ICAS ICAS logo

Quicklinks

  1. About Us

    Find out about who we are and what we do here at ICAS.

  2. Find a CA

    Search our directory of individual CAs and Member organisations by name, location and professional criteria.

  3. CA Magazine

    View the latest issues of the dedicated magazine for ICAS Chartered Accountants.

  4. Contact Us

    Get in touch with ICAS by phone, email or post, with dedicated contacts for Members, Students and firms.

Login
  • Annual renewal
  • About us
  • Contact us
  • Find a CA
  1. About us
    1. Governance
  2. Members
    1. Become a member
    2. Newly qualified
    3. Manage my membership
    4. Benefits of membership
    5. Careers support
    6. Mentoring
    7. CA Wellbeing
    8. More for Members
    9. Area networks
    10. International communities
    11. Get involved
    12. Top Young CAs
    13. Career breaks
    14. ICAS podcast
    15. Newly admitted members 2022
    16. Newly admitted members 2023
  3. CA Students
    1. Student information
    2. Student resources
    3. Learning requirements
    4. Learning updates
    5. Learning blog
    6. Totum Pro | Student discount card
    7. CA Student wellbeing
  4. Become a CA
    1. How to become a CA
    2. Routes to becoming a CA
    3. CA Stories
    4. Find a training agreement
    5. Why become a CA
    6. Qualification information
    7. University exemptions
  5. Employers
    1. Become an Authorised Training Office
    2. Resources for Authorised Training Offices
    3. Professional entry
    4. Apprenticeships
  6. Find a CA
  7. ICAS events
    1. CA Summit
  8. CA magazine
  9. Insight
    1. Finance + Trust
    2. Finance + Technology
    3. Finance + EDI
    4. Finance + Mental Fitness
    5. Finance + Leadership
    6. Finance + Sustainability
  10. Professional resources
    1. Anti-money laundering
    2. Audit and assurance
    3. Brexit
    4. Charities
    5. Coronavirus
    6. Corporate and financial reporting
    7. Business and governance
    8. Ethics
    9. Insolvency
    10. ICAS Research
    11. Pensions
    12. Practice
    13. Public sector
    14. Sustainability
    15. Tax
  11. CPD - professional development
    1. CPD courses and qualifications
    2. CPD news and updates
    3. CPD support and advice
  12. Regulation
    1. Complaints and sanctions
    2. Regulatory authorisations
    3. Guidance and help sheets
    4. Regulatory monitoring
  13. CA jobs
    1. CA jobs partner: Rutherford Cross
    2. Resources for your job search
    3. Advertise with CA jobs
    4. Hays | A Trusted ICAS CA Jobs Partner
    5. Azets | What's your ambition?
  14. Work at ICAS
    1. Business centres
    2. Meet our team
    3. Benefits
    4. Vacancies
    5. Imagine your career at ICAS
  15. Contact us
    1. Technical and regulation queries
    2. ICAS logo request

Internal audit: to outsource or not?

Photo of office ring binders
  • LinkedIn (opens new window)
  • Twitter (opens new window)
By Alan Simpson CA

12 September 2018

Key points:

  • More organisations now choose to outsource, either completely or partially, their internal audit function.
  • Internal audit outsourcing arrangements may take the form of full outsourcing; partial outsourcing; co-sourcing and subcontracting.
  • There are both benefits and drawbacks in outsourcing the internal audit function.

The following article describes the types of outsourcing arrangements often used and reviews the pros and cons of outsourcing internal audit.

Introduction

Traditionally, internal audit work was undertaken mainly by in-house teams. Through time this has changed and now many organisations outsource, either completely or partially, their internal audit function.

Modern internal audit functions need a broad range of skills to provide an effective and comprehensive service.

An organisation may employ only a small number of internal auditors, but their responsibilities can require expertise in a growing range of specialist skills such as IT audit; data mining; data analytics and, (depending on the type of industry and size of the organisation), in depth knowledge of different regulatory regimes. It can be difficult and expensive to recruit, retain and invest in those people with specialist skills.

To circumvent this difficulty, many organisations carry out some degree of outsourcing of the internal audit function.

Some smaller organisations, required by a regulatory agency or by funding covenant to have an internal audit function, may find that they want to outsource internal audit wholly to an external provider rather than incurring the cost burden of recruiting and training their own in-house internal audit section.

Types of internal audit outsourcing arrangements

Full outsourcing:where the entire function is carried out by an external provider, who would usually be a public accounting firm, but generally a different firm from the organisation’s external auditor.
Partial outsourcing:where less than 100% of the internal audit services are purchased from external sources.
Co-sourcing:where the work in carrying out the internal audit plan is shared between the core team of in-house internal auditors and an outside provider, who once again would generally be an accounting firm, and a different firm from that of the external auditor.

A need for this type of outsourcing can arise due a temporary shortage of internal audit staff coupled with the need to meet tight deadlines; special project work; difficulties perceived in recruiting suitably qualified internal auditors; coverage of remote business sites; skill shortages particularly those with experience of nascent or fast-moving technologies or for reviewing compliance with new pan-national regulatory regimes (e.g. GDPR or Sarbanes-Oxley).
Subcontracting:this is where a specific engagement or part of an engagement is undertaken by a third party, usually for a limited period.

The pros and cons of outsourcing internal audit v an in-house internal audit function


Some of the benefits of outsourcing the internal audit function include the following:

  • In a small internal audit section, some degree of outsourcing may be needed to provide the audit committee and board of directors (or equivalent) with overall adequate assurance, particularly in key risk areas requiring a high level of specialist technical expertise not available internally. This would especially apply in connection with fast-developing technologies where a small in-house section may not have adequate access to the continual (and probably expensive) training needed to maintain competence in and keep abreast of new developments.
  • Flexibility in staffing resources.
  • The organisation could gain from co-sourcing by having access to specialist expertise, innovations in the latest audit techniques and technology and the opportunity for bench-marking.
  • The perception that the independence of the internal auditor from management would be strengthened.
  • Depending upon the circumstances, it may provide greater value for money to outsource internal audit.
  • Some degree of outsourcing may help to revitalise a long - established internal audit function.

Some of the drawbacks of outsourcing the internal audit function include the following:

  • The challenge of effectively managing contracts and service level agreements with an external service provider.
  • Where internal audit is outsourced, at least to begin with, there will clearly be a lack of depth of internal knowledge and awareness of the culture of the organisation. There will be an inevitable acclimatisation period to get used to the organisation’s systems and processes.
  • How receptive will people be to an external service provider?
  • There is the risk of confusion over responsibility and accountability.
  • There is a risk to the credibility of the internal audit function if a serious lack of a cultural “fit” develops between the organisation and the provider of the outsourced service.
  • An unintended consequence is that by introducing an outside provider of internal audit services, the organisation loses some flexibility as it is tied into a per-agreed timetable and schedule.
  • It may prove to be costly and time-consuming if the board decides to bring the outsourced internal audit function back in house.
  • Internal audit is often used as a training ground for internal promotions. Depending upon the extent of outsourcing, the opportunities for this may disappear, or, at best, be significantly reduced if internal audit is outsourced.

Further points

It is important to emphasise that the oversight and responsibility for the internal audit function cannot be outsourced (per the Institute of Internal Auditors). The board, through the audit committee, is ultimately responsible for oversight of internal audit.

Consequently, there is a need for more formal documentation and channels of reporting and approval when a large part of the internal audit function is outsourced.

The working relationship between external audit and internal audit

By Alan Simpson CA

1 May 2018

The relationship between external audit and internal audit

By Alan Simpson CA

18 April 2018

2022-01-xero 2022-01-xero
ICAS logo

Footer links

  • Contact us
  • Terms and conditions
  • Modern slavery statement
  • Privacy notice
  • CA magazine

Connect with ICAS

  • Facebook (opens new window) Facebook Icon
  • Twitter (opens new window) Twitter Icon
  • LinkedIn (opens new window) LinkedIn Icon
  • Instagram (opens new window) Instagram Icon

ICAS is a member of the following bodies

  • Consultative Committee of Accountancy Bodies (opens new window) Consultative Committee of Accountancy Bodies logo
  • Chartered Accountants Worldwide (opens new window) Chartered Accountants Worldwide logo
  • Global Accounting Alliance (opens new window) Global Accounting Alliance
  • International Federation of Accountants (opens new window) IFAC
  • Access Accountancy (opens new window) Access Acountancy

Charities

  • ICAS Foundation (opens new window) ICAS Foundation
  • SCABA (opens new window) scaba

Accreditations

  • ISO 9001 - RGB (opens new window)
© ICAS 2022

The mark and designation “CA” is a registered trade mark of The Institute of Chartered Accountants of Scotland (ICAS), and is available for use in the UK and EU only to members of ICAS. If you are not a member of ICAS, you should not use the “CA” mark and designation in the UK or EU in relation to accountancy, tax or insolvency services. The mark and designation “Chartered Accountant” is a registered trade mark of ICAS, the Institute of Chartered Accountants of England and Wales and Chartered Accountants Ireland. If you are not a member of one of these organisations, you should not use the “Chartered Accountant” mark and designation in the UK or EU in relation to these services. Further restrictions on the use of these marks also apply where you are a member.

ICAS logo

Our cookie policy

ICAS.com uses cookies which are essential for our website to work. We would also like to use analytical cookies to help us improve our website and your user experience. Any data collected is anonymised. Please have a look at the further information in our cookie policy and confirm if you are happy for us to use analytical cookies: