Outsourcing — A RUNAWAY TRAIN

Internal Auditor, June, 2000 by Jonathan Figg

Goepfert's due diligence work includes investigating the economic viability of a prospective third-party provider. His staff speaks with companies that conduct business with the outsourcing candidate to determine the quality of service they are receiving. Like Gardner's group, the Continental Airlines audit team visits the outsourcer's facilities to conduct an on-site examination, talk to staff, and observe how the firm handles the business process within the context of the client's business environment. "This preliminary onsite audit might reveal slight variations between what the outsourcing firm proposed and what it is actually capable of delivering," maintains Goepfert. "Vendors can certainly suggest idyllic solutions, but they may not always be able to fulfill their promises. For example, your company might receive a proposal from a seemingly huge organization claiming the ability to handle an enormous workload; but when internal auditors visit the facilities, they observe just three people working in a warehouse. This sort of discrepancy cannot always be recognized in a proposal."

Jean Moyer, internal audit director for the National Geographic Society, and her staff were recently brought into an outsourcing conversion process late in the game, which forced her team to play catch-up. "We were not able to offer input on the vendors that were chosen, nor were we able to highlight potential problems," she says. "For example, an outsourcing firm provided financial reports in a new format, containing different data from that which our organization previously received in-house. Had internal auditing been involved earlier, we could have tested the firm's systems to gauge the accuracy and content of their reports." Moyer's team has been involved on the front-end of subsequent outsourcing projects, helping the organization by examining vendors' systems, processes, staff training, and financial reporting methods.

Proactive internal audit involvement is mutually beneficial for management and internal auditing. "By helping to develop the outsourcing arrangement, internal auditing will know which controls are integrated into the process when the time comes to audit the provider," notes Goepfert. "We like to set expectations as to what internal auditing will look for during a review so that the outsourcing firm can develop controls for the process.

Some organizations have developed a best practice of establishing special teams to identify the most effective approach for transferring a business process to an outside firm. Both Gardner's and Goepfert's organizations employ teams comprising all parties that might be affected by the decision to outsource, including the internal audit department. Internal auditing's primary role is to ensure that controls will not be sacrificed and the company is not facing unnecessary risk. "Internal auditors also add value to outsourcing review teams through their extensive of the organization's inner mechanisms," notes Goepfert. "Internal auditing contributes by suggesting methods for streamlining and improving the processes."