Co-Sourcing and Outsourcing Audit Functions
Guide to using external resources for internal audit including models, vendor selection, and quality oversight.
Co-Sourcing and Outsourcing Internal Audit
Sourcing Models
In-House
- Full internal team
- Maximum control
- Institutional knowledge
- Higher fixed costs
Co-Sourcing
- Internal team + external specialists
- Flexible capacity
- Access to expertise
- Balanced approach
Outsourcing
- External provider manages function
- Lower fixed costs
- Less institutional knowledge
- Independence considerations
When to Co-Source/Outsource
Expertise Gaps
- IT audit
- Specialized areas (cyber, data privacy)
- Regulatory expertise
- Technical skills
Capacity Needs
- Peak demand periods
- Special projects
- Staff vacancies
- Geographic coverage
Cost Optimization
- Variable vs. fixed costs
- Efficiency gains
- Benchmark pricing
Selecting a Provider
Evaluation Criteria
- Industry expertise
- Technical capabilities
- Geographic presence
- Quality assurance program
- References
- Cultural fit
Due Diligence
- Review qualifications
- Check references
- Assess conflicts
- Evaluate team
- Understand pricing model
Contracting
- Scope of services
- Service levels
- Pricing and billing
- Term and termination
- Confidentiality
- Independence
Managing the Relationship
Governance
- Clear ownership (CAE)
- Regular communication
- Performance reviews
- Issue escalation
Quality Oversight
- Review deliverables
- Assess methodology
- Provide feedback
- Monitor satisfaction
Knowledge Transfer
- Documentation requirements
- Transition planning
- Institutional knowledge
- Succession considerations
IIA Standards Considerations
Standard 2070
- Reliance on external providers
- CAE responsibility
- Quality assurance
Independence
- Auditor independence
- Rotation policies
- Conflict management
Best Practices
- Clear scope definition
- Strong project management
- Knowledge sharing
- Relationship building
- Performance metrics
- Regular reviews
- Transition planning