10 Best Practices for Co-Sourcing Internal Audit

As internal audit departments rebalance their work to focus less on financial topics and more on operational and strategic risks, many audit executives are looking again at the option of calling on outside expertise for assignments that they can't cover with their current staff. It's a viable option, but one that's not without risks, says Dave Richards, president of The Institute of Internal Auditors (IIA).

One issue that often confronts the co-sourcing strategy is the availability of the expertise. "With the marketplace being what it is, a truly good auditor on a specific technical topic is going to be in high demand," Richards points out. "No matter what the firm is that might try to sell you on that -- and they may have a leading expert in the field in their firm -- that individual may not be available to you because of other commitments."

And getting access to the specialist auditor may be an even bigger problem if you don't happen to be located in a major business market.

In any internal audit co-sourcing arrangement it's important to ensure that knowledge transfer takes place "so that there can be retention internally on the topic as a reference point for the organization in future uses of that information -- whether it's revising a procedure, revising a policy, revising a process, or whatever else that may result from the fact that you've done the audit," says Richards.

"If you don't have that knowledge resident internally, then you're going to have to go out and buy it again. And will the person who did the audit be available to you some time afterwards, when you're not actually asking them to do an audit but to consult?"

As major consumers of the internal audit department's services, CFOs should have input in any decision that might affect the quality of that service, Richards notes. But "it's the audit committee of the board that should be the prime driver in making decisions about staffing, how big the internal audit department should be, where it's going, and what kind of things it should do, in conjunction with the CEO of the organization."

It's worth taking some time to make sure you choose the right service provider. "Some firms are motivated by a profit margin and getting as much work done as they can, as quickly as possible," says Richards. "Others are more relationship-management oriented; they're looking at how they use the assignment in the long term to help build a relationship for future assignments." You might want to look for a firm with a history of success in similar assignments in your industry.

Here are the The IIA's 10 steps to effective co-sourcing of internal auditing:

1. The CAE carefully assesses the audit plan and staff capabilities to identify gaps. The audit committee also reviews and assesses the appropriateness and expertise of the resources as part of the annual audit plan.

2. The CAE matches skill sets of existing staff with audits called for in the plan, ensuring that each staff member understands assignments.

3. The CAE issues an RFP for a co-sourcing contract that will directly address the missing skills. The contract should be for three years, to ensure enough time and opportunity to build relationships, trust, and consistency.

4. The CAE chooses a provider based on reputation, references, experience, and "chemistry." Before making a final decision, the CAE should review and sign off on the resumes of each member of the team, identifying and addressing any red flags. The provider should be a good cultural match and should demonstrate an understanding of and a commitment to the organization's goals and objectives. Where material, the audit committee reviews and approves the appointment.

5. The provider has a dual reporting relationship to a senior firm partner and to the CAE at the organization.

6. The CAE ensures that all audits are performed in conformance with the International Standards for the Professional Practice of Internal Auditing (Standards).

7. Following each audit, the provider presents to the CAE a client survey report as to professionalism and performance.

8. All working papers should be retained by the CAE, not the provider.

9. The CAE evaluates the outsourced group's performance on a yearly basis.

10. The audit committee monitors the effectiveness of the co-sourced arrangement.

Read The Institute of Internal Auditors' press release here.