Buying in resources to supplement internal audit skill sets
A blog by our EQA review team | 13 October 2017
We’ve seen massive growth in recent years in buying in resources to supplement internal audit skill sets, as audit committees demand more from their internal audit teams, irrespective of size. Professional services firms have identified this opportunity and now provide more flexibility to help out internal audit teams with a broad range of subject matter expertise.
For years, this has primarily been in IT audit but today’s menu extends to the realms of cyber security, treasury, actuarial, modelling, project management, risk management, regulation, governance, culture, conduct, marketing, data analytics and even human resources.
Some internal audit teams also establish co-source partnerships with professional firms to build consistency of approach and ensure continuity of relationships. This can also help provide expert or industry input to audit committee reporting and to the annual risk assessment and planning process.
Of course there are pitfalls; team members may worry this could lead to a full outsource, which needs to be handled sensitively by the head of internal audit, who should see him or herself as leading a wider ’team’. Blending subject matter expertise with team members’ own insight of their organisation can often develop a more pragmatic solution to address issues which have arisen as well as buying benefits such as training, sharing of methodology and tools, access to peer comparison and benchmarking.
More fundamentally, how do you maintain knowledge of (and be able to follow-up) key areas if that knowledge disappears? Knowledge retention should be built into the planning process, as should issues such as working paper standards and ownership, confidentiality agreements and access to data. Reports should always be in the internal audit team’s style and must be signed off and owned by the head of internal audit. Heads of internal audit must take charge of the relationship to ensure that the co-source/outsource arrangement delivers what it is supposed to.
Some of the things that heads of internal audit should consider before they engage a firm to work on their behalf include:
- What are the long and short-term objectives for internal audit within the organisation?
- Is speed a factor when engaging a third-party provider?
- What specialist skills/experience is required?
- How important is continuity of knowledge and getting the same people back to do the same pieces of audit work for every engagement?
- What additional benefits can be gained from the relationship, beyond access to resources and skills for specific audits?
Find out more about our EQA services
