Internal audit professional standards require each department to establish a risk-based internal audit plan. When focusing on the highest organizational risks, however, they are often likely to find a gap in the talents and skills needed to execute that plan. Although it may be tempting, ignoring risk-based audit projects when your team lacks the necessary skills is a bad idea. You could hire additional internal audit staff to close these skill gaps, but then you may be left with internal audit staffers with skills you don’t really need every day, while other resource needs go unmet. While other options exist, such as loaned staff, many chief audit executives (CAEs) opt to close the skill gap with co-sourcing.
Co-sourcing means contracting third-party subject matter experts to supplement your team’s skills to complete a planned project. Essentially, you are supplementing your existing staff by renting skills and brining them in-house for a time. You might also outsource the entire project to a third party, such as a consulting firm or other organization. In any event, you as the CAE still retain control of the project’s scope and final deliverables as a part of executing your audit plan and therefore also maintain responsibility for ensuing that everything goes well.
Do I Have to Co-Source?
While co-sourcing is not required by the professional practice standards of the Institute of Internal Auditors (IIA Standards), it can help internal audit functions meet to other long-existing IIA standards and best serve the organization in executing the audit plan.
The following IIA standards are most relevant:
- Standard 2010 – Planning: The CAE … “must establish a risk-based plan to determine the priorities of the internal audit activity.”
- Standard 1210 – Proficiency: internal audit “must possess or obtain the knowledge, skills, and other competencies to perform its responsibilities.”
Taken together, these two standards articulate the need to obtain the “knowledge, skills, and other competencies” to supplement your internal staff’s capabilities on a project-to-project basis.
Challenges with Co-Sourcing
If you previously completed co-sourced projects, undoubtedly some of these projects have not gone as well as you would have anticipated—or worse. While a lot can go right, a lot can also go wrong.
Successful co-sourcing projects depend on how well you manage the entire process, from beginning to end. Some challenges and mitigation options include:
Wrong Personalities: You hired people with the right skills, but operating management of the audited area are complaining about the people on the project.
When hiring third-party resources, you are vetting not only their technical skills, but their interpersonal skills as well. While not always practical, involve operating management of the audited area in the selection process of the individuals on the team. Remember that you are hiring the whole person, not just the technical skills. Vet both hard and soft skills. Importantly, trust your instincts. If something seems amiss, it probably is.
Wrong Skills: The people on the project end up not having the necessary skills, and the project is quickly becoming a disaster and operating management is quite upset.
A lot of effort needs to be dedicated to vetting the people assigned to the project before they commence the work. You cannot trust the firm providing the resources to understand exactly what you need or trust them to deliver on a promise. Strongly consider having frequent touch points with the third-party team and, separately, with operating personnel in the area to check in and assess progress. Not reacting to, or responding to, early warning signs of the wrong skills on the project can be disastrous. Again, always trust your instincts.
Loss of Control: The project ends up not delivering on its original objectives. You have, effectively, lost control of the project at some point.
Clearly setting the scope of the project at the outset is critical. Ensure that there are defined checkpoints and planned check-ins. Also make sure you are involved in key client interactions and review progress at interim stages. Do not wait until the end of a project to evaluate the quality of the team’s efforts and output.
Scope Disconnect: You thought you had clearly agreed on what would be included and not included in the project’s scope, but as the project progressed, you constantly found yourself asking the team why they were looking at some things that did not seem relevant or not considering things you thought were supposed to be addressed.
Setting the proper scope is critical in any project, but especially when you are using third-party resources. You are usually paying for the resources on a per-hour basis and, as they say, time is money. Be crystal clear in dictating the scope of the project. If the team has doubts at any point during the project, they should check in and seek clarification. And, if the team feels the need to change or expand scope, they should not do so without your explicit permission. Frequent status meetings on the project, as well as periodic separate meetings with the client, are highly recommended to help manage scope issues and avoid unintentional “scope creep.”
Knowledge Transfer Miscues: While the skills you needed to acquire for one project may not be fully needed on future projects, never waste an opportunity to provide your staff with new skills, at least to some degree, to be leveraged in the future. Unfortunately, the project ends, and you and your staff are left none the wiser; all the knowledge walks out the door in the heads of your co-sourced resources.
Build knowledge transfer into the project plan and explicitly state this expectation in the contract and work order governing the project. Make sure the internal staff assigned to the project also understand these expectations. Hold all parties accountable.
Deliverable Weaknesses: Generally, the work accomplished met your expectations and the audit client found the team competent and easy to get along with, but when it came time to get draft findings, interim reports, a final report draft, and workpapers, you were very disappointed with the quality of what you received. You then invest a lot of time coaching, correcting, and fixing.
Set clear expectations on workpaper standards and expectations at the beginning of the project by holding a training session and establishing a process for periodic interim reviews of workpapers throughout the project. For quality assurance purposes, it is preferable to ensure that nothing of significance is shared with client personnel without your approval. When it comes to reports and reporting, it is helpful to share examples of audit reports your department has issued in the past that might be representative of the type, style, structure, and quality you expect. Do not be bashful about asking for samples of writing from your co-sourced personnel before any work begins.
Moving Forward
Co-sourcing partners and co-sourcing projects sometimes feels like a “can’t live with them, can’t live without them” scenario.
Take your time vetting available third-party vendors, develop a relationship with key people in the firm, and dedicate all the time necessary to make these challenging projects a success. Talk with other CAEs in your industry and in your region, and be thorough. Every ounce of prevention is worth a pound of cure, as they say.
Sometimes all it takes is having someone with lots of experience co-sourcing projects to guide you, as the CAE, through some of the challenges. Hiring a confidential adviser to help you navigate co-sourcing successfully may be a worthwhile and relatively small investment, and could potentially reduce the chances that you’ll collect a few grey hairs in the process.
Hal Garyn is Managing Director and Owner of Audit Executive Advisory Services, LLC based in FL.
These are very real concerns when working with co source. Excellent article