A fresh look at cosourcing: recent research reveals that cosourcing continues to be a viable option in meeting internal auditing's needs for specialized knowledge and services

Internal Auditor, Oct, 2003 by Richard Serafini, Glenn E. Sumners, Barbara Apostolou, Lydia Lafleur

FOR MANY YEARS, INTERNAL AUDITORS HAVE BEEN turning to third-party providers for supplemental assistance in grappling with issues of language, geography, technology, and peak personnel requirements. Such needs continue today, especially in the information technology area, and cosourcing remains a valuable tool in enhancing the efficacy of internal audit departments. * Internal auditors often use cosourcing when they need assistance with a specific audit, a risk assessment, or special projects. In a cosourcing environment, the chief audit executive (CAE) maintains control of the internal audit function but uses a specialized outside service provider's (OSP) talents and resources to enhance efficiency and economy within the organization. An OSP may be a professional services firm or a specialized consulting firm.

We recently asked CAEs about their attitudes toward cosourcing arrangements. The resulting study, "Cosourcing: Impact, Trends, and Outlook," includes interviews with several of them as well as the 41-question survey that we sent to 447 audit executives throughout the United States. (Eighty one executives--an 18 percent response rate--completed the survey.) The study reflects the executives' views on the impact, advantages, and disadvantages of cosourcing; the decision process, contractual arrangements, and trends associated with the practice; and the outlook for the use of OSPs.

THE BENEFITS OF COSOURCING

Survey findings reveal that most CAEs expect to maintain or increase their current level of cosourcing (see "CAEs' Forecast for Cosourcing," this page). Forty three percent of survey respondents said they plan to cosource more, and 44 percent said that cosourcing would continue at the same level. CAEs subsequently interviewed primarily attributed their expected increase in use of OSPs to technology issues. Two-thirds of survey respondents anticipated an increase in staffing levels, either in-house or cosourced, or both. "Most CAEs have come to realize that they do not have to own the resources as permanent staff to meet their internal customers' needs," explained Dave Richards, CAE at FirstEnergy Corp., a public utility holding company, in a follow-up interview. "Specific expertise can be provided through borrowing talents when the topics require a level of experience that is not efficient to have as a permanent part of the staff. Take, for example, auditing employee benefits, which requires unique experience and current knowledge of laws, regulations, and techniques."

Sixty-five percent of respondents reported that the internal audit profession has benefited from the use of OSPs in cosourcing relationships. For those CAEs who responded to this question--72 percent of the sample--OSPs were viewed as having the most impact on audit execution, followed by planning, and reporting.

Survey respondents listed expertise, specialized knowledge, technical skills, staffing flexibility, and best practices, respectively, as the top five benefits that can be obtained through a cosourcing arrangement. According to Dean Lesiak, executive vice president and chief risk officer at Countrywide Bank, "The primary benefit of using an OSP is the availability of immediate staffing resources. They provide needed niche skills that might not be cost effective to maintain in-house."

At FirstEnergy, Richards says establishing relationships with multiple internal audit service providers is built into the audit process: "We call upon their help to supplement our ability to review complex transactions, such as derivatives, or to supplement the audit staff and enable permanent staff to focus on key issues Facing the company. Having established relationship agreements with multiple providers has also enabled us to match our customers with providers in cases where they need help that is best managed by the OSP directly. Overall, we have concluded that the cosourcing with external providers makes sense and can extend the abilities of the internal audit department and improve our image as a partner with our customers."

The areas in which CAEs perceive OSPs as being the most effective include information technology audits, employee benefits, systems security, and construction. Most of the CAEs stated that OSPs improve or maintain three principal internal audit activities: control evaluation, risk analysis, and corporate governance (see "OSPs' Impact on Key Internal Audit Activities," page 62).

PERCEIVED DISADVANTAGES

Although most CAEs found cosourcing arrangements beneficial, 13 percent said they expect their use of OSPs to decline, citing cost, lack of business knowledge, lack of organization knowledge, time to manage staff, and internal knowledge development and retention as the top five disadvantages. "The major disadvantage of cosourcing is that the knowledge gained is not transferred into the organization, as is the case with internal auditing," said John Beard, director of internal audit at Nabors Industries Inc.

In other follow-up interviews, CAEs stated that although they felt OSPs excelled at generic services such as information systems, the providers often lacked industry-specific knowledge. Interviews revealed that CAEs value risk software and methodologies developed by OSPs but that their application required in-house involvement. With rapidly changing technology and internal auditing's increased involvement in the risk area, software and methodologies development may continue to be the primary area in which to use cosourcing. This may be especially true for small audit shops that have difficulty staffing information-technology auditors.