An important challenge for internal audit functions of limited size is to be effective. Due to their limited size, these internal audit functions often do not have the necessary knowledge and competencies for the planned assurance and advisory assignments. Another hindrance in fulfilling the internal audit function is the availability of audit professionals in the current tight labour market. Finally, smaller internal audit functions offer their audit professionals fewer opportunities to develop further, which can result in higher staff turnover. To enable the internal audit function (IAF) to perform optimally again, it is time to revise the sourcing strategy.

Every organisation should periodically reconsider the sourcing of the IAF because a new sourcing model can contribute to further professionalisation of the IAF, allowing better responses to changing stakeholder demands, organisational changes, and emerging risks. This article provides insight into the different sourcing models of the IAF and the pros and cons of the co-sourcing model. If an organisation opts for a co-sourcing model, this article provides guidance on tendering for a co-sourcing partner for internal audit services.

Four Resource Models of the IAF

In practice, there are roughly four resource models for the IAF:

1. Own department – The IAF is exclusively provided by a department with auditors employed by the organisation, under the direction of a Chief Audit Executive (CAE).
2. Execution Outsourced Under Direction of a CAE – The execution is outsourced to an external internal audit services partner who is contracted and actively managed by an internal staff member with knowledge and experience of internal audit (CAE).
3. Fully Outsourced – An external internal audit services partner fulfils the entire IAF, and the partner contract is managed by an organisational staff member with limited knowledge and experience of internal audit (e.g., a board member).
4. Co-sourcing – The IAF is primarily provided by a department with auditors employed by the organisation, under the direction of a CAE, supported by one or more contracted co-sourcing partners.

Each of these resource models has advantages and disadvantages in terms of control over the IAF, business knowledge, costs, and objectivity. There is no ideal IAF resource model; it all depends on the organisation’s challenges and needs. IIA Australia has published a document (updated 2020) outlining the advantages and disadvantages of the four main resource models ([http://iia.org.au/sf_docs/default-source/technical-resources/2018-fact-sheets/internal-audit-resourcing.pdf?sfvrsn=2](http://iia.org.au/sf_docs/default-source/technical-resources/2018-fact-sheets/internal-audit-resourcing.pdf?sfvrsn=2)).

Why Do IAFs More Frequently Choose a Co-sourcing Model?

Of the four resource models, co-sourcing is becoming increasingly popular because it can be an efficient way for the IAF to provide more added value to the organisation and control costs. In 2009, a Dutch article on co-sourcing internal audit was published in *De Accountant* ([https://www.accountant.nl/magazines/de-accountant-februari-2009/co-sourcing-internal-audit/](https://www.accountant.nl/magazines/de-accountant-februari-2009/co-sourcing-internal-audit/)). The article shows that co-sourcing can be a good solution to address increasing staff shortages in the IAF and manage internal audit costs. Whether co-sourcing internal audit makes sense depends on many factors, such as the size and geographical spread of the organisation, the corporate governance regime, and the requirements for specialised knowledge and skills. Besides the flexibility of resources, the IAF can also gain independent and objective insights through co-sourcing. It is easy for an internal audit team to become complacent in executing their tasks. Bringing in a co-sourcing partner offers a fresh perspective, sharp insights, and the expertise to make recommendations when inconsistencies and other issues are noticed.

There is no ideal IAF resource model; it all depends on the organisation’s challenges and needs.

Disadvantages

A co-sourcing model also has disadvantages. Contracting a co-sourcing partner and hiring external auditors and advisors can be intimidating for internal staff. They may wonder: what does this mean for me and my position? Internal staff must understand the reasons for choosing a co-sourcing model and, if possible, be involved in selecting a co-sourcing partner. Frequent use of hired auditors and/or advisors for audit assignments – without additional measures – can mean that organisational knowledge gained during audits is lost to the IAF, and the IAF finds it harder to build professional relationships with management within the organisation. Additionally, there is a risk that audit reports and files delivered by the hired auditors do not meet the IAF’s methodology and quality requirements. Finally, external co-sourcing partners also experience staff turnover. This means that new external auditors and/or advisors must be regularly trained in the organisation’s specifics, the IAF methodology, and quality requirements.

Dealing with the Disadvantages

How do IAFs deal with the aforementioned disadvantages? A commonly used method is to form an audit team for an assignment from both internal auditors and hired auditors and/or advisors. An internal auditor then leads the assignment, ensuring knowledge retention, maintaining the relationship with the auditee, and ensuring compliance with the methodology and quality of the audit report and file.

The Tendering Process

Selecting a co-sourcing partner should be done in a thorough manner that delivers lasting benefits to the organisation. Therefore, tendering for internal audit services is a logical choice. As always, good preparation is half the work. This is what a typical tendering process looks like: step 1 – determine the objectives of the tender; step 2 – plan the tendering process; step 3 – determine the decision-making process in advance; step 4 – execute the tender.

Step 1 – Determine the Objectives of the Tender

Think about what you want to achieve from the tender before starting the process. Stakeholders may have different objectives, so it is important to align stakeholders well in advance to prevent later disruption of the process or decision-making. You may want to involve the existing co-sourcing partner in this discussion where necessary to ensure all considerations are met. Possible objectives of the tender may include:

• Improved internal audit quality due to the involvement of external specialists with specific knowledge, experience, and skills.
• Implementation of new ideas, approaches, and/or new technologies.
• Reduction of overall audit costs.
• Underperformance of the current co-sourcing partner.
• Better continuity of the IAF due to the involvement of external specialists.

 

Step 2 – Plan the Tendering Process

Careful planning ensures that the tendering process runs as efficiently as possible for both the organisation and the potential co-sourcing partners. A poorly planned tender can result in a lot of extra work during the implementation phase (e.g., clarifying issues, providing additional information) and/or an inefficient decision-making process, causing the entire tender to take unnecessarily long. An important step in the planning process is appointing a single internal contact point within the organisation for all internal stakeholders and potential co-sourcing partners (the participants). The contact point should have sufficient seniority and knowledge of the organisation and the IAF, for example, the CAE. Another important step is forming the selection panel and ensuring the availability of panel members, especially if the panel includes board members and/or audit committee members.

The duration of the tendering process depends on several factors, such as the process you decide to follow, the number of participants you invite, the availability of panel members, and the timing of the tender. Generally, a tendering process takes eight to twelve weeks from the moment the tender letter is sent. It is a good idea to send a tender letter only to companies that you reasonably expect to score well on the tender criteria regarding reputation, team, experience, coverage, etc. If you are unsure which companies to invite, consider contacting IIA Netherlands.

Step 3 – Determine the Decision-Making Process in Advance

How the decision-making process regarding the tender will proceed depends on several factors. First, it is important to follow the organisation’s formal procurement process. Potential co-sourcing partners are then assessed based on predefined transparent and non-discriminatory evaluation criteria with relative weighting. A score matrix is often used for this purpose. Finally, intangible factors such as the impression participants made during the tender, the teams they proposed, and how well their culture and working methods fit with the organisation are also assessed. Relevant questions to answer include whether the potential co-sourcing partner has:

• A clear vision and strategy, good reputation, and track record.
• An understanding of the business and culture of the organisation.
• Experience in the industry/sector in which the organisation operates.
• The ability to provide assurance and/or advisory services to the organisation (is independence guaranteed?).
• Auditors and advisors in the countries where the organisation operates.
• Auditors and advisors with a good reputation, the required specific knowledge, audit experience, competencies, qualifications, and necessary memberships of professional organisations.
• Willingness to work according to the internal audit methodology and with the audit software of your organisation.
• Its own quality assurance system.
• Transparent rates for different roles, locations, and/or services and how these rates are revised over time.

 

Step 4 – Execute the Tender

The first phase of execution is preparing and sending an invitation letter for participation in the tender to all potential co-sourcing partners. The invitation letter should include the following information:

• The mission, strategy, organisational structure, and geographical spread of the organisation.
• The mission, strategy, audit charter, department structure, geographical spread, audit plan, and manual of the IAF.
• The reasons for the tender.
• The scope and period of the requested internal audit services.
• The contact details of the contact point within the organisation (CAE).
• The tender process.

 

Second Phase

The second phase focuses on answering any questions from participants regarding the invitation letter, evaluating the timely received written proposals, and selecting the participants who may present their proposals to the selection panel. The third phase involves organising the presentations of the participants to the selection panel. Depending on the needs of the selection panel or participants, additional meetings or telephone conversations may be organised. Organisations are increasingly choosing in-depth Q&A sessions for each participant instead of formal presentations to the selection panel. This can shorten the process and focus more on areas where the selection panel needs the most clarity. In the final phase, an agreement is concluded with the selected co-sourcing partner(s). The organisation’s legal department and procurement function are likely to be involved.

Chief Audit Executive it is time for a new sourcing strategy. BR1GHT is able and willing to support you the process of defining and implementing a new sourcing strategy.