,.C H, ,A ' ,P lT E ,,R,.

l
I

--'-l)l1]pare
: ileS.

. :ifr orga-

t/lanagement of lnternal Audit Function

-. r-.rgement.

: .:;t (ERN,I) I lrnnrurruc oeJrcrvrs

Upon the completion of this chapter, you should be able to:
l :O31 00,
. Understand the importance of managing the internal audit function.
.,. Internal . Identify areas that affect the internal audit function.
. Relate the relevant practice standards on managing the internal function.
'l)so'0rg/ . Comprehend the issues in managing internal audit conflicts.
.-

1.t. ,\4an-
. Understand the different ways of outsourcing the internal audit function.

-:rtants of

:- .. -.:i /u,rrlr,.
Introduction
'.1014. This chapter discusses the importance of managing the internal audit function as
S Niohd part of an organization's component and is divided into three main topics-staffing,
- [dition. managing internal audit conflicts and outsourcing. These functions are important
and necessary in ensuring that an internal auditor functions effectively and efficiently
and serves as an added value to the organization. The lack or failure to manage this
-.r Lidtlle, C.
: ... of [nter- function will have significant adverse effects on the organization's operations. I

lnternalAudit Charter
The internal audit department should be adequately staffed by competent and skilled
individuals. It is not an easy task to determine the ideal number of staff required as
the right size involves a consideration of a wide range of elements. These elements
include factors such as staffing strategies, understanding customer needs, adding
value, addressing risks and use of audit tools. It is important that a chief audit execu-
tive (CAE) reviews staffing needs on a regular basis to ensure that adequate staff
members are available to discharge the internal audit function effectively, both in
terms of numbers and expertise. Inadequate staffing can lead to a failure in provid-
ing high-quality internal auditing.

Reloted Standords
The International Standards for the Professional Practice of Internal Auditir
(ISPPIA) on attribute and performance standards of the IIA (Institute of Intern
Auditors) provide guidance on staffing.

:9
60 Part fwo Behavioural Issues

Attribute Standard 1270: Proficiency I

Internal auditors must possess the knowledge, skills, and other competencies needet I
to perform their indMdual responsibilities. The internal audit activity collectively f
knowledge' skills and other competencies needed to per-
il:* il.,.,"#;LloJffi.:n" I
An internal audit department should comprise professional individuals who pos- I
sess the knowledge, skills and other competencies. These attributes will
enable in-ter-
a CAE
I
their professional responsibilities' Hence,
nal auditors to effectively perform I
must consider the necessary attributes pertaining to knowledge, ability and character I
when deciding who is to be assigned to the internal audit team. Another important I
attribute that has to be considered is the value-added attribute to the organization. I
The proficiency of internal auditors can be demonstrated through the profes- I
sional certifications and qualifications that they have obtained' I
Attribute Standard 7230: ContinuingProfessional Development
I
Internal auditors must enhance their knowledge, skills, and other comPetencies I
through continuing professional development.
I
It is important for internal auditors to strive for improvement and enhancement so t
that they can keep abreast with the demands of the organization and the profession' !
Continuing professional education and development should be on the internal audit I
department agenda. I
Performance standard 2000: Managingthe Internal Audit Activity
I
The chief audit executive must effectively manage the internal audit activity to I
ensure it adds value to the Organization I
The CAE as the head of the internal audit hierarchy has the responsibility to t"""t I
that the department is efficiently and effectively managed. Internal audit staff-mitt I
ensure thai they conform to the definition of internal auditing and the Standards. !
Any problems relating to the staff should be dealt with professionally
I
Performance Standard 2030: Resource Management
I
The chiefaudit executive must ensure that internal audit resources are appropriate' I
sufficient, and effectively deployed to achieve the approved plan' I
The CAE is also responsible for ensuring that the internal audit staff assigned to u I
particular audit activity optimise the achievement of the approved plan.
I
Performance Stand.ard 2230-7: Engageruent Resource Allocation
I
Internal auditors must determine appropriate and sufficient resources to achieve I
engagement objectives based on an evaluation ofthe nature and complexity ofeach I
engagement, time constraints, and available resources.
I
When deciding on the appropriate number of staff for the internal audit department, !
the CAE needs to justiff it to the audit committee and the board of directors. This I
could create conflicts between the internal auditor and management'
I
Body of Knowledge ond Chorocter I
It is an ideal scenario when the cAE can employ experienced staff this can elimi-
as
I
nate much of the overhead costs incurred in supervision, training and working paper I
reviews. This is based on the view that internal audit must oPerate as a business
!
that adds value and be responsive rather than an expensive cost to the customer or I
become an outsourcing target' I
 Chapter 5 Management of lnternal Audit Function 61

The knowledge and skills that internal auditors should possess include:

::'ied . Proficiency in applying internal auditing standards, procedures and techniques

.r iLY . to perform effective and efficient internal audits. This is where internal auditors
-re1-
should be able to apply their knowledge to the audit situations and deal with
them without having to resort to detailed research and assistance.

ho pos-
',,.
. Adequate knowledge of accounting principles and techniques, management
principles as well as fundamentals of law, economics, taxation, finance and other
,:1e inter-
related subject matters.
:.'. a CAE
- :1aracter Nowadays, internal auditors are facing numerous demands and challenges when
::rDortant performing their activities. The ever-changing environment they encounter during
t: z.ltion. assignment calls for the ability to react quickly to problems, new organization objec-
-: Profes- tives and management viewpoints. They should also be diligent and persevering
when dealing with difficult problems.
Another critical trait of internal auditors is the ability to communicate effec-
tively, both orally and in writing, such as expressing their professional opinions on
::-L a1eS
factual needs.
The IIA Common Body of Knowledge (CBOK) suggests the following guide-
-iment so lines to assist the CAE in the IIA Common Body:
':.riession. . Consider the overall current and anticipated workload and then evaluate audit
:::tal audit projects and base strategies according to risk priority rather than available
resources. Internal auditors should focus on risk areas that pose the greatest
threat to the organization.
..ito
. Maintain good relationship with governance parties, especially the audit com-
mittee and executive management, by informing them about the internal audi-
tors' capabilities and the emerging trends affecting the profession. The internal
. a ensure auditors' audit plan should address the governance parties' concerns so that
.:rtf must their perceptions on the internal auditors will change from providing assurance
::.1ndards. on financial and compliance controls to other challenging issues, namely risk
assessment, e-commerce and environment assessment.
. Evaluate the internal audit processes and to continuously improve the performance.
The CAEs should assess the audit teams'recent trend of workflow and update the
: rlate,
staffing strategy accordingly. Delay in responding to staffing needs might have neg-
ative repercussions on the internal audit activity and the organizatton.
tgned to a

Selecting I nternal Auditors

The CAE should design an appropriate process for hiring, normally through testing
and interviewing, to ensure that only candidates with the appropriate qualification
.: irreve
and experience are selected. Screening the prospective candidates' background and
. each
references should be undertaken.
Firstly, potential candidates are required to sit for a test and the results ofthe
.--.artment, test will be used to shortlist the candidates to be interviewed. The interview session
'-iors. This should be conducted in a positive tone to ensure that information about the candi-
dates can be obtained and that the candidates can respond comfortably.
Successful candidates are then required to attend some form oforientation and
basic training conducted either by the internal audit department or human resources
department.
i can elimi-
rking paper
a business I nternal Audit Hierorchy
ustomer or The internal audit department should comprise professionals with relevant and
related qualification (e.g. possess the Certified Internal Auditing (CIA) qualification
62 Part Two Behavioural Issues

and a member of a professional body), experience and skills. The years of experience
in the internal audit profession would promote an internal auditor to the appropri-
ate senior level. The normal hierarchy of an internal audit department is aepltea in
Figure 5.1. Figure 5.2 shows the responsibilities of the internal audit staff.

FIGURE 5.1 | lnternal Audit Hierarchy

Audit E
lChief

I ora, *-.g.r--l
v
t
I sup.-iro.
L---r------i I

_l

{;;-_] tl
Audito

@r E Audito

FIGURE 5.2 | Responsibility of internal audit staff

Responsibilities
Chief audit executive (CAE) The cAE is fully responsible for the internal auciit function, including the examination
and evaluation of the adequacy and effectiveness of risk fiianagement, !nternal contrc.ls
and corporate governance process of the orqanization.

Audit manger (AM) TheAMisresponStnlerfrf olanninqaldi_ocici,natinqtheaJLt:[,]rtqrr:n,,,,qr rlritI

direCtlytOtheCA[,rnrrra:tpr:]teJ.I.:irtinqlaIl]eaLlilitasstqrt.rle, rslr,r-,.r.-rt-r,Frj,t,i
mation technoiog! silp{.t,ji ilrr,le{ir ileliverr.telwork and irther i!Sigrima,:i: r,.,, I 1r{ -
multinational orgarli.tati{lri

Audit supervisor (AS) The AS is responsible for ensuring that designated audit teams conduct audits as per
planned schedules and man-hours. Dulies involve reviewing workinq papers, co_
ordination anci preparing reports. The AS may come fronr diverse backgrounds, such a
accounting, systems and infornration technokrgy, valuation, engineering and nthers;
they can be assigned to various financial and operational activities.

Team leader (TL) TheTL is re5ponsiLria ll rrerit .r,rrjiii ,rncjei iiri rjire.irr.]r,,-r: ti,i .r, ,.rj jt,+- i , i:.,!f
close supervis;on itr' r1',. 4,,lit. cnar ,nLlia:i)(an lnaj.iranqa,i,r. -t-.",,";1:-.j,r ;,: ,111;ti:1..1e
according ly.

The auditor is responsihle for detailing auclit work of each assignment and rs supervise,i
by the TL. This is normar!y the entry level int() t he i.iternal audit departrrrent.
 Chapter 5 Management oflnternal Audit Function

Troining ond Promotions

In order to ensure continuous improvements of internal audit performance, inter-
nal auditors should undergo necessary training. The purpose of the training is to
enhance and upgrade knowledge, skill and competencies of internal auditors and to
keep these auditors abreast with the developments in internal auditing.
The different combination of orientation from basic audit skills and techniques
training to a more specialized training should be planned by the CAE in the staff-
ing strategies. Internal auditors should be exposed to both hard skills (such as basic
internal auditing skills, audit sampling, risk management, risk analysis and control)
and soft skills (such as business communication, analytical thinking, persuasive
skills, problem solving and managing performance).
Staff evaluation is a prerequisite and should be carried out without any bias. An
evaluation can be conducted either bi-annually or annually depending on the orga-
nization's staff appraisal policies. The purpose of the evaluation is manifold, namely
for promotion, salary increments and bonus awards and assignment allocations.
The use of key performance indicators (KPIs) is one of the evaluation procedures,
where a balanced scorecard is used and can be of benefit to both the management
and internal auditors.

Conclusion
Internal auditors need to acquire the appropriate skills, have the right aptitude and
relevant experience and be passionate about the profession to ensure the effective-
ness of the function. The added value element should always be considered when
developing the staffing strategies. Proper training and evaluation will boost the per-
formance of the internal auditors and thus fulfil the expectations of the audit com-
mittee and executive management.
Hence, the success of the internal audit function depends on the proper alloca-
tion of available resources and adequate monitoring of the internal auditors' per-
formance. Getting the right number of staff is a difficult and challenging task for
the CAEs, but with proper staff planning, the internal audit function can be more
effective and efficient.

Rislt-Based Internal Audit Plan Resource Management

In the internal auditor's working environment, conflicts may arise either between
internal auditors or between internal auditors and the other staff within the organi-
zation (auditee). These conflicts that are inherent should be dealt with professionally
as internal auditors routinely deal with organizational conflicts that affect the repu-
tation of internal auditors and the efficacy of the profession.
These conflicts can arise from a simple wording in an audit report to disagree-
:::]:r ments during negotiations with management or over-implementation of internal
: auditor's recommendations. Effective communication throughout the organization
can reduce conflict issues and enhance relationship and co-operation between inter-
nal auditors and the auditees.
Conflicts within the internal audit department normally exist when:
t:
.-: . Internal auditors do not understand the internal audit process due to ambiguity
and uncertainty.
. Internal auditors fail to think strategically and systematically.
. There is a lack of understanding on the importance of the internal audit and the
trends and challenges facing the profession.
Part Trvo Behavioural Issttes

Not all conflicts can be resolved as the financial costs associated with audit con-
flicts can be very high. It can also have significant effects on staff morale and increase
staffturnover, thus adversely affecting the entire audit process.

Reloted Stondards
Effective communication has been accepted as one way to minimize or eliminate
internal audit conflicts that are due to ambiguity. People are more receptive to situa-
tions when they are given the relevant information rather than being kept in the dark.
Performance Standard 2020: Communication and Approval
The chief audit executive must communicate the internal audit actMty's plans and
resource requirements, including significant interim changes, to senior management
and the board for review and approval. The chief audit executive must also commu-
nicate the impact of resource limitations.

Performance Standard 2040: Policies and Procedures

The chiefaudit executive must establish policies and procedures to guide the inter-
nal audit activity.
The existence of well-established and designed policies and procedures together with
effective communication channels within an organization can assist to minimise or
avoid the possibility ofconflicts. Lesser or no conflicts can increase the efficiency of
the internal audit function.
Performance Standard 2060: Reportingto the Board and SeniorManagement
The chief audit executive must report periodically to senior management and the
board on the internal audit activity's purpose, responsibiliry and performance relative
to its plan. Reporting must also include significant risk exposures and control issues,
including fraud risks, governance issues, and other matters needed or requested by
senior management and the board.

Prompt communication with those charged with governance will enhance the inter-
nal auditors'trust and relationship within the organization.

Types of Conflicts
The two Qpes of conflict that internal auditors might face when performing their
tasks are inherent conflicts and avoidable conflicts.
Inherent conflicts are conflicts that are inherent within an organization, for
example, the lack of communication in the organization; audit committee and man-
agement misconceptions of the audit function and lack of co-operation from audi-
tees. This tlpe of conflict is difficult to overcome but can be minimised through
proper action by management and the organization. These actions should be devel-
oped and reviewed by management on a continuous basis.
Avoidable conflicts are conflicts that exist within the internal audit department
and process, for example, absence or lack ofguidance or reference; unclear instruc-
tions for assignment; incomplete review of working papers and favouritism relating
to assignments. These conflicts can be avoided by internal auditors with the estab-
lishment of proper audit guidance and manuals; clear instructions, directions and
supervision and less bias.
These recommended practices could help internal auditors reduce the likeli-
hood of avoidable conflicts:
. Internal auditors need to develop trust. This can be done by showing a genuine
intention in assisting to improve the organization, thus ensuring co-operation.
For example, internal auditors should liaise their work with the production
 Chapter5 Management oflnternalAudit Function

.rrclit con- department to review the high wastage of raw materials used in production.
--
I increase
Internal auditors will forward some recommendations to the production man-
ager to undertake with the view to reduce the percentage ofwastage and subse-
quently improve the efficiency and economics of the production department.
Internal auditors have to be salespersons. This is true when they want to sell
their product, that is, recommendations for audit findings. They cannot assume
.- :iiminat.
' . to situa- that everyone will immediately react upon the submission of their recommenda-
tions. Internal auditors should be able to explain the problems or issues to audi-
:'- ihe dark
tees, instead of identifying problems and telling the auditees how to fix them.
Help the auditees understand the audit objectives. When the auditees know the
.::-. iftld objectives and the information needed, conflict can be avoided.
-:illent Internal auditors should be objective and factual about their findings. Different
r) nlu-
words or phrases can affect the auditees' value judgment. Hence, allowing the
auditees to review the findings and suggesting changes, before submission to the
board or management, can reduce the possibility of conflicts.
: llitI-
How to Deol with Conflicts?
...:let'rr'i. The ability to deal with conflicts would increase internal auditors' confidence and
: :irrise , ' morale. It improves the relationship between the internal auditors and auditees.
: . alC1-1aI \Arhen dealing with these conflicts, especially inherent ones, the internal auditors
should consider these suggestions:
.ln.rgemen: . Consider the positive aspects of the conflict because some of these conflicts may
'.r ihe help an organization move towards its objectives. Some negative conflicts could
- -ri1\ C have positive effects on the audit process, for example, conducting a formal
' :.Ll'\. interview with top management might be resented but could be considered a
..,: fl valuable gathering technique for the internal auditor.
. Compromise in situations where the auditees are more responsive to important
findings rather than to less important findings. Internal auditors should be firm,
-. - le itllc-
but at the same time fair, in taking a stance over their findings.
. Internal auditors should try to appreciate and anticipate all potential sources of
conflict and consider all possible solutions to the conflicts prior to any negotia-
'-...n9 ti-:
tion with auditees. Listening to what the auditees have to say is a crucial part of
the whole process of negotiations.

.,.ti()11.
. Seek support from highJevel management, especially the audit committee. Inter-
nal auditors should be able to segregate personal differences in opinion from
. - .'i'rd 111,,
. .. r|1 .i.-
critical control issues or ethical questions that the audit committee should be
-
informed about. This is to ensure effuctive operation of the audit function.
,. ' thrc,
-. ,. lc' rli-
. Internal auditors should not feel guilty or be made responsible for situations
having negative consequences as a result ofthe audit findings, such as auditees'
--:'-',il.lil : termination, relocation or other forms of mental ailments or conditions.
. : r: l1l::l -

Conclusions
Conflicts can help internal auditors be more receptive of the auditees and their
.-,.i"ll)
expectations of the value internal auditors can add to the organization. It is thus
important for internal auditors to be proactive when dealing with conflicts instead of
I
-: - lC being reactive, as this will assist them in minimising or in fact avoiding the conflicts.
Managing conflicts accordingly can move the organization forward or make
auditees miserable. It is up to internal auditors to negotiate effectively with auditees
in a harmonious manner, which will then increase the chances that their recom-
: _' mended changes will be implemented in a timely manner by the organization.
66 Part Two Behavioural lssues

Outsourcing
arena, and millions
outsourcing developments have made a greatimpact on business
outiourced services. Irrespective of the services
have been sient on and budgeted for
in adopting this alternative' On a nega-
U.ir'rg o,rtrorrrced, good things have resulted
tive iote, an uncontrollable iesort to outsourcing had caused the downfall of many
lu.g..o.porutions,thefamousEnronandWorldCom'tonameacouple'Hence'
be made by
befi.. optirrg for any outsourced services, carefirl consideration should
to ensure that the benefits actually outweigh
the strategic"planners (management)
the costs.
parties to per-
outsourcing involves the use or employment of independent
form a function within an organization's business activities. It has become a new
capital for setting up a
way of obtaining services without the need to invest a large
department to Jndertake those activities. Establishing and maintaining a depart-
task for a company' Effective internal
ment can be a challenging and daunting
skills that many organizations find difficult to
audit functions requirei diversity of
source and retain.
developing profes-
Significant investment is required in recruiting' training and
methodology, technology and time
sional internal auditors equipped with the latest
to outsource, management can hire fully dedi-
and resource management. By opting
the day-to-day managerial requirements
cated internat audii professionJs without
The outsourcing arrange-
that an in-house internal audit department would require'
ments take many forms, from limited assistance to internal auditors who lack exper-
tise to providing the entire internal audit function'

Why Outsourcing?
considering the
Many organizations, particularly small organizations, are currently
outsourcing alternative appropriate measure where there is scarcity or unavail-
as an
outsourcing solution
ability of iiternal audit resouiies. Temporary or permanent
internal audit services and compe-
may be necessary to acquire timely, professional
need for special skills especially
tent internal audit staff. Temporary^staff shortage,
onspecialprojects,remotegeographicalbusinesslocationsandadditionalstaffto
*..i d.udlirr.. *ill fo.." the management to resort to outsourcing alternatives'
financial reviews
The external provider will indirectty perform operational and
in terms of the
as part of the engagement activities, thus reducing cost for a company
can make better
time and expert-sfuls. With these reasons in mind, organizations
and add value to the
decisions on the outsourcing alternatives that would enhance
business and internal audit function specifically'
risks, the major
outsourcing internal audit activities has several problems and
This impairment arises from the
one being u porJibl. impairment of independence.
"provider's functions that in
external .orriirrroo, involvement in the management
internal controls'
due corrse maybecome an integral part of an organization's

Related Stondards
Auditing 1210 A1
International standards for the Professional Practice of Internal
assistance if the internal audit
states, 'The CAE must obtain competent advice and
staff lacks knowledge, skills or other competencies needed
to perform all or part of
the engagement"
of an organiza-
Ai e-*te..ral provider can be an individual or a firm independent
special knowledge, skills and experience in a particu-
tion and must be one who has
actuaries'
lar discipline. An external prorid.. include, among others, accountants,
 Chapter 5 Management of Internal Audit Function

engineers, Iavryers, environmental specialties, fraud investigators and security spe

cialties. The internal audit activities that are outsourced usually relate to:
d millions
. areas where specialised skills and knowledge are required
te services
)n a nega-
o va'luations of assets
ll of many . determiningwork-in-progress
[e. Hence, . fraud and security investigations
e made by . mergers and acquisitions
'outweigh
. risk managements consultancy

es to per- The CAE should assess the relationship of an external provider, whether financial,
me a new organizational or personal, to ensure that independence and objectivity are main-
:tting up a tained throughout the engagement (Enron is a classic case of independence impair-
a depart- ment). There are situations where the external auditor is the external provider and
e internal this can give rise to ethical issues. A thorough understanding ofan external provid-
lifficult to er's objectives and scope of service must be obtained to ensure that it is adequate for
the purpose of an internal audit activity. AII these matters need to be documented in
ing profes- an engagement letter or contract. Compliance with the related standard should also
p'and time be specified in the letter or contract.
tully dedi' The CAE must review the work performed by the external provider and report
quirementt accordingly to those charged with governance. Any external communications of the
1g arrange' findings from the engagement to third parties should be made only with the board's
lack exper approval. The code on confidentiality prohibits any internal auditor from dissemi-
nating the organization's information to external parties except in certain circum-
stances such as by court order or public interest (whistle-blowing).

.:dering the Outsourcing Arra ngements

unavail-
,-.r
Fulloutsourcing
:-g solutior.
-,:-rd compe-
. Execution of a full-scope and risk-focused internal audit plan contracted to an
.s especiall' external provider, usually from professional accounting firms. An in-house con-
,;rai staff t,. tractor with reporting responsibility to the board of directors and audit commit-
:--.rtives.
tee will be appointed as a liaison with the selected accounting firm.
'-;iai revierr. . The oversight and responsibility for the internal audit activity cannot be
,eims of th. outsourced.
r:rake bette. . Should require the approval of the audit committee and reporting to the board
'.'.rlue to th: or other governing body.

r.. the majc:

Partial outsourcing t'l
-.es from th.
- ons that i' . Execution of the internal audit plan is partly done by an internal provider on an
:rtrols. ongoing basis.
. External provider will report to the head of the internal audit department.

ng 1210 A
.ternal auil
Co-sourcing '/
r11 or part t
. Execution of an internal audit plan is shared between an accounting firm and
the organization. In most cases, the outsource d party handles specialized areas
(e.g., computer security auditing, special investigations, financial or operational
xrorganta
in a particr auditing) or those that are more cost effective to co-source.
ts, actuarie . Reporting should be made to the management and the board.
68 Part Two Behavioural lssues

Sub-contracting
. Involves the engagement of an external party for a limited period to
undertake a
specific engagement or a portion of some engagement'
. and
In-house internal audit department will normally provide the management
oversight functions.

The Institute of Internal Auditors (IIA) has issued a position paper titled'Resourcing
on resoLtrc'
Alternatives fir the Internal Audit Function'. The paper provides guidance
ing the inteinal audit functions and the various issues involved'

Merits of Outsourcing
when making an outsourcing decision, management will definitely revtew the mer-
its and limitations of the opiion. The main objective in making the final decision
is normally based on cost and performance effects. The following are some
of the
merits of outsourcing.
. Focus on core competencies
Outsourcing allows management to focus on core competencies instead of
the day-to-Iay low puybu& activities that are time-consuming. The resulting
'allocation
improvements in staff allow business to afford the luxury of having
access to global expertise and cutting-edge technology. It will increase business
returns and effective management of existing resources'
. Costs
Internal audit outsourcing helps a business reduce its costs by converting fixed
costs of an internal audii function to variable costs. The costs of overlapping
positions and audit effort can also be reduced, thus creating more flexibility
in
increasing and decreasing workload demands'
Efficiency of the business
An external provider can also perform quality checks24lT whlle executing inter-
nal audit activities. This continuous review enables a business process or func-
tion to be performed without any flaws and in tune with the latest technologies'
External audif
The knowledge obtained during an internal audit engagement can increase
the efficiencliof the annual independent statutory audit in situations where
an external provider is also the internal auditor; for example, knowledge
of the
should reduce the work to document the internal con-
internal control systems
trols, assess the control risks and design test ofcontrols'
Business geographical locations
Businesses with numerous and remote locations will benefit from outsourcing
as

more locations can be reviewed and improved. The coverage undertaken by an

external provider is more extensive and the coordination with an in-house

inter-
nal audiistaffwill increase accessibility to best practice or insight to alternative
approaches.
Future expectations
The existence of an external provider can be used as a training ground for
future
in-house internal audit staff to gain specialized skills, especially with partial out-
sourcing. The retention of knowledge for future assignments through the work-
ing pap""rs and information available can assist the internal audit staff to plan
their assignment.
 Chapter 5 Management of Internal Audit Function

. Credibility
o undertake a An external provider with a good reputation carries greater credibility compared
to the work done by the internal audit staff.
nagement and
Limitotions of Outsourci ng
rd'Resourcing while the merits or benefits of outsourcing are apparent, there are a number of con-
Ee on resourc-
straints or limitations that reduce its effectiveness to the organization, namely:

' The allegiance ofin-house staffversus external service provider, where the ele-
ments of motivation and loyalty are questionable.

' The culture of an organization towards an external provider might limit or hin-
s-iew the mer- der the outsource providers from performing their assignments. They may find
final decision it difficult to access information, whether rr"ibul o. writlen. Hence, to overcome
:e some of the this, the board will have to ensure that an external provider is given the required
authority and assistance.
. The Sarbanes-oxley Act 2002 states that an external audit firm engaged as the
outsource provider should not provide internal audit services to its existing cli-
-:s instead oi ents as this might impair the external auditor,s independence.
- he resuiting
i*rr- of having ' Outsourcing internal activities will result in the business incurring significant
':=ase business amount of resources in the form of fees and time assisting the external pro-
vider. Eventually, in the long term, these costs will become a fixed cost to the
organ ization.

' Lack of knowledge about the organization will affect the performance of the
.l-''erting fixec
,. overlappins outsourced activity, as an external provider might not be well informed about
the organization's objectives and operations. on the other hand, the in-house
:. flexibility Lr:
internal audit staff is normally well informed and the competencies possessed
represent a unique perspective ofthe organization.
. Internal audit department provides a training ground for future managers as
\..uting inter- they are involved in organization risk control and governance processes. The
:..,;ess or func absence of such department may affect management succession plans.
:echnologies.
.
. The outsourcing alternative lacks long-range development that an in-house
department provides and this may limit the appreciation of internat auditing by
:. ;an increase the board and audit committee.
:*atrons where
,- rtledge of th.
Conclusions
.- rnternal con-
The idea of outsourcing is not new and many studies and surveys have been done to
measure its effectiveness to an organization as a whole. Many advocates of outsourc-
ing will agree that outsourcing tends to resolve problems in a short period of time
rutsourcing a:
but is costly to an extent. The need to resort to outsourcing should be considered
:ertaken by a:.
only in situations that require immediate result and not for a iong-term engagement.
,:r-house inter-
The downfall of Enron evidenced the risks of fully outsourcing malor actirrities of the
:. :o alternatir'.
organization.
_ When choosing the external provider for the outsourced internal audit activity,
the CAE should consider the merits and limitations or risks inherent in the engage-
,-,,,r-rd for futur. ment. A careful assessment and review of the in-house internal audit capabilities
t-tit parti.al ou. and work performed can act as a benchmark in deciding whether outsourcing is
,: rrgh the work- required. In order to ensure a high return of the outsourced activity, management
:-: staff to p1a'' must assess the long-range planning ofthe organization to opt for outsourcing as an
alternative action.
7A iArtr:f ri.d",'Beft rttitittfti. t' Iisit sl

I S U'M,M ARY

Qu;
i
'...1
I .ii i
[*P
W OUESTIONS

-- a REF:EgElLeEi