Sourcing the internal audit function – finding the right ‘fit’

The internal audit organization of every company is moving beyond their traditional role. Often construed as an in-house “police,” internal auditors are increasingly becoming involved in various company initiatives that go beyond compliance and encompass activities that create business value.

Nowadays, the challenge for most companies is setting up an internal audit organization that has the capability and flexibility to respond to the diverse business and regulatory environment. An effective internal audit function requires a diverse set of skills by resources that many companies find difficult to source and retain – resources that are available to service providers such as the Big Four firms and where internal audit sourcing comes into play.

What are the options?

A white paper on internal audit sourcing written by KPMG enumerated the following forms of internal audit sourcing:

- Internal hiring, wherein resources within the company are pooled and trained to become part of the internal audit organization.

Internal resources are assumed to have better understanding of the company’s operations and areas that are deemed to be given audit priority. This sourcing option is often selected by companies to give their valued employees an opportunity to explore various verticals of the organization and prepare them for future management roles.

However, management will need to invest on time and money to train internal resources to achieve the capability and flexibility in auditing new and complex areas. There is also a tendency to impair independence as internal resources may become too comfortable with a particular area due to familiarity or relationships within an auditable unit. In these cases, there is a great chance that audit results will be communicated in a biased manner. It is important that in these scenarios, profiles of internal audit resources are carefully analyzed to better align audit assignments with their credentials and relationships within the organization.

- Co-sourcing, wherein a service provider is contracted to assist the core internal audit team (resources within the organization) with certain audit activities.

In this type of sourcing option, the company will be able to tap subject matter professionals who have the technical skills, industry experiences, methodologies and tools that the core internal audit team will need time to develop. The audit committee will also have a certain level of confidence when difficult issues are raised in a different perspective, most especially by a service provider who is trusted to get the job done right. Cost-wise, the core internal audit team can control cost by involving the service provider only to those audit areas that are deemed needed.

The most important concept of this sourcing option is that the core internal audit team will still be in-control of all audit activities and will be mainly responsible in reporting to the audit committee. Of course, the success of each audit activity will depend on the level of coordination exerted by both teams and the core internal audit team should make sure that there are regular meetings to discuss progress, challenges and issues encountered during the audit. The core internal audit team should also ensure knowledge transfer, including retention of work papers, from the service provider.

- Outsourcing, wherein the entire internal audit function is outsourced to a service provider who directly reports to the audit committee for progress and results of audit activities. In this type of sourcing option, the service provider will undergo a rigorous selection process from the audit committee since the internal audit function will be their sole responsibility.

As we know, an internal audit function is a cost center to every organization. Engaging a reputed service provider will get the audit committee jumping on their seats when fees are discussed as the rate of one resource from a reputed service provider will be relatively higher as compared to hiring an internal auditor. However, in a different perspective, several costs are saved since there is no in-house internal audit group maintained by the company. Costs savings include internal auditors’ salaries, benefits, trainings, and infrastructure related expenses such as office space and computers. There should also be regular evaluations of the service provider’s performance such that, money well spent will be money well earned.

The right ‘fit’

When strategizing for a sourcing option, each company should consider the complexity of operations, resources available (people, methodologies, budget), company culture and business priorities through a careful thought process to determine which sourcing option is the right “fit”.

The right “fit” will be the sourcing option wherein resources are optimized, knowledge base is developed and retained, independence is least impaired, there is sure audit continuity, and most of all, will help the company improve the value derived from internal audit.

The next step, finding the right service provider.

Naomi May M. Convento is a manager from the advisory group of Manabat Sanagustin & Co. (MS&Co.), the Philippine member firm of KPMG International.

This article is for general information purposes only and should not be considered as professional advice to a specific issue or entity.

The view and opinions expressed herein are those of the author and do not necessarily represent the views and opinions of KPMG International or MS&Co. For comments or inquiries, please email [email protected] or [email protected]