Internal audit is an extremely valuable tool of governance. Governance becomes more challenging if the organization is multi-location and decentralized and in these cases internal audit is invaluable.
Why not have all staff required for internal audit on board?
No audit professional or any experienced manager will dispute the fact that best results are obtained in internal audit through an in-house team. It is pretty difficult to transfer all the knowledge, insights and updates of an organization to an outsider. And yet there are other challenges like budget and fluctuating scales which make it worthwhile, thus makes co-sourcing a better option.
Benefits of co-sourcing internal audit
Cost efficiency: India has a huge pool of skilled professionals and indeed the speed with which the accounting and audit is getting digitised around the world the geographical barriers between service providers and clients is vanishing. So, it is fair to say that a pool of efficient internal audit professionals is available and their services are available at much more competitive prices than cost of retaining a professional full-time.
Though recognition of importance of internal audit has been increasing over the years, yet more often than not settling on a budget for IA is a challenge. Competitive prices for internal audit are helpful when a bargain has to be made by those in support of increasing the effectiveness of governance through internal audit with the naysayers.
Effectively dealing with variation in IA man hour requirement over a period of time: The organisation would normally finalize an audit plan based upon the risk matrix, to decide the frequency, extent and area/ process to be covered by the audit. This plan would require a certain number of staff of the requisite seniority to be on board. And the exercise needs to be carried within a certain time-frame for audit findings to remain relevant. This requirement more often than not tends to vary from period to period depending upon business realities. If the entire IA team is in-house there are times when they are hard-pressed to carry out the audit plan and at other times there may not be enough to occupy the IA staff. Neither is easy to accommodate IA staff in alternate roles due issues of independence. The other alternate is dilution of the audit plan by delaying or curtailing some audits, which is not desirable. More often than not IA function is facing the challenges of either under-staffing or over-staffing.
The above problem is more acute in those organisations which have project nature of business. In these cases, the number of branches or sites will change and vary widely from year to year. The volume of transactions may also vary significantly. And so, the manpower requirements for internal audit from period to period will vary widely.
The best solution is thus to have a core group of IA staff and purchase additional skills from the market as and when required.
Degree of automation: In organizations where degree of automation is low and large part of the records are manual it will necessarily involve higher degree of manpower and man-hours to cover the requisite sample size. They face larger challenges in terms of budget and manpower requirement fluctuations. So, it makes all the more sense for such organizations to go in for co-sourcing.
Challenges of Co-sourcing and beneficial partnership with core IA team
Now for the challenges of outsourcing and how co-sourcing SMPs while having a core IA team can help organisations overcome the challenges.
Appointment, co-ordination with the firms and continuous monitoring the quality of reports: The success of the entire audit arrangement depends on choosing the firm with requisite proficiency and commitment to carry on the tasks. Though CA firms are available in plenty, especially in metro and large cities, finding a suitable fit for the job is a big challenge. A match has to be found for the particular sort of skills required by the organization with the talent available. This determination is difficult and it is also continuous.
A suitable audit plan needs to be developed for the organization.
It is a continuum to monitor the quality of work of the firm as, among various other challenges, skilled and trained staff (they might have been trained previously by organization as well as by the firm) may leave or be held up for other conflicting assignments. Moreover, a productive engagement cannot be easily made by a person who is not a professional auditor.
If the organization does not have an in-house IA Department, it is a distinct possibility that the other departments will be unwilling to taking up all the above-mentioned onerous duties and moreover, they might not have neither the inclination nor the skill to carry on the duty effectively. So, a core IA function spear-heading the IA activities is a must for all organizations.
Understanding the business of the organisation: The External firm is an ‘Outsider’, so not understanding the nuts and bolts of the business may severely impair the quality of their audit. The in-house IA staff has an upper hand in understanding the business. For co-sourcing to be successful, core IA team will need to support, train and orient the firms in this learning curve on policies, procedures, org structure, working paper requirements, challenges and project/business objectives of the organisation. All updates of movements, policies, significant events in the organisation need to be passed on to the firm by the core team to help them effectively draw up the risk scenario and plan audit procedures accordingly.
Organize and arrange audits– This mundane but unavoidable task will have to be undertaken by an in-house team only. Besides arranging logistics for the audit team, it involves liaising between firms and process owners for scheduling the audits, holding the opening and closing meetings of audits, field visits and so on.
The audit firm will need to be equipped with necessary tool kit and financial data and background information for conducting the audit. This job, again, has to be done by an insider.
For a successful co-sourcing arrangement, it is best that core IA team and the outsourced firm together decide the risk scenario and based upon it finalize the audit program. This will ensure that no requisite information falls through the gap.
Ensuring Smooth conduct of audit: A core IA team helps liaise between co-sourced audit team and the business process owners. On the one hand it needs to monitor if all the scope is being properly covered and within the agreed timelines by the co-sourced firm and on the other hand ensuring all information required by the auditors are being made available to them by the process owners. Occasionally the core team may also be required to step in to smooth ruffled feathers on either side, like to alert the auditor if they are being ‘overzealous’, or to counsel the process owner that they need not be defensive.
A core IA team will make sure that the audited location is kept aware of the findings.
Bridging the skill gap: The language of the report needs to be checked for quality and tenor. It is not unusual to encounter skill gaps in outsourced small and medium practitioners which core IA team needs to cover to ensure smooth outcome of audit. For eg. a firm who is very good at finding gaps might have a challenge with language in conveying it crisply. In such cases core IA team may require to do some editing in the reports. Another example can be cited is that of writing under recommendations some thing which is simply the reverse of the observation, say the observation is ‘Leave application not submitted on time’ and recommendation goes ‘Leave application should be submitted on time’; the moderator from core IA team in such cases can require the firm to find out underlying flaws in the process or environment to understand why the exceptions are coming and write mitigating measures for such in the recommendations.
On the contrary, it is also possible that a certain technical expertise required for the audit may not be available with the core audit team but may be possessed by an SMP.
Quality of responses: After the audit is complete and the observations have been shared with process owners a core IA team will help immensely in making the process owners understand issues, bring them out of denial and draft professional and appropriate responses and thus time bound actions to audit observations, as the requirement may be. For eg. The core team may require the response to be modified from a casual ‘Will take care in future’ to something more substantial, accountable and time bound.
Driving home the message, helping progress on the value chain: Discussing the current audit report is very important and a core IA team jointly with co-sourced firm may carry out a dialogue on it with all the process owners and stake holders at the end of the audit to make the audit worthwhile including emphasizing the importance of transparency and good governance and explaining organization stand on various ethical issues. However, a core IA team will also have a grip on the trend or progress or otherwise of the process or organization along the value chain which the firm who is rendering a one-time service may not be able to so easily. And it is important to keep a focus on that. For eg. Say the organization lacked a system for tracking sales promotion items. And, since then, a tracking system has been put in place and is being executed in a time-bound manner. Now, if the external firm flags tracking of sales promotion as an issue without taking into account the plans put in place it will ruffle the process-owners’ feathers. Information gaps like this will be required to be filled in or focus may be required to be brought in on the broader picture by a core IA team.
Summarizing findings for top management: The reports in lengthy transactional form is discussed with the process owners and the strategic and control issues are suitably communicated to the Senior Management Team. The support from SMPs who have assisted in the audit is invaluable in this often detailed and painstaking, but necessary exercise.
Other benefits of co-sourcing and Conclusion
Other factors in support of co-sourcing: SMPs who do internal audit may also help do forensic work and help investigate red-flags thrown up during internal audit as well as any complaints received through whistleblowing hotlines or any special reviews ordered by audit committee or senior management.
Overall, Co-sourcing is a win-win situation for both the corporate as well as the small and medium practitioner. While the corporate benefits by creating efficiency while controlling costs, for the SMPs this is a valuable market and sound professional exposure.