As talent and staffing challenges persist for the internal audit profession, 43 percent of public companies outside of the financial services reached outside the organization for help, according to the latest data from the Institute of Internal Auditors. Financial institutions, public and private alike, make the greatest use of third-party services at 45 percent globally.
North American companies lead the way in outsourcing some portion of internal audit activity, with 56 percent of companies relying on outsourced service providers. The IIA culled the data from its latest annual “Common Body of Knowledge” survey published in 2015. That poll of more than 14,500 audit executives in 166 countries examined a host of internal audit practices.
The data show 56 percent of companies in North America expect flat budgets for third-party services in 2016, while 28 percent anticipate a decrease in budget. Only 16 percent said they expected to see a budget increase for outside help. The data also suggest that the smallest internal audit departments are the least likely to use a third-party provider. Only about one in four very small internal audit departments said they outsourced any of the work while those with 50 to 300 people outsource at twice the rate.
With the report, titled Engaging Third Parties for Internal Audit Activities, the IIA offers some of the latest intelligence on how chief audit executives can best leverage outside services to achieve the internal audit mission. The report not only provides data, but offers some best practices in leveraging third-party help, such as identifying objectives, scoping services, expertise levels, performance metrics, and responsibilities for remediation and follow through.
“As demands on internal audit evolve, we will need to turn increasingly to third-party services, so it is imperative that CAEs understand best practices in this area,” says Richard Chambers, president and CEO of the IIA, in a statement. “This report offers an important snapshot on the profession’s use of third-party services.”
Internal audit leaders who contributed to the content of the report said they effectively engage third parties by proactively evaluating the need for third-party assistance, setting clear performance expectations in the third-party agreement, establishing clear terms for remediation and follow-up, and taking advantage of the knowledge transfer that occurs.