The new auditing standards (published in January 2024) reiterate the possibility of using an independent external provider of internal auditing services in several forms: total outsourcing (subcontracting) or partial outsourcing (co-sourcing). Outsourcing can be justified in cases of insufficient human resources or lack of skills for auditing complex subjects, or when the objectivity of the internal audit is threatened.
Why outsource internal auditing?
- You do not have an internal audit department
Depending on the company's size, budget and circumstances (e.g., temporary replacement of the internal auditor), an internal audit professional may be used instead of a new recruit. In the case of a new department, the professional can put the tools and prerequisites in place (charter, audit manual, document templates, etc.) and make the company aware of the role of the internal auditor. He will carry out his assignments as if he were an internal auditor.
The advantage of employing a professional auditor in the absence of a dedicated audit manager is that the company is quickly equipped with the functions needed to control risks. Depending on the size of the company and the risks involved, it may not be necessary to recruit a full-time internal auditor. The outsourced internal auditor will work according to the audit plan defined at the start of the assignment, rather than on a permanent basis. This means you can optimize your budget with an experienced professional.
- You need support in carrying out internal audit assignments
In some cases, internal audit may not have sufficient resources to carry out assignments and implement the audit plan (see our article on pitfalls to avoid when drawing up an audit plan). In this case, you can recruit an internal audit professional to support your teams in carrying out audit assignments. The professional recruited will be part of the audit team and will be assigned tasks by the internal audit manager who will supervise the work (or the mission leader).
The head of internal audit or the engagement leader must ensure that the work has been carried out in accordance with the assigned work program and properly documented. The professional recruited must scrupulously respect the company's procedures and working methods.
- You wish to entrust a service provider with a specific mission
The head of internal audit may call on a professional to carry out specific audit assignments for which he or she has no particular skills. This may involve assignments in the following areas:
- Information security management system audit ;
- Audit of compliance with specific standards (ESG, etc.)
- Fraud risk audit ;
- Quality Safety Environment (QSE) audit ;
- Business continuity audit ;
- etc.
- When the objectivity of internal auditing is threatened
The new standard 2.3 Reporting breaches of objectivity stipulates that ‘when the internal auditor becomes aware of a situation likely to affect their objectivity, they must report it to line management.
«If a breach of objectivity cannot be avoided, the internal auditor may consider outsourcing the performance of the assignment or its supervision.»
How does the service provider intervene?
- Drawing up terms of reference
When recruiting a service provider to carry out internal audit assignments, it is imperative that the company draw up clear terms of reference, specifying in particular the qualifications required. These qualifications refer to the essential criteria for an internal auditor: technical competence, interpersonal skills, communication skills, etc., and a good knowledge of the company's business would be a plus.
- Signing a contract - roles and responsibilities
The service provider recruited for the internal audit must sign a contract or engagement letter with the company, undertaking to comply with the standards and code of ethics of the Institut d'Audit Interne (IIA). The engagement letter must provide a detailed description of the services to be performed and the deliverables (audit plan, planning memo, work schedule, audit report and follow-up of recommendations, audit activity report, etc.). The contract must clearly designate the authority responsible for monitoring the internal audit and the duration of the services.
The contract should define the responsibilities between the professional and the company in terms of internal audit quality assurance.
- Monitor the progress of the audit assignment
The audit provider carries out assignments in accordance with international auditing standards and best practices.
- In the case of total outsourcing, he plays the full role of internal auditor, monitoring all stages of the process (risk-based audit plan, presentation to the Board, budget, execution of assignments, reporting and follow-up of recommendations, etc.).
- In the case of co-contracting or subcontracting, the service provider works under the orders of the head of internal audit, to whom he reports his work.
- Designate a contact person within your company
In the event of total outsourcing of the function, the service provider will report to senior management and the Board of Directors (as would the internal auditor if he were in place).
In the event of subcontracting or co-contracting, the service provider will report to the company's head of internal audit.
- Evaluating the performance of internal auditors
In accordance with the IIA's quality assurance standards, outsourced internal auditing must undergo both internal and external evaluation (every five years). The internal assessment may be carried out by means of a self-assessment, whereas the external assessment is carried out by an independent firm.
This assessment ensures that internal auditing complies with standards.
In short, it is possible to outsource all or part of the internal audit function if you do not have an internal audit department, or if you would like support in carrying out internal audit assignments (as a co-contractor or sub-contractor) by specialists in a particular field (fraud, cybersecurity, etc.). International auditing standards allow for this, and in certain contexts it can even prove beneficial to the company in terms of better management of the function.
About Moore Senegal
For the past 15 years, Moore Sénégal has been supporting the internal audit departments of large and medium-sized companies, providing them with the skills they have acquired from working with major groups, as well as high-performance tools for carrying out audit assignments in line with the risk-based approach (charter, audit manual, work tools, etc.).
