Internal audit is in a state of transformation. In the insurance industry specifically, disruptions are growing bigger, developing faster, and requiring responses that are more quick and fluid. According to the Institute of Internal Audit’s 2018 North American Pulse of Internal Audit, transformation of internal audit is the only acceptable solution. To address these changes and disruptions, chief audit executives (CAE) need to act as internal disruptors who challenge the status quo, identify and focus on emerging risks, develop innovative strategies and form an agile approach that is supported by the right talent, either internally or by a third-party.
Because internal audit has continued to innovate and push the boundaries beyond the typical “check the box” exercise, several companies are beginning, or continuing, to seek outside assistance from qualified firms to supplement or fulfill their internal audit function. Some key reasons are lack of technical expertise (e.g., data analytics, regulatory compliance, information technology vulnerability, security and penetration audit expertise), the ability to attract and retain talent and the desire for sector insight that one gains by outsourcing or co-sourcing their internal audit function. Although seeking out an internal audit partner appears to be a simple task, there are many components to the selection process. Outlined below is a clear process to successfully develop a request for proposal (RFP) for internal audit services:
The first critical step in the RFP process is to identify the needs of your organization. To get started, below are a few questions to ask yourself when beginning the process of sourcing for an internal audit firm:
These are some of the critical questions that need to be answered in order to determine the overall scope, from a company perspective, that you are looking for when receiving RFP submissions.
After the scope has been defined, it is critical to determine what further services you will request of the firm, which can be inclusive of the following:
Services identified as significant or that are a requirement of the firm responding, in addition to the general internal audit functions, should be included in the RFP. These services should also be specifically outlined to ensure that the firm is able, and comfortable, to meet all requirements needed from your company.
Once the scope and additional required services have been outlined, it is critical to determine the information you are trying to ascertain as part of the RFP process. In general, the information that needs to be obtained revolves around the following themes:
The list above provides the overarching themes often included in an RFP. Although it is not often included in the initial RFP process, management should consider scheduling, with the top three to four candidates, an in-person meeting with key members of management to ensure the firm is an appropriate fit for the company.
When determining which firms to include in the RFP process, there are a few key areas to consider:
The value and expertise of the chosen firm will be the key to success for your internal audit department. If outsourcing, the firm will serve as the primary point of contact throughout the company. Therefore, it is important the firm aligns with your corporate culture. Although budget is a key consideration, it is an important note that fees and travel expenses are always negotiable. Generally, it is recommended to submit the RFP to all key potential candidates that fit with the culture, expertise and value of your company.
The final item to consider in the RFP development process is the overall timeline and who will be responsible for addressing questions, clarifications, etc. from prospective firms. The timeline should also be based on when the company expects the internal audit to be fully functional (i.e., onsite meeting with business owners for the initial risk assessment, start of fieldwork, etc.). In addition to outlining the timeline for the prospective firm, the expected start date of services should be listed within the RFP to allow a sufficient amount of time to allocate resources to your company.
Do not under estimate the value of in-person meetings of the selected finalist, including the assigned engagement managers and experienced staff to be present. A firm’s ability to showcase a dedicated team with experience in a proposal, as well as in-person, is crucial since these individuals will serve as your firm’s day-to-day internal audit function and represent the work performed.
Please see below for an outline of an expected RFP timeframe with the expectation that the internal audit department is functional by Jan. 1, 20XX:
By breaking out the RFP process into smaller steps, the search for a third party internal audit firm may become a straight-forward process. The critical points to remember are to establish the services your company is looking for, requirements of the firm, criteria you are looking to evaluate, specific firms you want to include in the RFP process, and the overall RFP timeline.
For more information on this topic, or to learn how Baker Tilly’s insurance industry internal audit specialists can assist your organization, contact our team.