When Internal Audit Should Be Co-Sourced (and When It Should Not)

Many internal audit functions are not understaffed. They are simply staffed for a different risk profile than the one they face in a given year.

A lean internal audit team may be well-positioned to support annual risk assessments, operational audits, and routine SOX activities. Then an ERP implementation begins. A cybersecurity assessment is added to the audit plan. A new SOC report requires review. Additional IT general controls testing is needed to support external audit reliance.

Suddenly, the challenge is not capability. It is capacity.

We often see organizations struggle when significant projects and specialized risks emerge at the same time as their normal audit responsibilities. Internal audit may have the knowledge to perform the work, but not necessarily the time or resources to do it all effectively.

That is where co-sourcing can make sense.

The question is not whether to outsource internal audit. The question is which activities are best supported by outside resources for a period of time while maintaining ownership of the audit function.

When Co-Sourcing Makes Sense

Co-sourcing is often most effective when the need is specialized, temporary, or difficult to justify as a permanent addition to the team.

Examples include:

• IT general controls testing to support SOX or external audit reliance
• Data analytics initiatives requiring specialized tools or skill sets
• ERP implementation reviews or pre-implementation assessments
• Cybersecurity and information security audits
• Regulatory or compliance-focused reviews that occur infrequently

Co-sourcing can also help preserve independence. In some situations, bringing in an experienced external team is preferable to assigning resources from the business area under review or borrowing personnel with competing responsibilities.

Another practical consideration is documentation quality. When external auditors will evaluate the work, organizations often benefit from resources that understand the evidence, testing approach, and workpaper standards necessary to support reliance.

The common thread among these examples is that demand is temporary. The organization needs additional expertise or capacity for a period of time, not a permanent increase in headcount.

What Should Remain Internal

Some responsibilities should remain with the internal audit function regardless of whether work is co-sourced.

These include:

• Developing and maintaining the audit plan
• Performing the annual risk assessment
• Managing relationships with the Audit Committee and executive leadership
• Monitoring remediation and issue follow-up
• Determining which risks and activities will not be audited

These responsibilities require organizational knowledge, judgment, and accountability that cannot be delegated.

When external providers begin making these decisions, the organization risks weakening the internal ownership that makes internal audit effective.

What a Successful Co-Sourcing Arrangement Produces

Successful co-sourcing arrangements are not measured by whether a report is delivered on time.

They are measured by whether the work can be understood, defended, and relied upon months after the engagement ends.

The Chief Audit Executive should remain accountable for the plan. Roles and responsibilities should be clearly defined. Supporting documentation should tell a clear story and demonstrate how conclusions were reached.

A practical test is simple: six months after the audit is completed, can someone explain why a sample was selected, what evidence was reviewed, and how the conclusion was reached?

If the answer is yes, the arrangement likely produced more than a report. It produced auditable evidence and institutional knowledge.

A Practical Starting Point

Organizations considering co-sourcing should start by identifying the audits and projects that exceed their team's normal capacity or require specialized expertise.

That list usually reveals where outside support adds value.

Everything else can remain with the internal audit plan and the team that knows the business best.