing risks throughout their organizations, they are expecting more of their internal auditors than ever before.
Many chief audit executives must confront the possibility of outsourcing some of their work to ensure that everything with which they are tasked is completed in a timely and competent manner. Whether the risks be operational, strategic, financial, or reputation-, technology- or compliance-oriented, they can put an organization's very survival at stake. And savvy CAEs must be ready and able to assess and report on them all, regardless of the size and expertise of their staff.
A viable option for coverage is called co-sourcing. This practice presents a CAE with a broad range of outside capabilities to supplement in-house talent. Because internal auditing by nature is internal and integral to the organization, it is absolutely critical that the in-house CAE manages all aspects of the co-sourced arrangement, and that there be no conflicts of interest with the organization's provider of external auditing.
Providers considered for internal co-sourcing must be independent of the organization's external auditors. Also, the arrangement must ensure that the CAE continues to report to executive management and the audit committee on all activities, regardless of sourcing.
After the size of the internal audit function is benchmarked against that of similar organizations, the CAE should consult with senior management and the audit committee to determine the most cost-effective mix of in-house and outsourced internal audit staffing.
The IIA recommends the following 10 steps to effective co-sourcing:
1. The CAE carefully assesses the audit plan and staff capabilities to identify gaps. The audit committee also reviews and assesses the appropriateness and expertise of the resources as part of the annual audit plan.
2. The CAE matches the skill sets of existing staff with audits called for in the plan, ensuring that each staff member understands assignments.
3. The CAE issues a request for proposal for a co-sourcing contract that would directly address the missing skills. The contract should be for three years, to ensure enough time and opportunity to build relationships, trust and consistency.
4. The CAE chooses an outside provider based on reputation, references, experience and "chemistry." Before making a final decision, the CAE should review and sign off on the resumes of each member of the team, identifying and addressing any red flags.
The provider should be a good cultural match and should demonstrate an understanding of and a commitment to the organization's goals and objectives. Where material, the audit committee reviews and approves the appointment.
5. The provider has a dual reporting relationship to a senior firm partner and to the CAE at the organization.
6. The CAE ensures that all audits are performed in conformance with the International Standards for the Professional Practice of Internal Auditing.
7. Following each audit, the provider presents to the CAE a client survey report as to professionalism and performance.
8. All working papers should be retained by the CAE, not the provider.
9. The CAE evaluates the outsourced group's performance on a yearly basis.
10. The audit committee monitors the effectiveness of the co-sourced arrangement.
These comprise the most basic aspects of a co-sourced arrangement.
For more guidance on this topic, the IIA has published a position paper titled Resourcing Alternatives for the Internal Audit Function, and Practice Advisory 1210.A1-1: Obtaining Services to Support or Complement the Internal Audit Activity, both available for free download from the institute's Web site at www.theiia.org/guidance/standards-and-practices.
For more information, contact the IIA at guidance@theiia.org.
With 150,000 members in 165 countries, the Institute of Internal Auditors in Altamonte Springs, Fla., is an international professional organization that offers certification, education, research and technical guidance to internal auditors.
