How to optimize value from an Internal Audit co-sourcing partnership

Today’s internal audit teams are expected to deliver more value, faster, in a wider range of disciplines than ever before. Yet with shrinking budgets and the need for subject matter expertise, many are struggling to deliver agile, multi-disciplinary advisory and assurance insights to address the emerging risks driven by social and technological change.

Where it used to make sense to bring bench strength in-house, that’s often no longer the case. Co-sourcing the internal audit function is fast becoming the most prudent and cost-effective approach. Following are some best practices to optimize the value of co-sourcing your internal audit function.

A new and changing world requires a new mindset

Today’s business environment is changing rapidly, and rapidly re-defining where, how, and by what measure internal audit delivers value. Finance and assurance audits are now only one means of delivering value — internal audit needs to deliver on-demand insight across a broad range of audit and advisory considerations. The chief audit executive (CAE) in particular is expected to not only be a trusted advisor but anticipate future risk related to strategy.

Internal audit teams must recognize and understand how diverse issues from privacy and cyber risks, to emerging technologies, economic headwinds, disruptive pressures from current and potential competitors impact their business. They must be prepared to mobilize at a moment’s notice to deliver increasingly complex analyses on a range of scenarios and support organizational leaders make informed and highly consequential decisions.

Few organizations can afford such a compliment of multidisciplinary expertise without external support. This brave new world of rapid innovation, automation, and economic uncertainty has fueled the demand and need for co-sourcing and services and will continue to do so in the years ahead.

Reframing the employee/service provider relationship

Trust and timely communication are fundamental to the success of a co-sourcing relationship. The right partner will certainly augment an in-house team’s strengths and skillsets. But even more, they should function as an extension of the CAE themselves — anticipating their needs, understanding the innerworkings and idiosyncrasies of the business, and ready to deliver insights on demand.      

Co-sourcing should optimize value

MNP often recommends our clients visualize the co-sourcing model as a value triangle — with internal audit on one corner, and the audit committee / management and co-source partner on the other two respectively. Everyone brings something to the relationship that adds strength and rigidity; but only if all the points connect and continuously interact.

In our experience, most gaps in the value triangle tend to follow predictable patterns. Thankfully, that means they’re also quite easy to address once you know what they are and what to look out for. Following are some of the most common reasons co-source relationships fall short and steps you can take to cement all three corners of your own value triangle.

Recruit a co-source partner that compliments your internal audit strategy and culture

Upon deciding to co-source, many audit executives instinctively proceed to tender a request for proposal and select the lowest cost vendor. However, absent a clear internal audit strategy, this approach may not deliver the results you need.  

Define the capabilities and insight you need to deliver your internal audit strategy and plan: Create a prioritized list of gaps your co-source partner needs to fill, then determine how frequently you will depend on the co-source partner for support. In many cases you will require continuous interaction with your co-source partner, including attendance at audit committee and management meetings.

With these requirements in mind, look for a service provider whose values and style align with yours — but who can also address priority areas, offset current weaknesses, and help you get the most from every dollar you spend.

Co-Source resources should intimately understand your business and internal audit strategy

When you have more work than time it can be tempting to delegate third-party resources to clean up the tasks that have fallen through the cracks. However, resources that lack an understanding of your business, and clarity on the scope and value proposition of the engagement, are unlikely to complete the task in an agile and cost-effective manner.   

Clearly define roles, responsibilities, and expectations from the outset: Roadmap your plan and engagements with your co-sourcing partner beforehand. Gain alignment on your needs and objectives. Understand where your co-source partner can add the most value, then find the intersection between these variables to design a project charter that defines clear roles, responsibilities, and deliverables. This will help keep everyone on task and the engagements on budget.

Also make sure to clarify if there will be a budget for ongoing support over and above the engagements — such as assisting with risk assessment and planning, communication with the audit committee or management, and assisting with audit committee reports.

Take advantage of third-party objectivity

Co-source partners are uniquely positioned to deliver incremental insight and challenge your team when needed. Acknowledge the existence of institutional blind spots and embrace the opportunity for a clear-headed perspective on key risks and controls. A fresh set of eyes is bound to see things differently than you do — and that’s a good thing.

Co-source partners should understand your industry and community

A third-party business partner should be able to hit the ground running right away. Time and money you spend educating a co-source partner on your industry, culture, risks, opportunities, and regulatory framework can add up quickly.

Use service providers who understand your needs: Ask prospective vendors for industry- or region-specific insights during the proposal / procurement process. The right co-sourcing partner must speak your language, be aware of existing and emerging trends, and contribute specific expertise to advance your internal audit objectives.

The audit committee should know and trust co-source partner

Effective internal audits require complete trust, transparency, and unfettered access to people, information, and systems. The internal audit team should introduce the audit committee chair and co-source partner and provide an opportunity to ask questions and to clarify expectations.

Set clear boundaries between the co-source partner, internal audit, and the audit committee: Create a transparent and collaborative environment that keeps all stakeholders on the same page and working toward shared objectives. Include program partners in conversations with the audit committee — but agree on clear ground rules for when, how, and in what context communication takes place.

Ensure both co-source partner and internal audit are maintaining their independence

Independence will be sacrificed when an individual audits a control or risk mitigation they created. It is therefore important to continuously ensure no conflicts exist before any work is completed — especially when co-source partners turn over or begin a new engagement.

Co-source partners should help manage expectations and document all assumptions:

High value internal audit functions know it is critical to manage the expectations of the Audit Committee and management. It is also important to document assumptions made in statements of work and audit or advisory reports. The right co-source partner should be just as diligent in this regard.

Overcommunicate: Get on the same page about the audit plan, objectives, tactics, methodologies, and reporting processes early in the engagement. The left hand should always know what the right hand is doing and vice versa.

Expect different interpretations of the best way forward and be willing to hear and embrace differing points of view. A leading practice is for the co-source partner and internal audit team to hold a debrief after large audits to determine what worked well and where there may be opportunity for improvement.

Face the pressure together

Co-sourcing models are a key advantage in today’s environment of rapid change and disruption. Internal audit functions that once gained influence from size and scale alone are fast making way for those that can deliver value more quickly, precisely, and comprehensively. The question is not whether to consider third-party relationships in your internal audit function — but how to get the most from those relationships.

A strong and robust value triangle is essential for internal audit teams to extract value from increasingly limited budgets and a vastly expanding risk landscape. Value comes not from who can stand tallest or shine brightest — but when the internal audit team, co-source partner, and audit committee / management, each has something uniquely valuable to offer and understands how to reinforce the others. It’s these points of connection that make one another indispensable and ultimately strengthen the organization as a whole.

To learn more, contact Richard Arthurs, FCPA, FCMA, MBA, CFE, CIA, CRMA, QIAL, National Leader, Internal Audit at 587.702.5978 or [email protected]