Are enterprises allowed to outsource their internal audit activities? Pros and Cons?

Can enterprises outsource their internal audit?

According the Clause 3, Article 10, Decree No. 05/2019/ND-CP date 22 January 2019:

“Enterprises may hire firms that are allowed by law to provide independent audit services to provide internal audit services for the enterprises. In this case, enterprises must ensure the fundamental internal audit principles and other requirements as prescribed in the Article 5 and Article 6 of the Decree No 05/2019/ND-CP.”

What are the benefits and limitations of outsourcing Internal Audit service?

Depending on specific situations, enterprises should consider the following benefits of outsourcing services:

• Helping enterprises meet deadlines: Outsourcing can be effective in the case of the shortage of in-house staff as audit firms often have available resources for internal audit services. It normally takes enterprises long time and much effort to build up a in-house personnel that meet high-level criteria of knowledge and skills.
• Saving effort and time for the management:Managing and directing a full - scope internal audit department will take more effort and time for the enterprises’ management rather than outsourcing. The more staff the enterprises have the more effort and time the enterprises spend on recruitment, management, training, human resource development, lay off ... Time and effort of the management should be focused more on business strategy that could bring more values to the enterprises.
• Saving more costs for enterprises: The fact is that the outsourcing fee for each audit engagement may be high, but the total outsourcing fees can be lower than the total costs that enterprises spend to maintain the internal audit department (e.g. salary and bonuses, compulsory insurance, income taxes, training costs, additional administrative costs due to additional departments, union costs, office rentals, equipment expense, business trip, allowances, etc.). The total costs will increase even more if enterprises have many units/sectors spreading across the country, or abroad. Outsourcing services may help to the enterprises to minimize recurring costs.
• Quality of internal audit can be maintained better: Audit firms are likely to maintain better internal audit personnel as their personnel are exposed to more intensive training and more engagements. Proper internal training is always a problem for enterprises. In addition, audit firms are likely to often have more new ideas because they have opportunities to learn from many clients, many industries, and regularly updated with legal information and professional knowledge. Their new ideas may help enterprises improve their processes, increase efficiency and profit growth.
• Independence and objectivity can be better: Internal audit personnel have to maintain independence and objectivity, however, regular meeting and interaction within a same working environment may create risks to independence and objectivity, such as similarity, close relationship,…. Therefore, outsourcing may help to reduce these risks. It is one of the important reason that many enterprises choose to use the outsourcing service.
• Taking advantage of reputable brands of audit firms: Reputable brands of audit firms may increase the trust of business partners on the enterprises’ business performance and risk management. Therefore, enterprises may have more advantages and incentives from the business partners.

In other side, outsourcing may have the following limitations, needing corresponding solutions:

• There may be technical issues that the outsourced auditors can’t understand as thoroughly as insiders: This is inevitable and therefore if outsourcing, enterprises should assign a suitable coordinator who is responsible for cooperating and communicating with the outsourced auditors to help them perform their work effectively. In addition, depending on the nature and size of the business, enterprises may consider outsourcing internal audit activities partly for fully. In our opinion, for the activities that outsourced auditors could hardly do them effectively and efficiently, enterprises should try to implement them on their own.
• Feel uncertain about work quality and information confidentiality: This is a normal worry when considering outsourcing services. To help mitigate this risk, enterprises need to perform a thorough due diligence on the service providers. Service providers need to fully meet the requirements regarding reputation, expertise and human resources. Enterprises should approve about 2-3 qualified providers so as to ensure their availability when needed.
• Costs exceeding the budget: This issue can be solved when enterprises discuss with service providers to determine what is the best audit plan and scopes for the budget. In addition, enterprises can negotiate with service provider for more for discounts to maintain a long-term relationship.
• Reporting on the audit results may be delayed or unclearly enough: In all cases of outsourcing, enterprises should always assign a person who are responsible for following up the outsourced work and audit results to ensure timely and clear reporting. Enterprises should also ask the service providers to attend internal meetings explaining audit results where and when required.