Like snowflakes and Pokémon, every audit is unique. Some of them come and go like the briefest of winter flurries while others are an arduous, life-draining exercise in perseverance like an episode of anime. No matter your preferred metaphor, the point your friends here at Embark are trying to make is this – every audit in every organization has a distinct and specific set of goals and criteria it is trying to accomplish.

Of course, given the shape-shifting nature of the internal audit – sometimes a harmless and brief nuisance, other times a carrier of pestilence and anxiety attacks – there are a handful of different outsourcing methods available to best cater to your organization's singular internal audit needs.

To use a practical example, SOX testing occurs in Q3 and at year's end, obviously not requiring a full year's worth of work. This can present certain challenges as the work is difficult and requires a very specific skill set, automatically eliminating many choices simply due to that needed specificity.

Given our SOX example, what is the best solution for a company faced with this particular situation? As usual, there's no single answer since it depends on the unique demands of every individual company. Audit committees will always have particular goals, ranging from simple and straightforward SOX compliance to more probing audits that are looking for areas of improvement as well.

Likewise, the costs of different audit outsourcing methods can also vary widely between different companies based on variables like company size and geographical layout. Smaller organizations typically don't require prolonged audit procedures, usually able to complete testing within three months, so bringing on a full-time auditor doesn't make sense.

For larger, more global companies, finding an individual consulting group who can efficiently spread an audit team across multiple countries or even continents presents its own unique challenges. In other words, a bit of due diligence into the different methods for outsourcing internal audit needs can be extremely helpful in finding the best solution set for your individual company.

Option 1: Full Outsourcing

This method of internal audit outsourcing relies on an outside team to handle all of an organization’s auditing needs, taking a laissez-faire approach from management’s perspective.

Benefits:

• Management can keep a healthy, productive distance from SOX compliance procedures, not getting caught up in managing the day-to-day tasks, milestones, or constantly dealing with the auditors
• Outside consultants will possess the most immediate and relevant insight and skills due to repetition and extreme familiarity with auditing process and procedures
• Overhead is minimized since a full-time IA isn’t needed for non-peak seasons
• Minimizes risk by assuring a company has covered all necessary steps
• Company will have access to industry-leading tools, thought leadership, and best practices
• Allows employees to focus on their daily responsibilities

Drawbacks:

• Can still be relatively costly but typically not as much as hiring a full-time IA
• Outside team will lack the intimate knowledge of your company that a year-round auditor would possess
• Consultants will initially lack relationships with your people, particularly process and control owners

Option 2: Co-Sourcing

Co-sourcing involves bringing in outside help to work with your Chief Audit Executive (CAE) or IA Manager and handle testing, documentation of process walkthroughs, controls, and flowcharts as well as building out your control matrix and risk assessment. This method of internal audit outsourcing can represent the best option for a company wanting to control costs but still rely on specialized knowledge and skill for the IA process.

Benefits:

• Co-sourcing with an outside firm each audit means you reap many of the benefits of complete outsourcing, while also having someone that’s very knowledgeable about your company (typically a Director of Internal Audit) serving as a familiar face to an audit committee
• Can manage relationship with the auditors
• Helps a company stay lean during non-peak seasons while still providing inside expertise to a business for the IA process. As mentioned previously, outside consultants possess immediate and relevant insight and skills due to repetition and familiarity with auditing process and procedures.
• Company will still have access to industry-leading tools, thought leadership, and best practices

Drawbacks:

• Testing is performed by an outside team that still lacks the intimate knowledge of your company that year-round positions provide
• Costs will include consultant fees as well as the salary for a Chief Audit Executive or IA Manager

Option 3: Internal

Building an in-house IA team might not be the most cost efficient method to employ but certainly has its own unique benefits.

Benefits:

• No consulting costs
• Consistent, intimate, and historical knowledge of the business
• Stable, productive relationships with process and control owners
• Resources are already in place when an audit committee or management requires additional projects beyond SOX

Drawbacks:

• Communication with auditors is limited to audit season, not year-round
• Costs can be higher due to full-time salaries
• Limited work for internal auditors during non-peak seasons
• Additional time and resources are required to manage a team
• Higher headcount can also raise HR expenses
• Can be challenging to find a good IA or build out a solid, reliable IA team
• If someone was to leave the IA team, overtime increases for other team members, possibly impacting overall employee satisfaction

Option 4: Staff Augmentation Through Consulting and Training

Augmenting the skill set and knowledge base of a team, especially in regards to the Information Produced by Entity (IPE) and Information Used in Control (IUC) focal points, allows management review controls and develops a testing approach and templates so that teams understand the necessary processes and procedures before taking the reins. This method also develops the requisite testing procedures necessary for the audit process.

Benefits:

• Helps teams establish a sound foundation since consultants work with them on best practices and new developments in the IA landscape. Consultants’ familiarity with the environment can be an invaluable source of knowledge and feedback.
• Teams have initial assistance to avoid becoming bogged down during while addressing internal audit focal points
• Lowest consulting costs of the different methods
• Very beneficial if testing procedures are all that’s required

Drawbacks:

• Creates the highest costs in full-time staff
• Challenging to keep the team busy during non-peak season
• Requires active, ongoing management of the team
• Greater headcount means higher accompanying HR efforts and costs
• Like the internal method, can be challenging to find a good IA or build out a solid, reliable IA team

Every organization has different goals and requirements in their internal auditing process. While we understand that we sometimes sound like a broken record, Embark can’t help but give you some familiar advice when it comes to choosing a method for internal audit outsourcing your internal audit: be methodical in your approach, take the time to understand your specific needs and budget, and choose the method that suits your company best.