In entrepreneurship, especially in our context, internal audit is still very little used. However, it is an important tool to ensure satisfactory performance for any type of organisation. It is not uncommon for a lack of questioning to lead to inefficiencies and ineffectiveness. A questioning cannot take place without an evaluation aimed at answering a number of questions:
- Are there better governance alternatives?
- Is the governance of the organisation in line with its objectives and its
vision?
- Is the reporting done by the managers, whether it is financial,
operational or commercial: is it correct? is it relevant? is it appropriate?...
- Is there a risk assessment system and a control capable of mitigating the
risks related to the context of the organisation?
- Are the organisation's data secure? Etc.
In the absence of being dangerous, management without questioning does not guarantee optimisation, a source of enrichment for any organisation and thereby its shareholders.
Among the responses to the aforementioned dysfunctions, internal audit holds a good position.
So what is internal audit?
What is its function within an organisation?
What are the constraints to implementing an internal audit function?
How can the constraints of its implementation be mitigated by outsourcing the internal audit function?
How does appropriate outsourcing of this function make it more effective and increase its quality and performance?
Internal audit
Internal audit is an independent and objective activity that provides an assurance opinion on the level of control over operations, makes recommendations for improvement, and helps create value.
What is the purpose of the internal audit function?
The internal audit function helps an organisation achieve its objectives by assessing its risk assessment, control, and governance system, and then formulating recommendations.
What are the constraints to establishing an internal audit function?
Indeed, establishing an internal audit function can prove difficult, especially for small and medium-sized enterprises:
Objectivity
When the internal audit function loses its independence, it will no longer be objective and therefore will not be able to assess objectively and will no longer make unbiased recommendations.
Audit is primarily about impartiality in both the exercise and the outcome. However, especially in SMEs, the existing governance system does not guarantee the independence of internal auditors who are subordinated to management without the existence of an audit committee.
For small organisations, the need for efficiency exposes the audit function to the risk of performance on governance aspects that conflict with the exercise of the internal audit function.
The required expertise
Depending on the type of audit, the size of the organisation, and the complexity of its activities, an organisation may express a need for skills and experience that are not available in the local job market.
In addition, certain aspects of internal audit require specialised expertise in areas that the company or organisation may lack internally.
Resources
Aside from expertise and skills, the organisation may find it less economical to have an internal audit function, which can generally be linked to the size of the organisation and its complexity.
Indeed, a small organisation may be inefficient in establishing an internal audit function because the costs of maintaining it and the salaries will exceed the benefits it provides to the company.
In situations of complexity and instability, the internal audit function may often rely on experts to assess the specialised and changing aspects of the organisation, making the internal audit function very costly.
Outsourcing the internal audit function
In order to overcome the constraints we have mentioned, outsourcing may prove to be the solution in more than one respect:
- Outsourcing the internal audit function can increase its independence and therefore its objectivity, as the provider has no hierarchical link within the organisation and no familiarity with the organisation's staff.
- Outsourcing the internal audit function is likely to have a greater probability of covering the expertise required by the company due to the variety of experience of its members and the missions in its portfolio.
- An outsourced internal audit function carries with it economies of scale. However, it is important that the external provider implements all controls to mitigate the risks associated with conflicts of interest.
In addition to being a response to the constraints of establishing an internal audit function, the outsourcing of the internal audit function, due to its contractual nature, imposes professional requirements related to results that are higher than those of an internal function.
The outsourcing of the internal audit function can also take the form of a one-off arrangement, co-sourcing, or subcontracting.
It can take the one-off form when there is an internal function but the company believes it does not have enough resources to carry out its audit plan, in which case it can call upon an external provider.
Co-sourcing exists when, without a subordinate relationship, the external provider supports the internal audit team either on a specific aspect of a mission or to evaluate its work within the framework of its quality system in relation to its degree of compliance.
In the case of subcontracting, there is an internal audit manager within the organisation who establishes an annual audit plan, schedules internal audit missions, and assigns work to an external provider who reports directly to them.
As is the case with the selection of any external provider, the organisation must still evaluate the following points before outsourcing its internal audit function to a provider:
- Establish the terms of reference
- Assess the competence of the provider and its members
- Assess the independence of the provider and its members
- Set up a system for evaluating the external provider.
Conclusion
Outsourcing the internal audit function is the most suitable solution for small and medium-sized enterprises as it offers a lever for cost optimisation, provides expertise that they are unlikely to find internally, and guarantees an independence that an embryonic governance system cannot provide.
In a situation of high instability and great complexity, it can prove to be the best alternative due to the diversity of expertise within these teams.
However, it is important that the organisation has established the terms of reference in advance, assessed the skills and independence of the provider, and set up a system for evaluating their services.
There are other forms of outsourcing besides total outsourcing: co-contracting, temporary outsourcing, and subcontracting.
