Internal auditors are, in many respects, the guardians of corporate standards. Without them, who knows what would happen? But does everyone involved in internal auditing need to be a company employee? Is this a function that can be safely, intelligently outsourced to generate cost savings? Or should downsizing and process reengineering respectfully stay away? What are the advantages of total outsourcing? And of a teaming approach that integrates internal with external auditors? What are the special situations that suggest the need for outsourcing? These are among the questions addressed as we condensed lessons learned from our work with corporations that have tried all of the above. We have not disguised the involvement of Price Waterhouse in many of the situations under discussion, but the purpose is not to point to ourselves; it is to lay out the management options and clarify best practices.
Few corporate activities are untouchable in this era of downsizing and business process reengineering. Companies are redefining the meaning of core and noncore functions--sometimes in defiance of traditional management thinking--and they are willing to experiment with outsourcing functions to specialized service providers that have made it their business to acquire expertise in a specific field. These functions range from manufacturing, computer operations, and product distribution to marketing and sales. To this list can be added internal auditing. Engaging an accounting firm to perform some or all of the internal audit would therefore appear to be a logical and prudent decision. But should companies outsource internal audit? And can it be outsourced successfully? There are arguments on both sides. External auditors can perform many of the tasks traditionally assigned to internal auditors, from conducting special investigations to auditing EDP systems. But many observers believe that outsourcing the internal audit is not the best response to cost-cutting pressures, especially when a corporation is seeking to decentralize decision-making authority. Under those conditions, some would assert that a centralized and closely held internal audit function represents an essential activity, without which a business leaves itself open to many difficulties.
The debate over outsourcing has diverted many internal auditors from the more pressing issue of finding innovative ways to reduce costs while providing services that are viewed by management as valueadded. Outsourcing sometimes is perceived as a threat by internal auditors, which is, of course, not illogical--but let's look more deeply at the issues here.
An Innovative Solution
We are not automatic or unquestioning fans of total internal audit outsourcing. Our experience, and our analysis of corporate needs and obligations, frequently leads us to suggest a different solution. This solution is a coordinated program of sourcing or teaming in which the organization retains its general auditor and key staff members to shape policy and to work with an external firm to provide the right blend of resources for each project. The teaming concept empowers audit directors to improve staffing flexibility, acquire outside technical expertise, and control costs without sacrificing audit quality or control. This is not to say that organizations should never totally outsource internal audit. Each situation should be evaluated separately and only after the department's core competency needs have been carefully assessed.
This assessment often begins with management's evaluation of its own expectations for the function. Should internal auditors emphasize financial or operational controls? Does the department primarily serve the CEO, or does it respond to the needs of such diverse parties as the CFO, business unit managers, the audit committee, or government regulators? Is the auditing department a training ground for future managers or is it staffed by career professionals? …