Some years ago, I was at a roundtable with fellow Chief Audit Executives (CAEs). One of the topics that came up was the push by several executives and their external audit partners to outsource the entire internal audit function.
One of the CAEs told us what happened at his company.
The CEO had received a bid from the external auditor that undercut the current internal audit budget by a serious amount. He took that to the audit committee of the board, asking for their approval to totally outsource the internal audit function.
The proposal included jobs for everybody on the IA team, including the CAE, as employees of the external audit firm. It specified the number of audits that would be delivered in the first year and boasted about the firm’s processes, compliance with IIA Standards, and more.
The chair of the audit committee was wise. He had prior excellent experience with internal audit and knew something was missing.
His questions drew from management a recognition (with strong support from the CIO and CFO) that the internal audit team at that company delivered at least as much value through its other activities as it did through formal audits.
For example, the CAE and his direct reports attended management meetings and were often able to share valuable insights and advice on operating issues, as well as…
