Internal audit: understanding co-sourcing and outsourcing models
How a strategic internal audit partner can protect and enhance value at your organization
Internal audit in a time of transition
Internal audit functions across industries are at a crossroads. At a time of increasing financial pressures, regulatory scrutiny and stakeholder expectations, organizations rely on internal audit to help assess and mitigate emerging risks across a wide spectrum of critical and time-sensitive strategic, financial and operational elements. Internal audit practitioners are expected to help their organizations manage risks as wide-reaching as financial controls, cybersecurity, talent management and fraud. At the same time, internal audit shops are faced with turnover driven by an increasingly flexible and mobile workforce.
Compounding all this, internal audit is expected to work smarter, faster and harder by leveraging agile auditing, data analytics and integrating with enterprise risk management (ERM) and compliance functions, as well as embracing rapidly changing artificial intelligence. The pressure to be effective, efficient, knowledgeable and collaborative change agents has never been greater.
How a strategic internal audit partnership can address six common challenges
Finding the right internal audit partner to provide co-sourced or outsourced support can help both your organization to manage this time of continuous change and your internal audit function to serve as a trusted and valuable member of leadership. Consider the following key successes that can be driven by a strong third-party internal audit relationship:
Solution: A co-sourced or outsourced internal audit partner brings a multitude of skillsets and deep expertise to the table. A firm well-versed in your industry’s particular risks can help you see over the horizon to address emerging risks (such as the following) and meet the expectations of your most sophisticated leaders:
- Governance
- ERM
- Regulatory compliance (federal, state, local, industry-specific)
- Strategic budgeting and fiscal resiliency
- Fraud risks
- Cybersecurity
- Diversity, equity and inclusion
- Contracts and grants management
- Talent management
Further, in co-sourcing arrangements your team members can join integrated project teams to gain firsthand understanding of complex technical topics, learning priceless knowledge that can be leveraged for the next project, while allowing for career progression and exploration.
Solution: Co-sourcing can provide you with fully equipped teams to seamlessly perform audits on a standalone basis, or the ability to supplement your existing teams with the specific levels of professionals you might be missing. A third-party internal audit partner allows you to quickly staff up or down to meet the changing needs of your organization, which is especially critical in an agile environment. The right partner will include professionals ranging from recent college graduates to seasoned professionals with 30 years of experience, allowing any gaps to be filled with the right resource. And in a high turnover environment, an effectively managed outsourced or co-sourced relationship can actually lead to greater retention of organizational knowledge.
The flip side to the shift towards remote work is that it is easier than ever to leverage the unique knowledge and skills of a third-party partner regardless of geographic location. Many engagement activities can now be completed successfully in a virtual environment.
Solution: Outsourcing or co-sourcing internal audit services can provide exceptional value. Internal audit activities performed by a partner firm can be budgeted on a yearly, hourly or project basis, ensuring that your organization only pays for the services it needs. In contrast, with a fully in-house internal audit function, your organization must fund a consistent level of salaries, benefits, training and nonproductive time, as well as technology and infrastructure costs related to employees. An outsourced or co-sourced model allows the internal audit budget to expand or contract over time as budgets and relative risk priorities shift, enabling a more agile approach to internal auditing. In addition, in an increasingly remote environment, organizations have been able to decrease the travel costs often associated with using a partner firm; rather, onsite work can be thoughtfully agreed upon considering the relative costs and benefits.
Solution: An internal audit partner operates in a variety of organizations, including your competitors, peers and aspirational peers, and can therefore provide industry-leading perspectives to help you:
- Identify blind spots in your risk assessment and audit planning
- Maximize systems implementation and usage
- Implement effective monitoring and analytics practices
- Assess design of controls for reasonableness and efficiency
- Garner the support needed to invest in key enhancements
Solution: An outsourced or co-sourced internal audit partner comes to the table with a fresh perspective, untainted by organizational politics, history or relationships with stakeholders. The right partner can help invigorate the risk assessment and risk-based audit planning processes, handle investigations with sensitivity and independence and perform diplomatic advisory work requiring buy-in from multiple stakeholders.
Solution: An internal audit partner can serve as a thought leader to help to move forward ideas that have stalled, whether it is implementing a new system, exploring ERM or rethinking your internal controls structure. Your internal audit partner can help you understand and explore cutting edge changes – including artificial intelligence, as well as educate your stakeholders on the possibilities and impacts of change; these professionals have often explained major past projects in whitepapers and industry presentations that can be leveraged to gain buy-in across your organization. An internal audit partner doesn’t need to be afraid of pushback, so it can bring fresh and exciting new thoughts to the table. The sky is the limit!
Choosing the right co-sourcing or outsourcing model for your organization
Internal audit co-sourcing and outsourcing relationships can vary along a spectrum, with each model delivering certain common successes and challenges. Some of the most typical models are outlined below along with key considerations which may work best at your organization:
Fully outsourcing
| Success factors | Obstacles and implementation considerations |
|
|
Coordinated approach
Integration with leadership Ongoing, integrated co-sourcing
| Success factors | Obstacles and implementation considerations |
|
|
Staff augmentation co-sourcing
| Success factors | Obstacles and implementation considerations |
|
|
Subject matter expertise co-sourcing
| Success factors | Obstacles and implementation considerations |
|
|
Industry spotlight
Hear firsthand from our industry-specialized professionals how internal audit co-sourcing and outsourcing can benefit organizations across industries.
- Financial services
- Government contractors
- Healthcare
- Higher education
- Not-for-profits (NFPs)
- Manufacturing
- Private equity (PE)
- Public sector
- Real estate
- Technology
Financial services
Banking: The banking industry continues to deal with impacts to interest rate and liquidity concerns in addition to continued consolidation with mergers and acquisitions. Banks and credit unions are continuing to focus on digital transformation, improving customer experience through improved digital banking and payment capabilities. Increased utilization of data and models is also increasing the needs for modeling resources and model validations. Cybersecurity maturity is focus and continuing to ensure banks and credit unions are staying on top of the evolving cybersecurity landscape.
Insurance: Insurance organizations are navigating rapid changes in digital technology, customer experience enhancements, climate change impacts, cybersecurity, artificial intelligence considerations and organizational structure transformation. In addition, complex and ever-changing regulatory compliance requirements must be managed, and internal audit plays a pivotal role in providing assurance. Partnering with an internal audit provider with insurance expertise allows you to adapt to shifting priorities and adjust resource levels as needed, ensuring that both mandatory, emerging, operational and strategic audits are conducted efficiently and effectively.
Government contractors
Government contractors not only need to understand traditional risk areas, but they must also be able to grasp the nuances of contract-specific technical requirements and be agile to address emerging industry and regulatory requirements. Due to the rigor around contract compliance and the ever-changing regulatory environment, it can be a challenge for contractors to keep up with the technical nature of certain requirements (e.g., cybersecurity risk, Cybersecurity Maturity Model Certification (CMMC), artificial intelligence, ESG, ISO certifications). An outsourced internal audit model provides government contractors with the flexibility to add, shift or focus resources in these critical areas.
Healthcare
The healthcare landscape continues to experience change at an accelerated rate and successful leaders are committed to being innovative and nimble. Healthcare organizations need to bring in experts who can provide unique insight into strategic undertakings including leading practices and trends across the healthcare industry, exposure to other environments and access to ad hoc expertise, especially in technical areas where subject matter experts are not needed in-house on a continual basis.
Higher education
Colleges and universities operate like small cities, with increasing public scrutiny, enrollment-related fiscal challenges, a broad regulatory burden and numerous potential reputational challenges. Partnering with a co-sourced or outsourced provider allows access to specialty knowledge and industry leading practices in emerging risk areas including cybersecurity, sponsored research and student safety and well-being.
Not-for-profits (NFPs)
NFP organizations face a variety of internal and external pressures including the need to manage and steward funds from multiple funding sources, optimize resources and maintain compliance—all while effectively delivering on the organization’s mission. An NFP can benefit from the objective insights and oversight provided by an outsourced or co-sourced internal audit provider to help prioritize a multitude of risks in the most cost-effective manner, take advantage of peer and industry leading perspectives to gain efficiency, and protect its reputation as a good steward of donations and other funding. A strategic internal audit partner can provide financial, information technology, compliance and operational expertise, allowing the organization to focus on meeting the needs of those it serves.
Private equity (PE)
PE firms are facing increasing investor demands, higher levels of competition for portfolio companies and new levels of regulatory scrutiny. Co-sourcing or outsourcing internal audit provides PE firms with the flexibility required to effectively address emerging risk areas and evolving compliance matter through a variable resource model and real-time access to subject matter resources who can provide industry insights and actionable solutions to help the business manage organizational risks and solve business issues.
Public sector
Co-sourcing or outsourcing allows government entities to increase the appearance of independence with audit functions, avoid political or policy matters that may be out of scope, and improve the audit committee or governing body’s reliance on audit results as these bodies may be more trusting of an external point of view.
Real estate
The real estate industry has experienced significant change since the onset of the pandemic. Many owners are adjusting or reinventing their focus for the future to align with tenant and investor sentiment. With change comes an increase in new and emerging risk. Traditional in-house internal audit functions may not have the required subject matter specialists such as those with expertise in valuation, third-party risk, sustainability or advancements in technology that would be available in a co-sourced or outsourced internal audit model.
Technology
The technology industry has grown significantly. The advent of new tools and regulations puts the onus on the organizations to adequately address and mitigate risk. Internal audits can help the technology industry by maintaining the integrity of an organization's data and infrastructure. Internal audit teams can use technological advancements like artificial intelligence, data analytics, robotic process automation (RPA), and cloud computing to streamline audit processes, improve risk assessment and enhance decision-making.
An organization’s internal audit function is key to ensuring that strategic risks are appropriately managed and mitigated. The combination of external forces (a complex regulatory environment, rapidly evolving technology, increasing cyber threats and uncertainty brought about by international conflicts and geopolitical risks) and internal forces (increasing demands from organization leaders and skill gaps, for example) should compel leaders to investigate working with a co-sourced or outsourced internal audit partner. These partners can not only help make today’s increasing challenges solvable but can help internal audit to add value across a wide spectrum of risks, operate more efficiently and better partner with leadership in supporting the organization’s success.
For more information or help choosing the right sourcing model for your organization, contact our industry-specialized internal audit professionals.
Featured insights
Adapt and overcome: The evolving strategic role of internal audit
Boards and audit committees can enhance oversight with a more strategic internal audit function that can create and protect value.
Internal audit resources for higher education
Explore the value of internal audit for your higher education institution with Baker Tilly insights, case studies and other resources.
New IIA Global Internal Audit Standards: What you need to do in 2024
In this webinar, Baker Tilly's internal audit specialists help your organization prepare for the IIA's 2024 Global Internal Audit Standards.
The rise of proactive assurance, and why it’s here to stay
Through proactive assurance, internal audit can add immediate and tangible value to an organization.
