THE CPA IN INDUSTRY

February 2000

OUTSOURCING THE INTERNAL AUDIT FUNCTION

By Charles L. Martin and Michael K. Lavine

Organizations are regularly outsourcing their internal audit function to large CPA firms, as well as to niche firms that specialize in the service. A survey of more than 1,300 internal audit directors representing different industries throughout North America revealed that more than 25% of U.S. and 31.5% of Canadian respondents' organizations' internal audit work is outsourced. Of those that do not currently outsource their internal audit activities, about one-third stated that they plan to do so in the future. Regardless of the firm being downsized, reengineered, or rightsized, the most common reason cited for outsourcing a portion of the internal audit function was financial savings: 60% of U.S. and 52% of Canadian respondents cited this as their reason.

Robert Barr and Stanley Chang in a 1993 article identified three forms of internal audit outsourcing. The simplest form of external assistance is supplementation. Through supplementation, outside contractors work with an internal audit department to help complete jobs that require a significant amount of time during short periods. Another form of internal audit outsourcing, audit management consultation, is usually an extension of a currently existing consulting or audit engagement by a public accounting firm and may develop with or without an internal audit department. Finally, total outsourcing of the internal audit function is popular among small or mid-size companies without internal audit departments.

A fourth form of outsourcing, not identified by Barr and Chang but gaining in popularity, involves replacing an existing internal staff with an external organization. The external organization is usually a public accounting firm that is performing the company's internal audit function. Controversy often surrounds an appointment of this nature, because independence becomes an issue.

One Side of the Fence

Economic pressures on corporate America have forced many companies to consider the costs and benefits of having some support functions provided by outside vendors. By outsourcing these functions, firms are able to adjust the level or intensity of services while still devoting attention and resources to the primary aspects of their businesses.

Internal auditing is being reengineered because of a number of important changes in the general business environment. First, executive management and boards of directors are changing their attitudes toward the compulsory internal audit function. As many businesses look to reduce operating costs by removing their non-value-added services, internal audit departments that do not add shareholder value are being eliminated. Second, outsourcing as a means of achieving corporate objectives is presently in vogue. Businesses are selecting an increasing number of external service providers in lieu of hiring, training, and maintaining internal staff. The external provider often employs large numbers of part-time personnel, resulting in direct cost savings. Third, senior management has become more reliant on business advisors that are technologically competent and deliver cost-effective services on a global basis.

Organizations should consider whether it is more cost-beneficial to develop internal audit skills or simply purchase them from a competent service provider. The numerous potential gains from outsourcing include decreased costs due to reduced pension obligations and in-house training, the ability to engage outsiders on a just-in-time basis, and the ability to replace a fixed workforce with a virtual workforce possessing a wider range of skills and competencies.

Outsourcing the internal audit function can also lead to cost-effectiveness, cost conversion, personnel flexibility, and quality assurance. When contracted internal auditors are truly independent, they may feel freer to comment upon observed weaknesses. External auditors may have a larger and more diverse set of specialists to help management solve operating problems. This is in sharp contrast to the typical internal audit department that has a small nonspecialist staff geared to completing a predetermined annual audit plan approved by the audit committee.

With the trend toward globalization, it is becoming increasingly difficult for a multinational staff with limited or centralized resources to provide all internal audit services. Therefore, an analysis similar to a traditional set of make or buy decision alternatives should be made as to whether outsourcing is more appropriate.

Finally, an internal audit position can also have its share of frustrations. Internal auditors may find that the audit committee and board of directors do not view their findings and recommendations with the same seriousness as the external auditors' findings. The internal auditors may be seen as the corporate "cop" in attempting to make sure management and employees adhere to organizational policies and procedures.

The Other Side of the Fence

For some companies outsourcing can be the perfect solution, while for others it is neither cost-effective nor efficient. This depends on factors such as the efficiency of the current internal audit department, the size of the firm, and the cost of outsourcing arrangements. Often, existing internal audit departments can adjust their policies and procedures to cut costs and increase efficiency without outsourcing. These factors should be considered on a case-by-case basis.

Traditional internal audit departments often lend a number of benefits to their organizations. These benefits include a strong understanding of corporate operations, internal controls, and risks and exposures facing the business. Internal audit departments also assist management and boards of directors in effectively discharging their responsibilities related to maintaining an effective system of internal controls.

Based on our professional experience, we have found that internal auditing is an enjoyable and rewarding profession. Young CPAs with a desire to learn more about a particular company or industry often move to an internal audit position after starting their career in public accounting.

Because a significant portion of internal audit work involves operational matters, having personnel whose future is connected with the organization is a definite benefit. Employees of a corporation are more likely to exhibit loyalty to their employer than a third-party contractor. In addition, the in-house audit department's cumulative working knowledge of daily business operations enables it to detect weaknesses in the internal control structure. This will likely produce more detailed and constructive recommendations for company management.

The Institute of Internal Auditors is of the opinion that a competent, properly trained internal audit department can perform the internal audit function more efficiently and effectively than a contracted service, based upon evidence that such departments are better acquainted with their companies' organization, policies, procedures, operating practices, and personnel.

Moreover, the internal audit provides employees with important management development training opportunities. Frequently, internal auditors gain broad exposure to the business's operations and risk areas. Internal auditors often transfer to positions in their organization's accounting, finance, information systems, or operations. The visibility of an internal audit position often aids an individual's opportunity for transfer and advancement within the organization.

Internal auditors normally have better writing, presentation, and interpersonal skills than other employees with similar years of service to the organization. Furthermore, when internal auditors assist management in discharging its responsibilities--often through special internal consulting projects--the value-added services they bring are immediately recognized by the management team.

Although this management training ground might bode well for individuals, it can result in frequent turnover, which in turn can lead to inefficiencies within the internal audit department. While difficult to translate into strict financial terms, the benefits should nevertheless be considered when contemplating an outsourcing decision.

GAINing the Advantage

Many companies continue to employ their own internal audit staffs. Those companies that do outsource often employ internal auditors to educate the external auditors about the client's industry and corporate culture. However, outsourcing has been seen as a threat to the internal audit staff.

From practical experience, we believe that internal auditors must assist their organizations in identifying the optimal internal audit solution. This process should include a cost-benefit approach, and one useful method is to perform a periodic benchmarking survey using data from the Institute of Internal Auditors' Global Auditing Information Network (GAIN) quarterly surveys.

GAIN is a quality tool for self-assessing an internal audit organization. Its reports, charts, and graphs provide baseline levels from which to benchmark and evaluate an internal auditing department's performance. Comparisons may be made within specialty groups or across industries, and may cover such diverse topics as internal auditing department costs, audit committee information, customer satisfaction, and audit life cycles. GAIN is available on a subscription basis from the Institute of Internal Auditors.

Regulatory Issues

The critical issue in hiring a public accounting firm for both the internal and external audit functions relates to independence. Outside auditors that also perform internal audit procedures would at least seem to lack the appearance of independence. This controversial and potential conflict of interest has been the subject of scrutiny by the SEC chief accountant. If it is a management function or part of the company's internal controls, the service provided by the external auditor would clearly conflict with independence rules. The SEC is concerned by the following activities:

* Determining the scope of the internal audit function,
* Assessing the company's business risks,
* Developing procedures that address the business risks, and
* Monitoring the effectiveness of the internal control structure.

Outsourcing allows the expansion of internal audit services, which can be positive or negative depending upon the nature of the service. Positive approaches to outsourcing occur when all parties work toward efficiency in cost and service. However, if management views an internal audit department simply as a cost, the decision to outsource could be counterproductive. The senior management and audit committee of each organization must analyze the full range of qualitative and quantitative factors before deciding to outsource. *