Sourcing the Internal Audit function

Overview of Internal Audit Sourcing and Governance

• Governance Responsibilities:

  • Irrespective of how an internal audit function is staffed or sourced, the Chief Audit Executive (CAE) maintains ultimate responsibility for the internal audit function.
  • The Audit Committee retains governance and oversight control over the internal audit function regardless of the sourcing model chosen.
  • Specific prescriptions and specifications regarding internal audit sourcing are mandated by the Sarbanes-Oxley Act (SOX), which dictates who can perform internal audit services when outsourcing is utilized.

• The Sourcing Continuum:

  • Internal audit sourcing operates across a spectrum defined by two primary anchor points:
  • Insourcing: The traditional, full-time internal hiring model.
  • Outsourcing: Contracting the audit function to an external service provider.
  • Co-Sourcing: The practical compromise position located in the middle of the spectrum, blending internal employees with third-party contractors.

Insourcing the Internal Audit Function

• Definition and Operational Framework:

  • Insourcing is the traditional method of conducting internal audit operations.
  • Under an insourced model, an organization directly hires full-time corporate employees who perform all internal audit engagements on an ongoing basis.
  • The majority of corporate internal audit departments utilize the insourced operational model.

• Organizational Structure Example (Raymond James):

  • A representative operational structure of an insourced internal audit department includes:
  • One ($1$) Chief Audit Executive (CAE).
  • One ($1$) Associate Audit Director.
  • Three ($3$) Internal Audit Managers.
  • A supporting complement of staff internal auditors.
  • In an insourced setup such as Raymond James, all personnel are direct full-time corporate employees dedicated exclusively to the internal audit function.

Outsourcing the Internal Audit Function

• Definition and Organizational Dynamics:

  • Outsourcing involves contracting with an external service provider to supply internal audit staffing.
  • While auditors in an outsourced model act as internal auditors for the client organization, they are not direct employees of that organization.
  • Staff members performing outsourced audit work are full-time employees of external third parties, such as public accounting firms, consultancy firms, or boutique Governance, Risk, and Compliance (GRC) firms.

• Case Study: Southern Company ($2008$):

  • In $2008$, Southern Company (headquartered in Birmingham) underwent a full outsourcing of its operational internal audit function.
  • Chief Audit Executive Role: Mark Harkins, the CAE at the time, remained in his role as a direct employee of Southern Company to preserve internal corporate governance.
  • Operational Staffing: Southern Company outsourced its entire operational internal audit staff to a Big Four public accounting firm (such as KPMG or Ernst & Young).
  • The auditors performing field engagements were full-time contractors employed by KPMG (or Ernst & Young) assigned to perform work for Southern Company.

• Strategic Rationale for Complete Outsourcing:

  • Knowledge, Skills, and Abilities (KSAs): Professional standards mandate that an audit department must collectively possess the necessary KSAs to fulfill the audit plan. Organizations lacking internal technical depth utilize external providers to comply with standard requirements.
  • Bench Strength: Major public accounting firms (including regional firms and Big Four accounting firms) maintain a broad, deep talent pool (analogous to a deep 3-deep depth chart in sports such as basketball, baseball, or football). It is often easier for specialized firms that recruit and train auditors to supply complex skill sets.

• Governance and Professional Standards Integrity Under Outsourcing:

  • Under a fully outsourced model, governance remains unchanged: the organization maintains a CAE as an employee and an Audit Committee to which internal audit reports.
  • Third-party contractors are hired for specific durations and hour thresholds.
  • Full outsourcing does not alter professional audit standards or obligations:
  • The IIA Code of Ethics remains fully applicable.
  • Attribute Standards remain fully applicable.
  • Performance Standards remain fully applicable.
  • The sole structural difference between insourcing and outsourcing is who issues the paycheck.

Co-Sourcing Model and Public Accounting Workload Dynamics

• Co-Sourcing Operational Structure:

  • Co-sourcing maintains a stable, core cadre of insourced internal auditors within the enterprise.
  • The internal team is supplemented by contracting a specific block of man-hours to an external audit firm, consulting firm, or third party to augment existing internal skill sets.

• Public Accounting Business Model and Workload Smoothing:

  • Seasonal Workload Fluctuations: Public accounting firms face high seasonality. Workload intensifies heavily during the fourth quarter and peaks following the calendar year-end ($12/31$) through April ("busy season") due to corporate audit and tax filing deadlines.
  • **Off-Peak Downtime (