Internal Audit Outsourcing / Co-Source

Service description

Internal audit outsourcing hands all or part of a business's internal audit work to an outside firm. The firm builds a risk-based audit plan, tests controls and reports findings to management and the audit committee or board. In a co-source arrangement, the firm works alongside the business's own staff, filling gaps in time or expertise.

Common industries

Applies to businesses with a board, lenders or investors expecting independent review.

ROI

Program-grade internal audit without building the team; flexes with need and keeps the function independent of what it audits.

Benefit

Run your internal audit function on an outsourced or co-sourced basis — risk-based plans, controls testing, and reporting to the audit committee.

Why get it

An independent review of controls finds weaknesses before auditors, lenders or regulators do. Outsourcing provides the skills without building a full department.

When you benefit

Audits follow an annual plan, each review taking weeks, with findings followed up through the year.

What it costs

Typically an hourly fee.

When you pay

Providers usually bill hourly or per audit, scaled to scope and the staff level involved. Co-sourcing is often a set number of hours or a monthly retainer. Follow-up reviews are typically priced separately.

Other costs

Staff time to supply records and answer questions, and the cost of fixing the issues found.

Risks to know

An auditor who also designs or runs the controls it tests loses independence, so the firm should not perform management's work. Findings that are not acted on leave weaknesses open. Different rules may apply if the business is public or a regulated bank.

When risks arise

Independence concerns arise when the engagement is set up. Control weaknesses surface in the report, and unresolved ones tend to resurface at the next audit or review.

The process

The provider assesses risks and agrees an audit plan with management and the audit committee. It then tests controls, documents findings and presents reports with recommendations. The business assigns owners to fix issues, and the provider follows up on progress.

Your commitment

The business names a sponsor, usually in senior management or on the audit committee, and gives the provider access to records, systems and people. It should agree the audit scope and reporting lines in advance, and assign owners to fix each finding.

Documents to gather

• Org chart and descriptions of key processes
• Prior audit reports and findings
• Risk register or list of key controls
• Audit committee charter or reporting requirements

Helpful reading

• Internal Control — COSO
• Internal Audit | What is internal auditing? — The Institute of Internal Auditors
• What Are the Global Internal Audit Standards? — The Institute of Internal Auditors