Internal audit functions across industries are at a crossroads. At a time of increasing financial pressures, regulatory scrutiny and stakeholder expectations, organizations rely on internal audit to help assess and mitigate emerging risks across a wide spectrum of critical and time-sensitive strategic, financial and operational elements. Internal audit practitioners are expected to help their organizations manage risks as wide-reaching as financial controls, cybersecurity, talent management and fraud. At the same time, as we recover from the pandemic, internal audit shops are faced with turnover driven by an increasingly flexible and mobile workforce.
Compounding all this, internal audit is expected to work smarter, faster and harder by embracing agile auditing, leveraging data analytics and integrating with enterprise risk management (ERM) and compliance functions. The pressure to be effective, efficient, knowledgeable and collaborative change agents has never been greater.
Finding the right internal audit partner to provide co-sourced or outsourced support can help both your organization to manage this time of change and your internal audit function to serve as a trusted and valuable member of leadership. Consider the following key successes that can be driven by a strong third-party internal audit relationship:
Challenge No. 1: Your audit committee expects expertise in an ever-widening list of topics.
Solution: A co-sourced or outsourced internal audit partner brings a multitude of skillsets and deep expertise to the table. A firm well-versed in your industry’s particular risks can help you see over the horizon to address emerging risks (such as the following) and meet the expectations of your most sophisticated leaders:
Further, in co-sourcing arrangements your team members can join integrated project teams to gain firsthand understanding of complex technical topics, learning priceless knowledge that can be leveraged for the next project, while allowing for career progression and exploration.
Challenge No. 2: Your internal audit function has faced recent turnover, leaving you with open positions and skills gaps.
Solution: Co-sourcing can provide you with fully equipped teams to seamlessly perform audits on a standalone basis, or the ability to supplement your existing teams with the specific levels of professionals you might be missing. A third-party internal audit partner allows you to quickly staff up or down to meet the changing needs of your organization, which is especially critical in an agile environment. The right partner will include professionals ranging from recent college graduates to seasoned professionals with 30 years of experience, allowing any gaps to be filled with the right resource. And in a high turnover environment (think The Great Resignation), an effectively managed outsourced or co-sourced relationship can actually lead to greater retention of organizational knowledge.
The flip side to the recent shift towards remote work is that it is easier than ever to leverage the unique knowledge and skills of a third-party partner regardless of geographic location. Many engagement activities can now be completed successfully in a virtual environment.
Challenge No. 3: Your organization has limited funding budgeted for an internal audit function.
Solution: Outsourcing or co-sourcing internal audit services can provide exceptional value. Internal audit activities performed by a partner firm can be budgeted on a yearly, hourly or project basis, ensuring that your organization only pays for the services it needs. In contrast, with a fully in-house internal audit function, your organization must fund a consistent level of salaries, benefits, training and nonproductive time, as well as technology and infrastructure costs related to employees. An outsourced or co-sourced model allows the internal audit budget to expand or contract over time as budgets and relative risk priorities shift, enabling a more agile approach to internal auditing. In addition, in an increasingly remote environment, organizations have been able to decrease the travel costs often associated with using a partner firm; rather, onsite work can be thoughtfully agreed upon considering the relative costs and benefits.
Challenge No. 4: Your leadership wants internal audit to bring a competitive edge to its strategy and operations.
Solution: An internal audit partner operates in a variety of organizations, including your competitors, peers and aspirational peers, and can therefore provide industry-leading perspectives to help you:
Challenge No. 5: Your audit committee expects an objective perspective for certain internal audit activities.
Solution: An outsourced or co-sourced internal audit partner comes to the table with a fresh perspective, untainted by organizational politics, history or relationships with stakeholders. The right partner can help invigorate the risk assessment and risk-based audit planning processes, handle investigations with sensitivity and independence and perform diplomatic advisory work requiring buy-in from multiple stakeholders.
Challenge No. 6: Major initiatives and changes have stalled with leadership.
Solution: An internal audit partner can serve as a thought leader to help to move forward ideas that have stalled, whether it is implementing a new system, exploring ERM or rethinking your internal controls structure. Your internal audit partner can help you understand and explore cutting edge changes, as well as educate your stakeholders on the possibilities and impacts of change; these professionals have often explained major past projects in whitepapers and industry presentations that can be leveraged to gain buy-in across your organization. An internal audit partner doesn’t need to be afraid of pushback, so it can bring fresh and exciting new thoughts to the table. The sky is the limit!
Internal audit co-sourcing and outsourcing relationships can vary along a spectrum, with each model delivering certain common successes and challenges. Some of the most typical models are outlined below along with key considerations which may work best at your organization:
Hear firsthand from our industry-specialized professionals how internal audit co-sourcing and outsourcing can benefit organizations across industries.
Financial services organizations face complex regulatory compliance requirements while many are also undergoing rapid digital and organizational transformation. Leveraging an internal audit partner allows these organizations to shift priorities and scale up/down on resource needs to ensure both required and strategic audits are completed effectively.
Government contractors not only need to understand traditional risk areas, but they must also be able to grasp the nuances of contract-specific technical requirements. Due to the rigor around contract compliance and the ever-changing regulatory environment, it can be a challenge for contractors to keep up with the technical nature of certain requirements (e.g., cybersecurity risk, Cybersecurity Maturity Model Certification (CMMC), ISO certifications). An outsourced internal audit model provides government contractors with the flexibility to add, shift or focus resources in these critical areas.
The healthcare landscape continues to experience change at an accelerated rate and successful leaders are committed to being innovative and nimble. Healthcare organizations need to bring in experts who can provide unique insight into strategic undertakings including leading practices and trends across the healthcare industry, exposure to other environments and access to ad hoc expertise, especially in technical areas where subject matter experts are not needed in-house on a continual basis.
Colleges and universities operate like small cities, with an increasing broad regulatory burden and potential reputational impacts. Partnering with a co-sourced or outsourced provider allows access to specialty knowledge and industry leading practices in emerging risk areas including cybersecurity, sponsored research and student safety and well-being.
Many manufacturing organizations work globally and partnering with a firm that can offer world-wide reach for internal audit services allows internal audit to offer both subject matter and local business custom and language knowledge and capability across the world.
Co-sourcing or outsourcing internal audit allows an organization to leverage leading practices from many portfolio companies under a PE fund and demonstrate to the organization how these practices can benefit other companies.
Co-sourcing or outsourcing allows government entities to increase the appearance of independence with audit functions, avoid political or policy matters that may be out of scope, and improve the audit committee or governing body’s reliance on audit results as these bodies may be more trusting of an external point of view.
Utilizing co-sourced or outsourced providers allows REITS to minimize overhead costs while simultaneously allowing access to technical specialists in topics such as construction and development, cybersecurity, information technology and other areas that the REIT would not have access to with a standalone audit department.
An organization’s internal audit function is key to ensuring that strategic risks are appropriately managed and mitigated. The combination of external forces (a complex regulatory environment, rapidly evolving technology, increasing cyber threats and uncertainty brought about by events like the COVID-19 pandemic) and internal forces (increasing demands from organization leaders and skill gaps, for example) should compel leaders to investigate working with a co-sourced or outsourced internal audit partner. These partners can not only help make today’s increasing challenges solvable, but can help internal audit to add value across a wide spectrum of risks, operate more efficiently and better partner with leadership in supporting the organization’s success.
For more information or help choosing the right sourcing model for your organization, contact our industry-specialized internal audit professionals.