We are regularly asked this question by clients who are looking to establish an internal audit function. As professional service providers of internal audit services on an outsourced basis, there is obviously a case to be made that we are not in a position to provide independent advice, as it relates to this question. We do, however, like to think that we put our ethics before our wallets.
In short, we believe that if your annual internal audit effort is around 5,000 hours or more, it makes sense to establish the function internally. Specialist knowledge considered necessary, can then be procured via a variety of outside service providers, delivered around a very specific scope (“co-sourcing”, in other words). With anything smaller than that, it is probably best to go the outsourced route.
The main reasons that are normally provided as to why insourcing is preferable, are “costs”, and “knowledge and experience of the organisation”.
Let us look at costs first. A service provider, charging on an hourly basis, is normally perceived as being more expensive than the salary associated with an employee. This is, however, more often than not, incorrect. It is our experience that, after taking aspects such as public holidays, annual leave, internal and external training, sick leave, internal administration and similar aspects into account, most internal resources are hard-pressed to deliver on more than 900 hours per year.
In addition, costs such as rental, electricity, IT, telecommunications, etc. should be added to the salary costs of each employee, to reflect their full costs. If the full costs per internal employee are now divided by 900 hours, a commensurate cost comparison can be performed. More often than not, the costs of the internal resource are now on the same level as that of a service provider.
Secondly, it is perceived that an internal employee gets to know the business quicker and more intimately than an outside person. This is true, especially if the personnel from the service provider providing the service are rotated (as is often the case). It is not to say that the service provider does not get to know the client. It may, however, take a bit longer.
It must be noted here that “knowledge and experience” refers to having knowledge of the organisation itself, but it also refers to knowledge and experience of aspects fundamental to the success of an internal audit function. This includes staying abreast of trends and techniques, having access to other clients’ processes to be able to benchmark, client management skills, change management skills, etc. The success of an Internal Audit function, especially during the first three years, is dependant to a large extent on what work is performed, and also on how the results are interpreted with management.
This means that a large level of experience is necessary to perform the planning, and also to facilitate issues found with management, resulting in better business processes, as well as management buy-in into Internal Audit (which is fundamental to ensuring the success of the function). So, initially, personnel with more experience (especially on the “softer” issues) are needed to deliver against a large percentage of the plan. This, then, gradually decreases over time, as the function is established. Accomplishing this within a relatively tight timeframe is easy for a service provider who utilises a partner with 20 years’, a manager with ten years’ and a clerk with two years’ experience. It is very difficult for an internal resource or internal team.
Either you need to appoint an experienced person, resulting in over qualification when he/she performs the fieldwork or underutilisation, while he/she waits for the fieldwork to be performed (as well as an “unnecessary” increase in overall costs). Alternatively, a more junior resource is appointed, resulting in inadequate planning and less buy-in from experienced and senior management.
There are also other issues to consider, like the independence and objectivity of in-house versus outsourced resources. Although we all adhere to a code of ethics, and I am very comfortable with the integrity of my fellow professionals, it does become a bit more difficult to remain objective and person-independent if you share tea-time, office gossip, sports days, and the like on a daily basis.
An in-house person may also bring his/her own Human Resources-related issues, which can be time-consuming.
Finally, an issue which should also be considered, is the accessibility of in-house staff, versus getting hold of service provider staff. This is a valid consideration highlighted in today’s world that is so focussed around communication. Again, though, a service provider will normally have a team with various individuals assigned to a client, with support staff at its offices. It is also our experience that an in-house resource, who is easily accessible, can be drawn into project accountant functions by the CEO or CFO, instead of being allowed to fulfil his or her plan.