Internal audit outsourcing - How could it work for you

Outsourcing of internal audit (IA) activities is a decision that an organization may face when dynamic market conditions require it to focus on core business functions and leverage on the expertise of service providers to perform support services and other non-core activities. When faced with that decision, business leaders should consider the following pros and cons:

The Pros

Increased independent assurance.

Increased assurance of independence and objectivity is the primary driver for outsourcing internal audit activities. For critical engagements with results affecting the performance evaluation of people in the organization, e.g., fraud audits or business process reviews, outsourced internal auditors are in the best position to provide objective results because they are not reporting administratively within the organization. Thus, the risk of familiarity and intimidation threats affecting internal audit independence is reduced.

Bang for your buck. Another value proposition of internal audit service providers is the ability to provide the organization with qualified and highly-trained personnel without the costs associated with hiring and maintaining them in the company. The service providers have access to best-in-class practices across industries as they combine expertise acquired from their various clients. Service providers are also exposed to the latest advances in technology and often have access to comprehensive knowledge bases that in-house internal audit operations do not have.

The cost of hiring, training, and certifying auditors, along with the benefits due them and staff retention programs typically amount to 35 to 45 percent of salary rates. These costs are avoided when an organization opts to outsource. In addition, service providers that specialize in internal audit outsourcing perform more efficiently due to experience and expertise.

The Cons

Brain drain. Although organizations benefit from the specialized skills, best-in-class practices, and reduced costs associated with outsourced internal audit, the organization may be exposed to risk of diminishing operational knowledge and institutional memory. Internal audit is one area where organizational milestones and key management decisions are monitored and evaluated. It is also one avenue for developing talent internally by exposing employees to different aspects of the company’s operations. To mitigate this risk, key people in the organization should be updated and involved in internal audit activities. This will ensure that the people are apprised of the latest concepts in effective internal control practices and will also increase their sense of ownership for controls under their accountability. Throughout the outsourcing of internal audit activities, the organization and the provider should draw up an agreed-upon documentation protocol to chronicle all the key takeaways in the course of the engagement.

Moral hazards. While outsourcing’s primary boon is enabling the organization to focus on core activities, moral hazards may arise. Process and control owners may tend to transfer the responsibility of implementing positive quality management changes to the outsourced internal auditors. As such, key personnel should be actively involved and invested in ensuring that recommended changes are successfully effected. Through continuous monitoring and review of the internal audit activity within the organization, it is ensured that the outsourced internal audit function is directed towards value creation.

Governance is yours

Although outsourcing poses some challenges, it can be an effective strategy to allow an organization to focus on core activities while benefiting from the expertise of a service provider. It must be remembered, however, that while an organization can outsource some aspects of its operations, oversight and ultimate responsibility cannot be passed on to others. Should an organization decide to outsource its internal audit functions, its oversight and governance bodies must actively participate in the planning, monitoring, and review of internal audit activities. Management should also take ownership of the execution of controls and mitigation of business risks.

Deanna Kaye Mallari CPA is an Associate Consultant with the Advisory Services Division of Punongbayan & Araullo.

Executive Brief – November 2012

Punongbayan and Araullo