Managing External Providers of Internal Audit Services (CIA Part 3: Internal Audit Operations)
Introduction
Many internal audit activities do not perform all of their work with in-house staff. They may outsource the whole function, co-source part of it, or bring in specialists such as IT security experts, actuaries, forensic accountants or environmental engineers. The CIA Part 3 exam tests whether you understand how the Chief Audit Executive (CAE) selects, oversees and remains accountable for these external service providers (ESPs). The topic sits within Internal Audit Operations and links to the IIA standards on resource management, proficiency, independence, objectivity and quality assurance.
Why It Is Important
1. Accountability cannot be outsourced. The work can be delegated to a provider, but the CAE and the board stay responsible for the internal audit activity. If a provider performs poorly, the internal audit function's credibility suffers.
2. Skill gaps are common. Few internal audit teams have deep expertise in cybersecurity, data analytics, derivatives, regulatory compliance or construction auditing. External providers help the CAE achieve the plan with the right competencies.
3. Independence and objectivity risks. A provider might also be the external auditor, or might have consulted on the very system it is now auditing. This can create impairments that must be managed and disclosed.
4. Cost and efficiency. Outsourcing can give flexibility, but it must be justified and its value monitored.
5. Conformance with Standards. Work performed by outside parties must still conform with the IIA's Global Internal Audit Standards (formerly the IPPF Standards). The internal audit activity can only claim conformance if this work also conforms.
What It Is
An external service provider is a person or firm outside the organization that has special knowledge, skill and experience in a particular discipline. Common sourcing models include:
- Full outsourcing: An external firm performs the entire internal audit activity. A liaison inside the organization, usually a senior manager acting as the internal audit contact, oversees it.
- Co-sourcing: In-house staff and an external provider share the work. The in-house CAE usually keeps leadership.
- Guest auditors or subject-matter experts: Specialists are engaged for specific engagements or tasks, such as an actuary valuing pension liabilities or an IT specialist testing penetration controls.
- Use of other assurance providers' work: The CAE relies on the work of other internal or external assurance providers rather than redoing it.
Key standards and guidance concepts include:
- Resource management: the CAE must make sure resources are appropriate, sufficient and effectively deployed.
- Coordination and reliance: the CAE should coordinate with other providers and assess whether their work can be relied upon.
- Competency and due professional care.
- Independence and objectivity.
- The Quality Assurance and Improvement Program (QAIP).
- Under the Global Internal Audit Standards, an outsourced CAE may be engaged. The board must still be informed, and the provider must conform with the Standards.
How It Works: The Life Cycle of Managing an External Provider
Step 1: Identify the need
The CAE compares the audit plan with the skills and capacity available. Gaps in expertise, peaks in workload, geographic reach, or the need for an independent view all point toward using an ESP. The CAE also weighs cost, confidentiality and knowledge-transfer goals.
Step 2: Assess competence
The CAE should evaluate:
- Professional certifications, licenses and memberships (CIA, CPA, CISA, actuarial credentials).
- Relevant experience in the industry and with the type of engagement.
- Reputation, references and quality of prior work.
- Knowledge of the IIA Standards and the provider's own quality control.
Step 3: Assess independence and objectivity
The CAE should consider:
- Financial interests in the organization.
- Personal or professional relationships with management or the board.
- Prior or current services to the organization, such as consulting on the area to be audited, or acting as external auditor.
- Compensation arrangements that might bias results.
If impairments exist, the CAE decides whether to use the provider, applies safeguards, or discloses the impairment to the appropriate parties.
Step 4: Define the scope through a written agreement
The engagement letter or contract should specify:
- Objectives, scope and deliverables.
- Timelines and milestones.
- Responsibilities of each party.
- Required conformance with IIA Standards and the Code of Ethics.
- Access to records, personnel and working papers. The organization should keep the right to review and keep the working papers.
- Confidentiality and data-protection requirements.
- Reporting lines and communication protocols.
- Fees, billing and terms for ending the contract.
- Right-to-audit clauses and quality review rights.
Step 5: Supervise and monitor the work
The CAE, or a designee, should:
- Review and approve work programs.
- Monitor progress against milestones.
- Review working papers to confirm the evidence is sufficient, reliable, relevant and useful.
- Check that conclusions are supported.
- Hold regular status meetings.
Supervision should be scaled to the provider's experience and the risk of the engagement.
Step 6: Evaluate and use the results
The CAE decides whether the work is adequate to rely on. If it is, the results are incorporated into internal audit reports. If not, the CAE requires extra work or limits reliance. The CAE is responsible for the final opinions and communications to the board.
Step 7: Communicate with the board and senior management
The board should understand:
- The sourcing strategy.
- Material use of ESPs.
- Any independence issues.
- How quality is assured.
The board typically approves the internal audit plan and resource plan, including significant outsourcing.
Step 8: Quality assurance and performance evaluation
ESP work falls within the QAIP. Internal assessments should cover it. External quality assessments review the whole activity, including outsourced work. The CAE should also evaluate the provider's performance at the end of each engagement or contract to inform renewal decisions.
Special Situations
- External auditor providing internal audit services: This raises independence concerns for both functions. Many jurisdictions restrict it, for example the Sarbanes-Oxley Act in the US. The CAE and board must evaluate the effect on objectivity.
- Fully outsourced function: The organization should name a competent internal person to oversee the provider. The provider must conform with the Standards. The board keeps responsibility for overseeing the internal audit function.
- Knowledge transfer: Co-sourcing arrangements often include requirements for the provider to train in-house staff.
- Reliance on others' work: Before relying on another provider's work, the CAE assesses their competence, objectivity and due professional care. The CAE also confirms that the scope, objectives and results suit internal audit's purposes.
Advantages and Disadvantages of Using External Providers
Advantages:
- Access to specialized expertise and technology.
- Flexibility to scale resources up or down.
- A fresh, independent perspective and benchmarking against other organizations.
- Possibly lower fixed costs.
- Wider geographic coverage.
Disadvantages:
- Less knowledge of the organization's culture and processes.
- Possible threats to independence and objectivity.
- Higher hourly costs and the risk of dependency.
- Confidentiality and data security risks.
- Less continuity and loss of institutional knowledge.
- Weaker development of in-house staff.
Exam Tips: Answering Questions on Managing External Providers of Internal Audit Services
1. Remember who is ultimately responsible. The CAE, under board oversight, stays accountable for the internal audit activity even when work is outsourced. Eliminate answers that suggest responsibility shifts to the provider.
2. Competence and objectivity come first. When asked what the CAE should do first or most importantly before engaging a provider, look for answers about assessing competence (qualifications, experience) and independence or objectivity (relationships, conflicts).
3. Watch for the external auditor trap. If a scenario involves the external auditor doing internal audit work, think about independence threats to both functions, legal restrictions, and the need to disclose to the board.
4. Know what belongs in the contract. Typical correct answers include scope, deliverables, conformance with Standards, access to and ownership of working papers, confidentiality, and timelines. Answers that let the provider keep sole ownership of working papers or deny the CAE access are usually wrong.
5. Supervision is still required. Even experienced providers need oversight. The CAE should review work programs and working papers and approve the results. Answers saying "accept the provider's report without review because they are experts" are wrong.
6. Reliance requires evaluation. When using others' work, the CAE must evaluate competence, objectivity and due professional care, and check that the scope fits. Blind reliance is never correct.
7. The final opinion belongs to internal audit. The CAE decides what is reported to the board and management. The provider's conclusions are inputs, not the final word.
8. Link to the QAIP. Questions may ask how quality of outsourced work is assured. The answer is usually that ESP work is included in internal and external quality assessments.
9. Read for keywords. Words like best, most appropriate, first and primary matter. For example:
- The primary reason for using an ESP is usually lack of needed expertise or resources.
- The primary concern is usually independence, objectivity or competence.
10. Board communication. Significant outsourcing decisions, independence impairments and resource limitations should be communicated to senior management and the board. Choose answers that keep the board informed.
11. Eliminate extremes. Options like "never use external providers" or "always outsource specialized work" are rarely correct. The IIA favors a balanced, risk-based judgment.
12. Practice scenario analysis. A typical question reads: "A CAE plans to engage a firm that designed the organization's ERP system to audit that system. What is the main concern?" The answer is an objectivity impairment, because the firm would be reviewing its own work.
Summary
Managing external providers means identifying needs and assessing competence and independence. It also means contracting clearly, supervising and reviewing the work, evaluating whether it can be relied on, communicating with the board, and including the work in the QAIP. Above all, remember that the work can be outsourced, but responsibility cannot. Keep that principle in mind and you will be able to answer most exam questions on this topic.
