Co-Sourcing and Outsourcing Risk Expertise

Introduction
Few internal audit functions possess every skill required to provide assurance over an organization's full risk universe. Cyber threats, derivative valuation, actuarial modeling, ESG metrics, data analytics, construction cost auditing, and emerging-technology risk all demand specialized knowledge that a typical in-house team may not hold. The IIA's framework anticipates this reality and sets clear expectations about how the Chief Audit Executive (CAE) may bring in external expertise while still protecting the quality, independence, and accountability of the internal audit activity. This guide explains why this topic matters for the CRMA exam, what co-sourcing and outsourcing actually mean, how the arrangements work in practice, and how to recognize and answer exam questions on the subject.

Part 1: Why This Topic Is Important

1.1 Relevance to the CRMA exam
The CRMA syllabus is built around internal audit's role in risk management assurance. Within the Internal Audit Roles and Responsibilities domain, the exam tests whether you understand that the CAE must (a) maintain or obtain the competencies needed to perform risk-based engagements and (b) remain accountable for the work regardless of who performs it. Questions on sourcing of expertise test judgment: when must the CAE seek outside help, what safeguards are required, and who ultimately owns the outcome?

1.2 Relevance to the profession
Risk landscapes change faster than audit staffing plans. Co-sourcing and outsourcing give the CAE flexibility to deploy specialist skills exactly when a risk-based plan requires them, without permanently hiring for every niche. At the same time, badly managed external arrangements create real hazards: loss of institutional knowledge, impaired objectivity, confidentiality breaches, inconsistent quality, and a mistaken belief by management that responsibility for internal audit has been transferred to a vendor. Understanding both sides is essential for a risk management assurance professional.

1.3 Link to the Standards
Under the 2017 International Standards for the Professional Practice of Internal Auditing (IPPF), the core references are:
• Standard 1210 Proficiency, especially 1210.A1: the CAE must obtain competent advice and assistance if the internal auditors lack the knowledge, skills, or other competencies needed to perform all or part of an engagement.
• Standard 1210.A2 and A3: auditors must have sufficient knowledge to evaluate fraud risk and key IT risks and controls, which often drives the need for specialists.
• Standard 2030 Resource Management: the CAE must ensure resources are appropriate, sufficient, and effectively deployed to achieve the approved plan.
• Standard 2070 External Service Provider and Organizational Responsibility for Internal Auditing: when an external service provider serves as the internal audit activity, the provider must make the organization aware that the organization retains responsibility for maintaining an effective internal audit activity.
• Standard 2020 Communication and Approval and 2060 Reporting: the CAE communicates resource requirements and the impact of resource limitations to senior management and the board.
• Standard 1300 Quality Assurance and Improvement Program: the QAIP covers all aspects of the internal audit activity, including work performed by external providers.

Under the 2024 Global Internal Audit Standards, the same principles appear in Domain IV (Managing the Internal Audit Function), notably the standards on human resources management and competency, which state that if the function lacks the collective knowledge, skills, and abilities to complete the plan, the CAE must obtain the necessary resources, which may include outsourcing or co-sourcing, while remaining responsible for the quality of the work. Exam candidates should be comfortable with either framework's wording.

Part 2: What It Is

2.1 Key definitions
• In-sourcing (in-house model): all internal audit work is performed by employees of the organization under the CAE.
• Co-sourcing: the organization maintains its own internal audit function led by an internal CAE, but supplements it with external specialists for specific engagements, skills, geographies, or peak workloads. The external resources work under the direction and supervision of the CAE. This is sometimes called a partnership or hybrid model.
• Outsourcing: all or substantially all of the internal audit activity is performed by an external service provider. The organization may still designate an internal executive to oversee the provider, and the board remains responsible for the effectiveness of internal audit.
• External service provider: the IPPF Glossary defines this as a person or firm outside of the organization that has special knowledge, skill, and experience in a particular discipline. Examples include actuaries, IT security specialists, forensic accountants, valuation experts, environmental engineers, lawyers, statisticians, and other audit firms.

2.2 Why risk expertise specifically?
CRMA focuses on assurance over risk management processes. Risk-based audit plans increasingly point toward areas where a generalist auditor cannot reach a sound conclusion without technical help: model risk in financial institutions, cyber resilience, cloud security configurations, complex hedging strategies, pension obligations, climate risk disclosures, AI governance, and major capital projects. The Standards do not allow the CAE to simply skip these high-risk areas because of a skills gap. Instead, the CAE must either develop the skill internally, obtain it externally, or clearly report the resulting limitation to the board.

2.3 Advantages and disadvantages
Advantages of co-sourcing: access to deep specialist knowledge on demand; scalability for peak periods or one-off projects; knowledge transfer to in-house staff; retention of organizational knowledge and relationships; the CAE retains direct control over methodology and reporting; often more cost-effective than hiring rare skills full time.
Disadvantages of co-sourcing: coordination and supervision effort; potential inconsistency in methodology; cost per hour can be high; confidentiality and data-access controls must be managed; risk of over-reliance on a single provider.
Advantages of outsourcing: broad skill pool; independence from internal politics may be perceived as stronger; potentially lower fixed cost for small organizations; quick establishment of a function where none existed.
Disadvantages of outsourcing: loss of institutional knowledge and continuous presence; the provider may lack understanding of culture and strategy; dependence and switching costs; possible conflicts if the provider also performs other services; management may wrongly assume accountability has shifted; weaker ongoing relationship with the board unless deliberately managed.

2.4 The accountability principle
The single most important concept to carry into the exam is this: the CAE and the organization cannot outsource accountability. When co-sourcing, the CAE remains responsible for the engagement, the conclusions, and the quality of the work. When fully outsourcing, the board and senior management remain responsible for maintaining an effective internal audit activity, and Standard 2070 requires the provider to make this explicit.

Part 3: How It Works

3.1 Step 1 – Identify the competency gap
The process begins with risk assessment and planning (Standard 2010). As the CAE builds the risk-based plan, each engagement is mapped against the knowledge, skills, and other competencies of the team. A skills inventory or competency matrix highlights where gaps exist. The CAE then decides whether to train staff, hire, use guest auditors from other departments (subject to objectivity rules), co-source, outsource, or defer the engagement with disclosure to the board.

3.2 Step 2 – Decide the sourcing model and obtain support
The CAE evaluates cost, urgency, frequency of need, sensitivity of the area, availability of providers, and strategic importance. Resource decisions and any limitations are communicated to senior management and the board under Standards 2020 and 2030. For a fully outsourced model, the board typically approves the arrangement and the designated oversight executive.

3.3 Step 3 – Perform due diligence on the provider
Before engaging an external service provider, the CAE should assess:
• Competence: professional certifications, licenses, relevant experience, references, and reputation.
• Independence and objectivity: any financial, personal, or business relationships with the organization or with the area under review; whether the provider has designed or operated the controls it would be assessing; whether the provider is the organization's external auditor (for U.S. public companies, the Sarbanes-Oxley Act prohibits the external auditor from providing internal audit outsourcing services, and similar restrictions exist in other jurisdictions).
• Capacity and continuity: ability to staff the engagement with appropriately qualified people throughout its duration.
• Confidentiality and data security: controls over sensitive information, compliance with privacy regulations, and willingness to sign nondisclosure agreements.
• Insurance and legal standing: professional liability coverage and absence of disciplinary issues.

3.4 Step 4 – Document the engagement in a formal agreement
A written contract or engagement letter should specify: scope, objectives, and deliverables; timelines; roles and responsibilities, including that the CAE directs the work; adherence to the IIA Standards and the internal audit charter and methodology; ownership of working papers and access to them by the organization and regulators; confidentiality obligations; fees; performance measures; conflict-of-interest disclosures; and termination provisions. For fully outsourced arrangements, the agreement must reflect Standard 2070's requirement that the organization retains responsibility for an effective internal audit activity.

3.5 Step 5 – Supervise, review, and integrate the work
External specialists are subject to the same engagement supervision as internal staff (Standard 2340). The CAE or a designated internal auditor reviews planning documents, working papers, evidence, and draft communications; ensures conclusions are supported; and confirms the work meets the Standards and the Code of Ethics. The CAE decides how the specialist's results are reflected in the final report and may reference the specialist's involvement. Where the CAE has relied on an external specialist and cannot independently verify the technical conclusions, this should be understood and documented, but the CAE still signs off on the engagement.

3.6 Step 6 – Evaluate and include in the QAIP
The quality assurance and improvement program covers work performed under co-sourcing and outsourcing. The CAE evaluates provider performance against the agreement, gathers client feedback, tracks knowledge transfer, and considers the results in future sourcing decisions. External quality assessments of the internal audit activity must also encompass outsourced work.

3.7 Practical illustrations
• A regional bank's audit plan includes a review of the credit risk model used for loan loss provisioning. No internal auditor has quantitative modeling skills. The CAE co-sources a model validation specialist, retains leadership of the engagement, reviews the specialist's testing, and issues the report under internal audit's name.
• A small not-for-profit with no internal audit staff outsources the entire function to a firm. The audit committee appoints the CFO's deputy as liaison, approves the firm's annual plan, and receives reports directly from the firm. The engagement letter states that the board remains responsible for maintaining an effective internal audit activity.
• A manufacturing company's external auditor offers to perform the internal audit of inventory controls at a discount. The CAE declines because the external auditor would be reviewing controls it relies upon for the financial statement audit, creating an independence conflict, and because regulatory rules prohibit it for this listed company.

Part 4: Common Pitfalls and Misconceptions
• Believing outsourcing transfers responsibility to the vendor. It does not.
• Assuming the CAE can refuse to cover a high-risk area simply because the team lacks skills. The Standard requires obtaining competent advice and assistance, or at minimum reporting the limitation.
• Treating a specialist's report as a substitute for internal audit supervision and review.
• Overlooking the objectivity of the provider, especially where the provider also consults for management or has designed the system being reviewed.
• Confusing co-sourcing (supplementing an internal function) with outsourcing (replacing it).
• Neglecting to secure ownership of and access to working papers, which can create problems for regulators, external assessors, and future audits.
• Failing to plan for knowledge transfer, which leaves the organization dependent on the provider.

Exam Tips: Answering Questions on Co-Sourcing and Outsourcing Risk Expertise

Tip 1 – Anchor on accountability. Whenever an answer option suggests that an external provider, management, or the board 'takes over' responsibility for the quality or conclusions of internal audit work, treat it as a distractor. The best answer almost always keeps the CAE responsible for engagement quality and keeps the organization responsible for maintaining an effective internal audit activity.

Tip 2 – Know the trigger in 1210.A1. The CAE must obtain competent advice and assistance when internal auditors lack the knowledge, skills, or other competencies for all or part of an engagement. If a question describes a skills gap in a high-risk area, the correct response is usually to obtain external expertise or communicate the limitation to the board, not to drop the engagement quietly or assign an unqualified auditor.

Tip 3 – Distinguish co-sourcing from outsourcing precisely. Co-sourcing keeps an internal function and an internal CAE who directs the external specialists. Outsourcing replaces the function with an external provider. If a question asks which model preserves institutional knowledge and continuity, choose co-sourcing. If it asks about Standard 2070, the context is outsourcing.

Tip 4 – Due diligence beats cost. When options present factors for selecting a provider, prioritize competence, independence, objectivity, and confidentiality over price. The 'lowest cost' answer is rarely correct unless all other factors are equal.

Tip 5 – Watch for independence conflicts. Scenarios involving the external auditor, a vendor who implemented the system under review, or a consultant who advised management on the same area are testing objectivity. The right action is to identify the impairment and either reject the provider or implement safeguards and disclose.

Tip 6 – Supervision applies to everyone. External specialists are supervised and their work is reviewed under Standard 2340 just like internal staff. Options stating that the specialist's work 'does not require review because of their expertise' are wrong.

Tip 7 – Remember the board communication link. Resource limitations and significant sourcing decisions are communicated to senior management and the board (Standards 2020 and 2030). Answers that bypass the board for major resource decisions are usually incorrect.

Tip 8 – Link to the QAIP. If a question asks whether outsourced or co-sourced work falls under the quality assurance and improvement program or an external quality assessment, the answer is yes.

Tip 9 – Read for the 'best' answer, not a merely 'acceptable' one. CRMA questions frequently offer several plausible actions. Choose the one most aligned with the Standards: assess competence and objectivity first, formalize the arrangement in writing, retain direction and review, and report appropriately.

Tip 10 – Use elimination on absolutes. Words such as 'always,' 'never,' 'fully transfers,' or 'no longer responsible' usually signal a wrong answer in this topic because the Standards emphasize retained accountability and professional judgment.

Practice Questions

Question 1. An internal audit activity's risk-based plan includes an assessment of the organization's cybersecurity incident response capability. None of the auditors has IT security expertise. According to the Standards, the CAE should most appropriately:
A. Remove the engagement from the plan because the team is not proficient.
B. Assign the engagement to the most experienced generalist auditor and accept the limitation.
C. Obtain competent advice and assistance from a qualified external specialist and retain responsibility for the engagement.
D. Ask the IT department to perform a self-assessment and report the results as internal audit's conclusion.
Answer: C. Standard 1210.A1 requires the CAE to obtain competent advice and assistance when the team lacks the needed skills. Option A ignores the high-risk area, B knowingly uses an unqualified resource, and D abandons independence.

Question 2. A company has fully outsourced its internal audit activity to a professional services firm. Which statement is correct?
A. The firm now bears sole responsibility for maintaining an effective internal audit activity.
B. The organization retains responsibility for maintaining an effective internal audit activity, and the firm must make the organization aware of this.
C. The board no longer needs to approve the internal audit plan.
D. The QAIP is not required because the firm has its own quality control system.
Answer: B. This is the direct requirement of Standard 2070.

Question 3. Which of the following is the most important factor for a CAE to evaluate before co-sourcing a derivatives valuation specialist?
A. The hourly rate compared to other providers.
B. Whether the specialist has existing business relationships with the treasury function being audited.
C. Whether the specialist is based in the same city as head office.
D. Whether the specialist is willing to use the organization's report template.
Answer: B. Objectivity and independence of the provider are paramount; a relationship with the auditee could impair the credibility of the conclusions.

Question 4. A CAE engages an external forensic accountant for part of an investigation. Which statement about supervision is correct?
A. The forensic accountant's work requires no review because of the specialist's expertise.
B. The CAE must supervise and review the work to ensure objectives are achieved, quality is assured, and the Standards are met.
C. Only the audit committee may review a specialist's work.
D. Supervision is required only if the specialist is a former employee.
Answer: B. Standard 2340 applies to all engagement work, including that of external specialists.

Summary
Co-sourcing and outsourcing are legitimate, Standards-supported ways for the CAE to bring risk expertise into the internal audit activity. The CAE identifies competency gaps through risk-based planning, selects a sourcing model, performs rigorous due diligence on competence and objectivity, formalizes the arrangement in writing, supervises and reviews the work, reports resource decisions and limitations to the board, and includes external work in the QAIP. Above all, remember the exam's recurring theme: expertise can be sourced externally, but responsibility for the quality of internal audit work and for maintaining an effective internal audit activity always remains with the CAE and the organization.