SOURCING INTERNAL AUDIT SERVICES: A THREAT OR A BEST PRACTICE?

By David Hodgson and Lee Puschaver

Internal auditors are, in many respects, the guardians of corporate standards. Without them, who knows what would happen? But does everyone involved in internal auditing need to be a company employee? Is this a function that can be safely, intelligently outsourced to generate cost savings? Or should downsizing and process reengineering respectfully stay away? What are the advantages of total outsourcing? And of a teaming approach that integrates internal with external auditors? What are the special situations that suggest the need for outsourcing? These are among the questions addressed as we condensed lessons learned from our work with corporations that have tried all of the above. We have not disguised the involvement of Price Waterhouse in many of the situations under discussion, but the purpose is not to point to ourselves; it is to lay out the management options and clarify best practices.

Few corporate activities are untouchable in this era of downsizing and business process reengineering. Companies are redefining the meaning of core and noncore functions‹sometimes in defiance of traditional management thinking‹and they are willing to experiment with outsourcing functions to specialized service providers that have made it their business to acquire expertise in a specific field. These functions range from manufacturing, computer operations, and product distribution to marketing and sales. To this list can be added internal auditing. Engaging an accounting firm to perform some or all of the internal audit would therefore appear to be a logical and prudent decision. But should companies outsource internal audit? And can it be outsourced successfully? There are arguments on both sides. External auditors can perform many of the tasks traditionally assigned to internal auditors, from conducting special investigations to auditing EDP systems. But many observers believe that outsourcing the internal audit is not the best response to cost-cutting pressures, especially when a corporation is seeking to decentralize decision-making authority. Under those conditions, some would assert that a centralized and closely held internal audit function represents an essential activity, without which a business leaves itself open to many difficulties.

The debate over outsourcing has diverted many internal auditors from the more pressing issue of finding innovative ways to reduce costs while providing services that are viewed by management as value-added. Outsourcing sometimes is perceived as a threat by internal auditors, which is, of course, not illogical--but let's look more deeply at the issues here.

An Innovative Solution

We are not automatic or unquestioning fans of total internal audit outsourcing. Our experience, and our analysis of corporate needs and obligations, frequently leads us to suggest a different solution. This solution is a coordinated program of sourcing or teaming in which the organization retains its general auditor and key staff members to shape policy and to work with an external firm to provide the right blend of resources for each project. The teaming concept empowers audit directors to improve staffing flexibility, acquire outside technical expertise, and control costs without sacrificing audit quality or control. This is not to say that organizations should never totally outsource internal audit. Each situation should be evaluated separately and only after the department's core competency needs have been carefully assessed.

This assessment often begins with management's evaluation of its own expectations for the function. Should internal auditors emphasize financial or operational controls? Does the department primarily serve the CEO, or does it respond to the needs of such diverse parties as the CFO, business unit managers, the audit committee, or government regulators? Is the auditing department a training ground for future managers or is it staffed by career professionals?

Once these considerations have been addressed, corporations can begin to determine the best mix of internal and external resources (See Exhibit 1, depicting the complementary roles of internal and external auditors). Audit directors rarely maximize efficiency by relying solely on internal talent. Trying to build a staff large enough to meet every need is impractical, and the result is that talented people are sometimes deployed on the wrong projects. A professional hired to analyze controls in a client/server computer system may not be the right person to provide advice on a new image-processing system or on broader issues such as human resource policies. Sourcing enables audit directors to convert fixed costs to variable costs and to form a core team of professionals capable of orchestrating the efforts of talented specialists from inside and outside the organization.

More Horsepower

The general auditor at Great Western Bank in Los Angeles, for instance, engages an independent accounting firm to provide additional support for EDP auditing and other projects, some technical in nature, others requiring more personnel than the bank chooses to carry on a permanent basis. The sourced projects can range from assessing controls in a local area network to helping the internal audit team conduct detailed branch reviews. Other corporations have sourced considerably larger portions of the internal audit function to an external auditor. Continental Bank, now Bank of America Illinois, viewed outsourcing as a way to control costs while maintaining a comprehensive auditing program that would satisfy changing regulatory requirements. Responding to tougher regulations imposed by the Federal Deposit Insurance Corporation Improvement Act, Continental recognized that it would have to expand the scope of its internal and external auditing efforts. At the same time, management was implementing a corporatewide initiative to evaluate the sourcing of noncore activities in an effort to enhance the quality and cost-effectiveness of services.

The solution was to create an integrated audit team with approximately 60 professionals. Continental retained its general auditor and about 20 internal audit professionals, a critical mass large enough to set scope and policy for internal auditing and to meet the concerns of the bank's regulators. Price Waterhouse provided the remaining 40 staff members. After a brief transition period, external and internal audit teams began integrating audit objectives and programs, generating significant cost efficiencies, and satisfying both management expectations and regulatory requirements.

Geographic Sourcing

Teaming can help multinational corporations achieve cost-effective audit coverage at multiple overseas locations. For years, multinationals have wrestled with the task of overseeing far-flung international locations. Should they incur the expense of sending audit teams across the globe? Do they expose themselves to unacceptable risk by not sending teams? Tapping the international networks of public accounting firms can help management solve this problem without devastating the travel budget, while also avoiding the language and cultural barriers that inhibit many visiting audit teams.

When Allied Signal engaged our firm to perform targeted compliance audit tests at 30 manufacturing sites across Europe and Central America, it was able to reduce staff travel expenses and redeploy internal auditing resources to other areas. After visiting the sites, the local audit teams prepare reports and send them to the Price Waterhouse LLP partner coordinating the process from Allied Signal's corporate headquarters. On behalf of head-office management, the teams follow up to ensure that local management implements the desired recommendations for enhancing controls and improving administrative efficiency. The result is both effective and cost-efficient.

A similar approach has worked for UPS at its European locations. In this program, offices of the local Price Waterhouse firm supervise the external audit teams with oversight from the United States. Besides the obvious advantage of slashing travel costs, the use of local auditors eliminates the transition period that typically slows staff members visiting from overseas. Even employees who are fluent in the local language require an adjustment period to become fully effective in the new setting. Local auditors, however, can step right in and get to work.

The geographic sourcing needs of Freeport-McMoRan were more precise. As part of an overall corporate strategy, Freeport-McMoRan outsourced its entire internal auditing function. A key requirement for the natural resources conglomerate was to find a firm with a strong presence in Indonesia that could help it enhance the internal control environment at a huge mining operation in Irian Jaya (western New Guinea). Visiting the mine is a logistical nightmare. Sending audit teams from the New Orleans corporate headquarters was exhausting and expensive--the trip to Jakarta alone requires 30 hours of air travel, and the mining operation lies a full day's travel past Jakarta. Under these conditions, access to the resources available from Price Waterhouse Indonesia fits nicely with the corporation's overall strategy.

Corporate Governance

As the preceding example illustrates, complete outsourcing is the right choice for some corporations. The U.S.-based Price Waterhouse audit partner responsible for the Freeport-McMoRan internal audit engagement essentially serves as chief internal auditor, reporting directly to the audit committee--with dotted-line responsibility to a high-level executive, who is not a member of the finance group. This arrangement ensures the independence of the audit function while still providing for adequate oversight by the senior management team.

Complete outsourcing should be considered when the activity can be closely supervised by a senior corporate officer, as is done by Freeport-McMoRan. Senior management cannot cede its ultimate responsibility for corporate governance, which includes accounting controls and internal auditing. A management team that yields organizational control to an outsider, without very real oversight, exposes itself to significant financial and operational risk. However, by retaining oversight of the internal auditing function, management can help to ensure the independence of the external auditor while also alleviating any potential regulatory concerns.

Special Situations

The complexity of a business is another matter to consider in deciding whether to outsource. Some organizations have intricate bureaucracies and business processes. It is difficult for an audit team to navigate such a maze and do an effective job as an internal auditor. Conversely, everyone is on the same learning curve when a corporation is in the midst of a merger or spin-off--full-time employees as well as external auditors. One such example is Ralcorp.

In 1993, Ralston Purina bundled its noncore enterprises--primarily its human-foods businesses and several Colorado ski operations--into a new publicly traded entity called Ralcorp. Deeming that it would be too distracting to build a new internal audit department from scratch, Ralcorp management asked the company's external audit firm to provide integrated auditing services for the new company. A distinction was established between the normal work of the external audit team and the activities of the internal audit team. The latter were to be closely supervised by the executive vice president and the controller.

Ralcorp now has at its disposal a flexible, cost-efficient team of external/internal auditors who are thoroughly familiar with the business. Adjusting to a new and evolving culture, the audit team has made more than 50 recommendations that have helped the organization implement stronger internal controls. As it grows, Ralcorp may yet decide to add an internal auditing function, but for now it is content to have Price Waterhouse implement the management team's internal audit plan.

A recently spun-off subsidiary faces a different set of internal control challenges than a highly regulated financial institution growing rapidly via mergers and acquisitions. Nevertheless, Union Planters, a Memphis-based bank holding company that has acquired 40 financial institutions in the past five years, found a way to make outsourcing work. The bank had grown so fast that it was no longer cost-effective to keep adding internal auditing staff. This recognition prompted management to reengineer the function altogether. Where appropriate, internal audit staff members were given new jobs within the organization, and line managers were instructed to take responsibility for reviewing "high-risk" activities. Union Planters then outsourced most internal auditing functions to its external auditor, which hired several Union Planters staff members. The bank maintains a general auditor on staff to direct the Price Waterhouse audit team and serve as a liaison between it and senior management.

Accustomed to conducting due diligence reviews for Union Planters as external auditors, the integrated audit team easily adjusted to its expanded role, even helping to roll out control self-assessment reviews to line managers. The assessments encourage managers to implement new procedures and then determine how well the procedures are working--instead of waiting for the audit team's report card.

Focusing on Core Business

The disruption caused by a merger can also create an environment suitable for internal audit outsourcing. The impending merger of two mining conglomerates, Cyprus Minerals Co. and Amax Inc., spurred significant change and resulted in reduced employee head count. A desire to focus on its core mining businesses led management to decide against building a new internal department. The company opted instead to outsource most internal audit responsibilities and asked us to develop an integrated audit approach.

The integrated team, comprising members of the external auditing team and three auditors hired from Cyprus and Amax, quickly coalesced into an effective unit, revamping audit procedures and generating enhanced reports that featured business analysis and detailed management summaries. For example, the team completed a comprehensive study of an affiliate's hedging portfolio and risk management strategy.

As several of these examples show, an integrated teaming approach has helped many companies solve internal auditing needs. In virtually every organization, internal auditors are being asked to do more with less. Sourcing selected services can be an innovative and creative solution for internal auditors who have been told to cut staff, while at the same time expand the scope of their audit programs. Teaming provides an opportunity to create strong partnerships between internal and external auditors and thus enhance the value of internal auditing programs. And while we do not recommend full outsourcing except in specific situations, it can make managerial and financial sense. *

David Hodgson is national director of Audit Technology and world chairman at Price Waterhouse's global Internal Audit Services. Lee Puschaver, CPA, is industry segment leader of National Banking for Price Waterhouse.

Adapted from an article published in PW Review, Spring 1995. Reprinted by permission of Price Waterhouse. Copyright 1995.

Editor:
Michael Goldstein, CPA
The CPA Journal

DECEMBER 1995 / THE CPA JOURNAL