Who Should Perform an Internal Audit?

An internal audit is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization achieve its objectives by systematically evaluating and improving the effectiveness of risk management, internal control, and governance processes. This function operates independently from the activities it evaluates, typically reporting to the board of directors, often through an audit committee.

Internal Audit Staffing Models

Organizations have several primary approaches to staffing their internal audit function, each with distinct characteristics regarding who performs the audit. These models include maintaining an in-house team, fully outsourcing the function, or utilizing a co-sourcing arrangement. The choice among these models dictates the structure and direct management of the audit activities within the organization.

An in-house internal audit function involves dedicated employees who are part of the organization’s staff. These internal auditors work full-time within the company, providing continuous oversight and an intimate understanding of the organization’s culture, systems, and processes. This model typically features a structured department with a Chief Audit Executive (CAE) overseeing the team, which can range in size depending on the organization’s scale.

Outsourced internal audit involves engaging an external service provider, such as an independent accounting firm, to perform the entire internal audit function. This model is often chosen when an organization lacks the internal resources or specialized expertise to conduct comprehensive audits. The external firm operates independently, providing an outside perspective on the organization’s processes and controls.

The co-sourced internal audit model represents a hybrid approach, combining the organization’s internal audit team with external expertise. Co-sourcing allows organizations to supplement their internal capabilities with specialized skills or additional resources, particularly during peak periods or for specific projects. This collaborative structure ensures the internal audit function remains aligned with organizational goals while benefiting from external insights.

Key Factors for Deciding on a Staffing Model

The decision regarding an internal audit staffing model is influenced by several organizational factors, each pointing towards a suitable approach. These considerations help tailor the internal audit function to the specific needs and circumstances of the entity.

Organizational Size and Complexity

Organizational size and complexity significantly shape the choice of an internal audit staffing model. Larger organizations, particularly those with diverse operations or multiple subsidiaries, often find an in-house or co-sourced model more practical due to the continuous need for comprehensive oversight and deep institutional knowledge. Smaller entities, or those with less intricate structures, might lean towards outsourcing, as maintaining a full-time internal audit department could be resource-intensive.

Need for Specific Expertise

The need for specific expertise also plays a substantial role in this decision. Organizations requiring highly specialized knowledge, such as in IT audit, cybersecurity, or particular regulatory compliance areas, may find it challenging to retain all necessary skills within an in-house team. In such cases, co-sourcing or outsourcing provides access to external professionals with niche capabilities that might be too costly or difficult to maintain internally. This allows the organization to leverage expert knowledge for complex or emerging risks without a permanent hiring commitment.

Financial Considerations

Financial considerations influence whether an organization opts for a fixed cost associated with internal employees or a variable cost linked to external services. An in-house team involves consistent expenses like salaries, benefits, and training, which are relatively fixed. Outsourcing or co-sourcing can offer a more flexible cost structure, as services can be budgeted on a yearly, hourly, or project basis, allowing the organization to pay only for the services needed. This flexibility can be particularly appealing for organizations with fluctuating audit demands or limited dedicated funding.

Maintaining Objectivity

Maintaining objectivity is a fundamental aspect of any internal audit function. While an in-house team strives for independence by reporting to the audit committee, potential familiarity with internal operations can present challenges to complete impartiality. Outsourced providers inherently offer an external, unbiased perspective, as they are not part of the organization’s internal politics or relationships. Co-sourcing can balance these aspects by combining internal knowledge with the fresh perspective of external auditors, potentially enhancing the overall objectivity of audit findings.

Availability of Internal Resources

The availability of internal resources and management’s focus on core business operations also directs the staffing model choice. Organizations with limited internal capacity or a desire to allocate management bandwidth primarily to their core activities may find outsourcing appealing. This approach allows the business to delegate audit tasks to external specialists, freeing up internal personnel. Conversely, if an organization has sufficient internal talent and wishes to develop its employees, an in-house or co-sourced model can serve as a pipeline for leadership development and skill enhancement.