Primary navigation:

QFINANCE Quick Links
QFINANCE Reference

Home > Auditing Best Practice > Considerations when Outsourcing Internal Audit

Auditing Best Practice

Considerations when Outsourcing Internal Audit

by Peter Tickner

Executive Summary

  • The key consideration is whether it is better to outsource internal audit, insource to support an existing function, or leave the function inhouse.

  • Outsourcing is a valid option when cost or effectiveness is the single most important factor in considering the internal audit function.

  • If the key consideration is efficiency, outsourcing may not be the best option.

  • Outsourcing a small, existing internal audit function may be counterproductive.

  • Outsourcing either a new internal audit function or a weak medium-to-large inhouse audit function is often an effective solution.

  • Organizations should only consider outsourcing once they have evaluated the effectiveness of the existing inhouse function and have identified any improvements that they can implement. Only then can the merits of outsourcing be evaluated properly against those of retaining the inhouse function.

  • Outsourcing can provide benefits by bringing skills not available to an inhouse team, but it can also risk losing the internal knowledge of the organization.

  • A valid alternative for consideration is cosourcing (a partnership between inhouse and external provider), which may confer the advantages of outsourcing while keeping the effective parts of the inhouse function.

  • Outsourcing can be to a specialist internal audit provider, a major organization with an audit arm such as one of the “big four” accounting firms, a specialist financial and business services provider, or a consortium formed from several internal audit departments in similar businesses.


Outsourcing the internal audit function is a major step and one that should not be taken for the wrong reasons. Wrong reasons include a personality clash between the chief internal auditor and the person taking the decision to outsource, and a decision based on the perceived ineffectiveness of an under-resourced inhouse audit team that would struggle to perform well even if the most outstanding employees in the organization were assigned to it.

When deciding to outsource internal audit, three options should automatically be evaluated before a decision is taken. First, is the inhouse function fit for purpose? Second, is outsourcing a value-adding solution? Third, is a better option to cosource1 where skills can be improved or cost savings made?

In some circumstances outsourcing can initially save costs and, in the long term, reduce the pension requirements of internal employees. Before taking such a step, the options must be weighed and a realistic evaluation of the consequences made. What may seem on paper a straightforward way of reducing internal audit costs and increasing the pool of expertise can have unexpected consequences if the starting position is not as the organization imagines it to be.

Case Study

Her Majesty’s Treasury

In the 1990s the United Kingdom’s HM Treasury embarked on a program of outsourcing noncore functions, including internal audit. An immediate and unexpected snag was hit when the head of internal audit pointed out that the inhouse function had been significantly under-resourced for several years. In order to outsource the function they would need to determine the true need for internal audit resources, as it would be unlikely that an external provider could give the levels of service required with the same or fewer staff than were currently employed. Also, an issue arose as to who was to ensure the quality of an outsourced service provider. The Treasury set standards for internal audit in government and could not be seen to fail to provide the right standard of service for itself. Leaving an outsourced contract to be evaluated by someone with no specific knowledge of the function would leave the Treasury exposed to external criticism. At the time, no senior finance staff outside of the audit department had any specialist knowledge of internal audit.

To ensure that there would be an adequate internal audit, the Treasury had an audit needs assessment prepared to go with the specification for the service to be outsourced. When senior management realized that a significant increase in staff and costs would follow, they opted for a cheaper compromise option of cosourcing specialist skills and retaining a core general audit team. Although this did not fully meet the identified audit need, it enabled the Treasury to demonstrate to external reviewers that it did take the level of resource needed for internal audit seriously. At the same time it enabled the Treasury to implement the extant UK government policy of using the private sector wherever that was the best placed to offer the appropriate skills and add value.

Lessons Learned from the Case Study

The decision to outsource has to be preceded by a thorough analysis of the data available about the existing service, both financial and structural. The ‘political’ decision in this instance backfired. Ultimately, management spent time and resources to end up with a more effective but more expensive audit service when the strategy had been to cut costs by outsourcing non-core functions. At the time of writing the Treasury’s internal audit service is still largely in-house. It is unlikely that there is any meaningful benefit to be gained from outsourcing an existing small inhouse internal audit function. Almost certainly, the chief internal auditor or a senior audit manager will have to be retained to oversee the quality and performance of the outsourced function, and it is likely that the margin for making savings will be small if not nonexistent.2

Conclusions from the Case Study

In such circumstances the best option may well be to keep a small cadre of inhouse staff supplemented by an insourced external partner to provide one-off expertise and professional support, thereby avoiding the need to carry the costs of a full-time internal member of staff or a significant overhead to manage an outsourced function.

Back to Table of contents

Further reading



  • Institute of Internal Auditors (IIA). “The role of internal auditing in resourcing the internal audit activity.” IIA position paper. January 2009. Online at: [PDF].

Back to top

Share this page

  • Facebook
  • Twitter
  • LinkedIn
  • Bookmark and Share