“Managing Outsourced Internal Audits”

-Sourcing decision-

Internal Audit & other Corporate Services

Is there a difference between “Outsourcing” the

other Corporate functions & Internal Audit?

ie. Outsourcing,

Accounting activity (Say Payroll, Bills processing etc.) (or)

Fixed Deposit System (or)

Share registry work etc.

&

Outsourcing the “Internal Audit” work?

IIA’s Perspective

What is so unique about IA that it should be exempt from the

outsourcing decision?

“Internal Auditing is an unique effort that is aligned with the

Management of the organisation and overall Corporate

Governance”

“Internal Auditors who are engaged full-time in an enterprise can assimilate the organisational culture and use this cultural awareness to understand risks and potential strategic outcomes. By being continually involved in business processes, they understand the inter-relationships that can impact the control environment”.

“They (IA) have a vested interest in the long run

success of the business. Internally housed IA

functions can draw staff expertise from the many

facets of the Business to provide independent

reviews of operations.”

“IA is best performed by an independent entity that

is an integral part of the organisation which

functions under the policies established by senior

management & the Board of directors” , fully

resourced & Professionally competent.

IIA’s Perspective...

At the Same time,

“Recent studies and new developments in services

provided by external entities challenge

management, audit committees and existing Internal

Audit departments to carefully examine alternatives

to the ‘traditional internal auditing’ function.

IIA’s Perspective...

Fundamental Position

….. that internal auditing is designed to serve the

organisation. Therefore it is the responsibility of

Management and the audit committee to provide

effective oversight and management of the function -

whether it is housed internally or provided by an

outside service provider.

IIA’s Perspective...

IIA’s Principal Interest

“Promote IA activities that provide maximum overall

effectiveness in achieving the organisation’s

strategic objectives”.

Situation Specific

Some basic Questions

“Audit Management” outsourcing or “Audit Assignment”

outsourcing?

“Audit Skills” outsourcing or “Audit Manpower” outsourcing?

Outsourcing or Co-sourcing?

Objective “Cost Effectiveness” or “Quality Improvement”?

Some more basic Questions...

Is there a full time internal Executive - Auditor in place or audits

co-ordinated by a part time Executive?

Is the entire work outsourced (or) part of it also done by internal

team?

What is the level of the Head of Audit / Audit Co-ordinator ?

Is the audit responsibility lies with the Finance Head / Company

Secretary etc ., who have other primary responsibilities?

Situation Specific...

Size of the organisation

[Large Corporates]

Can afford full time internal team

Function would have been there for longer years

Need for strengthening the internal function to serve the

growing organisation better. (Internal Consultant role)

Staff- Competent / trained

Will posses experience / insight needed to deliver high

quality service

Best Practices for specific industries

[Medium / Small size Companies]

Company cannot afford Senior level Audit professional -

full time

Required skills may not be available internally

Would be cost effective if outsourced

Flexibility

Easier to tailor audit services to meet clients needs

Offer best potential for a long term relationship (Comparatively less expensive)

Size of the organisation...

Takes many forms

Purchase of specialised audit services

Purchase of services in a specific geographic location

Full outsourcing of IA department

Outside providers entering into partnering agreements

with internal auditing department in performing audit

services.

“Cost” perspective of Internal Audit

Trend……..

Business Divisions / Profit centres looking at audit

service Cost as an allocated overhead and from the

perspective of whether the “traffic can bear” - Not a

healthy sign

Need for defining ‘negotiables’ and non-negotiables

to audit customers

Arguments in favour of outsourcing

Allows management to focus on core competencies

Economies of scale should result in cost savings for

the

same services, or improved services for the same

costs.

Flexibility in staffing leads to better resource

allocation.

Access to leading best practices / Outsiders can add

fresh

perspective

A clear customer focus

Better international and cultural coverage

Arguments in favour of outsourcing…

Better access to and use of specialised skills

(Availability

of varied Audit Skills - readily)

Eg., Information systems audit skills

Pairing in house auditors with service partners can

broaden

the auditors’ knowledge & skills

Easier to remove an outsourced auditor than

employees

Will enable meet customer’s urgent & unexpected

requirement

Overtime, outsourcing providers may command an

ever-

greater premium for their services

An external provider won’t know the business as well

as

an Internal Auditing Department

A valuable management Training ground is lost.

The outsourcing employee’s allegiance is to the

outsourcing provider, not the client

Arguments in favour of in house - sourcing

‘Corporate Governance’ is a Management Function

that

cannot be outsourced

- Corporate Governance

- Internal Controls

- Internal Audit

Independence of the External Auditor may be

impaired

when the outsourcing provider is also the External

Auditor (The SARBANES - OXLEY ACT of 2002)

Arguments in favour of in house - sourcing...

Management and the Audit Committee lose an objective

source of information (ie. IA)

Institutional knowledge may be lost

Structure may replace internal knowledge (eg: risk

analysis approach - may not fit a particular

organisational climate)

New / first time service providers may not deliver what we

want

In house staff may resent the assignment of a service partner to a

project that they believe they can perform.[ high profile project]

Arguments in favour of in house - sourcing...

Successful Outsourcing

PLANNING, MANAGEMENT , EXECUTION

Criteria based selection of Service Providers

Evaluation of Audit Team effectiveness / audit outcomes

Feed back from Auditees / changes in IA system

Audit learnings / Knowledge management effectiveness

Confidentiality agreement

Proper Vendor Selection & Evaluation System

Have a Strategic Alliance !

Successful Outsourcing

Clarity in defining the Scope of audit

Adequate pre-audit briefing.

Usage of Tools

Close monitoring of audit execution at the site

Internal Audit Co-ordinators & their effective role

Effective participation by the Audit Project Owner

(IA Team) in closing meetings

Source Identification - A Practical Approach

INTERNAL

Guest Auditors Pool

Specialised skills within the organisation pooled together

Executives drawn from different disciplines of the organisation

Proactive Executives keen to learn & develop themselves join the Internal Audit Team for a shorter duration as Guest Auditors

Working arrangement - Corporate Service Teams

Internal Technology Cells

Process Safety Cells

Energy Conservation Teams

TQM Centres

Safety Management Cells

BPR teams etc.,

• Big Fours ( Force ? )

• Medium Sized Audit firms ?

• Young skilled Professionals ( owning growing Internal Audit Firms ) who could directly involve in field work ?

EXTERNAL

Achieve effective co sourcing

Combine expertise of a service partner with

the cultural perspective of internal auditing

Enhance value by expanding scope of audit

coverage

Gain access to specialized skills that

internal auditing could not justify

developing and maintainng in house

Subject matter experts required in many cases

Insurance specialists for an Insurance Management Audit

A fraud investigator / forensic expert for alleged fraud situation

Civil Engineers while doing Building Contract Audits

Security Experts when doing Data Centre Security Audit

A Marketing Expert for conducting Marketing Department Audits etc.,

Criteria for selection

Projects & Skill set of service provider match

Fitting into the organisation’s culture

Single service provider may not have all the

skills

required to meet the diverse needs of Internal

Audit.

Partnership with Audit Customers

Involving audit customers in the selection

process

Understanding & communicating the deliverables

expected

Effective Contracts

Clearly communicating the Projects Scope,

key

deliverables & expected standards &

performance.

Reporting requirement (Report reinforces the

outcomes of audit)

Format and delivery date

Billing format & frequency

(Arrangement should be combination of price,

deliverability, reliability & dependability)

Managing the Engagement

(Some practical tips)

Effective Project Management skills required for

keeping

the project on track.

Responsibility & Accountability for Project

Management

should be clear (Audit Project Owner drives)

Manage the first day of the project effectively (It

can

make or break it!)

Managing the Engagement

(Some practical tips)

Discuss Corporate Vision, Mission, Values &

Principles

Audit Philosophy / Policies / Procedures /

Methodology &

Performance Standards

Reiterate scope of audit

Review performance standards / project

deliverables

Introduce the service partner to the rest of the

Audit Team

Managing the Engagement

(Some practical tips)

Familiarise them with Internal communication

system /

Business Applications, Audit Tools used & Audit

work

paper system in vogue etc.

Above all, keep giving early ‘feedback’ regarding

the

service partner’s performance (Deal with issues

effectively)

Terms of outsourcing should be clear to all

Managing the Engagement

(Some practical tips)

Scope should be clearly understood and rules for

changing them should be spelt out.

Weekly progress reports should include key

performance

indicators

(Eg: Lumpsum contract – No cutting into the scope!

Manday rates – monitoring the time spent!)

Address all risks

Poor planning / Bad contract / ineffective

management!

Interview the Audit Team to gain an understanding

of the

Qualifications / role each will play

Get the Resumes & experience of Team Members

Do reference check in case of first time

engagements

Address all risks

Substituting a lesser qualified staff in the place of

a

high flier (who might have left for greener

postures!)

Should not ‘sell’ other products during the

performance of a project

To conclude….

“A properly sized IA function with the ability to employ

outside service providers, as needed, may be more

economical, efficient, effective and responsive to

organisation needs”

“When Internal Auditors collaborate with experts outside

the audit department , it can be a winning proposition for all

involved”

THEN, THIS WILL BECOME A WIN WIN CO SOURCING!

THANK YOU