5 questions to ask when sourcing internal audit services

Subject-matter expertise, specialization, and relevant financial services industry experience are all critical when executing internal audits.

At a high level, organizations should engage providers that have demonstrated experience conducting internal audits in the financial services industry. But it’s also important to see the individual resumes of the people who will be working in a co-sourcing or staff augmentation arrangement.

For example, what if an individual is billed as a banking internal audit specialist but spent most of his or her career performing external financial statement audits and only recently switched to internal auditing? External auditing is a different process and context from internal auditing, so that person might not have yet developed the complete and relevant skill set.

Even if individuals have plenty of banking internal audit experience, it’s important that their areas of focus align with the organization’s needs. Whether it’s regulatory compliance, financial crime, operational risk, credit, or IT, some internal audit topics can be highly specialized. Organizations might not want a generalist or specialist without the right knowledge and skills and from a different area handling an audit.

Not every internal audit co-sourcing or outsourcing provider operates on a model in which its own full-time employees perform the work. Some third-party internal audit providers might secure an engagement and then immediately turn around and subcontract some of those internal audits to another provider.

For some financial services organizations, that arrangement could work fine, but it’s important that they understand how the work is being executed and what risks might result. Fourth parties can introduce additional variables and uncertainty, which might not align with the organization’s expectations or risk tolerance.

When sourcing internal audit services, organizations should ask whether the provider under consideration has experience executing similar projects and whether it plans to use its own full-time employees or potentially work with fourth parties.

The core role of internal audit is to provide oversight, assurance, and critical challenge, which requires that internal auditors remain impartial, independent in their judgments, and conflict free.

Sourcing internal audit services from a third-party provider that has a potential conflict might compromise the level of support and critical challenge the organization receives from internal audits, and it could even draw negative attention from your regulators. For example, if the third-party provider also provides consulting services for the organization’s business operations and management, conflict is present.

Knowing which organizations have current conflicts is a critical first step. But the financial services industry is a dynamic environment, and larger organizations might regularly initiate new engagements with external providers.

The internal audit provider might be conflict free today, but what if it takes on a project for the organization’s business teams in a month or a year? If there’s any possibility that the provider might provide business consulting in an area that overlaps with its internal audit services, the organization could have to start over and find a new provider to meet its co-sourcing or staff augmentation needs.

To avoid this scenario, it’s important to ask how an internal audit provider handles potential conflicts and whether it can commit to remaining conflict free for as long needed.