Board briefing: Outsourcing and the role of internal audit
Our new report outlines a number of approaches in the private and public sectors to managing the risks associated with supplier relationships, including the practices of internal audit functions.
As part of the report we learned about the approach towards auditing contracts taken by the BBC, EDF Energy, Crossrail, Ministry of Justice and the Home Office.
Download the board briefing (pdf)
Key points
- Outsourcing the service does not outsource the risk, including financial and operational risks but especially reputational risk.
- Internal audit can support boards in relation to outsourced services but there needs to be an appetite for assurance of outsourced services at board level.
- If outsourced services are of strategic importance then they should feature on internal audit plans.
- The precise role, timing and extent of internal audit’s involvement will depend on: the perceived risk it presents to the organisation; the board’s risk appetite; and the cost and complexity of the outsourced service.
- Internal audit has a key role to play, especially in strategic intent and feasibility of outsourcing, implementation and management of the supplier selection process and contract management.
Internal audit can support boards in relation to outsourced services.
There should be an appetite at board and senior management level for assurance that the risks of outsourcing are being managed so that the organisation’s achievement of its strategic objectives is not compromised. If outsourced services are of strategic importance then they should feature on internal audit plans.
Over time, assuring outsourced projects is likely to become a regular feature of internal audits in all sectors. The precise role, timing and extent of internal audit’s involvement will depend on: the perceived risk it presents to the organisation; the board’s risk appetite; and the cost and complexity of the outsourced service.
