By Mark Stephenson, KnowledgeLeader contributing writer
In the pre-SOX world, the idealized view of a traditional IA department was a fully in-sourced staff. The world, however, has changed and so has the legislation. As companies are growing more global, it is becoming more challenging to have an in-house department employing the skills needed to address all the internal audit needs of the enterprise. For most chief audit executives in today’s increasingly demanding compliance environment, the difference between what is ideal and what is affordable or practical is a gulf that is ever widening.
A growing number of organizations are responding to the increasing demands placed on their internal function by co-sourcing with outside providers. Distinct and separate from the functions performed by external auditors, co-source internal audit providers can be valuable partners both in bridging day-to-day capacity needs as well as performing highly specialized auditing duties on an as-needed basis. The fact that internal audit co-sourcing is expanding rapidly is testimony to the growing governance and compliance pressures facing chief audit executives today.
Different models for different needs
Co-sourcing models can range from internal audit functions that are almost entirely in-sourced and only rarely require external assistance, to others that may be almost completely outsourced. In practice, most co-sourcing arrangements involve situations where the largest percentage of internal audit services is provided by the in-house function, supplemented by external, and often specialized, resources.
“There are two primary reasons why an in-house internal audit function might co-source,” says Paul Marshall, Protiviti managing director, UK. “The internal function may need to temporarily beef up its generalist skills to compensate for a shortfall in headcount. The other motivation is the need to access short-term specialized skills not required on a permanent basis and that would be inefficient to staff on that basis.”
Among all industry segments, large banks and financial institutions are the entities that come closest to having fully staffed, self-sufficient internal departments. One of Marshall’s clients, a leading global bank headquartered in the UK, boasts an internal audit department with a staff of several hundred people. Despite such a robust in-house capability, the client periodically needs to call on specialized financial and IT internal audit skills.
"You have to remember that, while the big banks and financial institutions have huge internal audit departments, 80 percent of all corporate internal audit departments have 20 auditors or less," says Carmen Rossiter, Protiviti managing director, Canada. "If those companies need to perform specialized security, IT or other audits, it is simply not practical to have those resources on staff all the time. The answer is simple—you supplement with special resources with the competencies you need."
Expanding regulatory demands
The increasing need for internal audit services is largely being driven, in part, by the expanding range of regulatory and compliance pressures. For example, U.S. companies that judged in-house internal audit resources to be adequate prior to Sarbanes-Oxley soon discovered that additional help was required to meet the compliance deadlines of the law.
“The impact of Sarbanes-Oxley and similar legislation around the world is driving the need for additional, general services, and to a lesser extent the need for highly specialized skills,” Marshall says. “For the most part, complying with Sarbanes-Oxley was more of a volume question than the need to access special expertise."
With the rapid internationalization of business, the trend toward heightened regulatory scrutiny is being exported to other parts of the globe. One example is Japan’s recently enacted Financial Instruments Exchange Law, also known as J-SOX given that the goals are similar to the U.S. Sarbanes-Oxley Act. However, unlike its U.S. counterpart, which featured staggered implementation dates for larger and smaller organizations, J-SOX requires the compliance of all companies, size notwithstanding, as of April 2008. As expected, Japanese companies have dramatically increased the demand for internal audit resources.
“Japan’s financial companies have long been ahead of the game in the internal audit area,” says Yasumi Taniguchi, Protiviti managing director, Japan. “They have consistently had strict rules to follow and are accustomed to much tighter scrutiny. But many of our manufacturing companies are lagging because they did not make large investments in internal audit during 10 years of economic slowdown. Now, as these companies become more global, they face a much greater need for internal auditing resources."
Taniguchi notes that the increasing internationalization of many companies is adding fuel to the fire, increasing the demand for internal audit services. In turn, companies seek ways to cope with the compliance challenges of new subsidiaries, joint ventures, licensees and suppliers, as well as meeting the needs of new and far-flung customers.
“In the past, the overseas locations of many Japanese companies were mainly small sales operations or simple manufacturing,” Taniguchi says. “However, as more companies have acquired more extensive operations overseas due to mergers and acquisitions around the globe, their operations have become bigger and the need for local internal audit resources has grown.”
Taniguchi says that co-sourcing abroad benefits companies by providing access to local expertise, knowledge and language skills that would be virtually impossible to develop internally within a reasonable timeframe.
“Using local co-source providers gives you the advantage of utilizing internal auditors who know the local language and business customs and who can provide specific industry knowledge, such as the IT skills that may be required in a particular country,” Taniguchi adds.
Many rewards and manageable risks
The rewards of co-sourcing are many. If there are risks, what are they and how can they be managed or mitigated? Start at the beginning of the relationship.
“When choosing a co-source partner, you need to make sure you are selecting one that will be a good fit with your business culture and structure," says Rossiter. "It is important to set clear and measurable goals. You need to make sure that the co-source provider knows what is expected and also knows something about your industry, with the ability to access the additional resources that may be needed, depending on how the project unfolds.”
From the outset, a smooth, productive relationship also requires the company’s internal audit function to view the co-source provider as a strategic partner. The company should be including the co-sourcer’s staff in meetings and continuously looking for value-adding and improvement opportunities. The expectations and accountabilities of both parties must be clearly defined, communicated and measured.
"You need to engage a co-source provider that will work with you on a plan and discuss all of the potential risks openly and honestly," Taniguchi says. "Once you have decided what the parameters of the relationship will be, the co-source provider should do only what has been agreed to in the initial plan."
It is also important to choose an external provider that has had relevant experience in the same business segment or similar industries so that the vendor will be aware of relevant regulatory requirements.
"One of the key success factors to remember is that effective co-sourcing is all about the people," says Marshall. "Employ the right people with the right skills and the right personalities so that there is a cultural fit between the co-source provider and the in-house department."
Sharing knowledge and new perspectives
Ultimately, one of the most enduring benefits of internal audit co-sourcing is the potential for knowledge transfer from the co-source vendor to the internal function, including the sharing of resources, tools, methods and frameworks.
"Co-sourcing offers many benefits," Taniguchi says. "It gives you great flexibility to respond to special situations or demands. The partnering of in-house auditors with co-source specialists also brings new knowledge and insights into the company that can benefit the in-house function and entire organization for years to come."
Download the entire article:
(3 pages , 31 KB)
Internal Audit Co-sourcing Relationship Poll