Every organization that needs internal audit has to decide who will do it: its own employees, an outside firm, or a mix of the two. The choice is rarely made once. Functions start outsourced because a lender or a listing requires an audit function before there is budget for a team, move to co-sourcing as they hire, add specialists back in from firms as the risk universe grows more technical, and sometimes outsource again after an acquisition or a cost program. The decision matters more than its budget line suggests, because the sourcing model decides who holds institutional knowledge, how independent the function really is, what it costs per hour of assurance, and whether the board has one accountable person to call.
This guide compares the five models on the dimensions that decide the choice, explains the rules that constrain it in listed companies, banks and public bodies, gives a decision matrix by size and situation, works a cost comparison, lists the contract clauses and provider measures that make a sourced arrangement succeed, describes how to transition in either direction, and follows Brightwater Foods, a $180 million food manufacturer, from an outsourced arrangement sponsored by its finance director to a hybrid function with its own chief audit executive. The what co-sourcing is guide defines the model in depth, the co-sourcing vs outsourcing guide compares the two external models for boards, and the rates and pricing guide covers what the help costs.
In this guide
- The five sourcing models
- The models compared on what matters
- The rules that constrain the choice
- A decision matrix by size and situation
- The economics: a worked cost comparison
- Independence and accountability under each model
- Contract clauses that make a sourced arrangement work
- Measuring the provider
- Transitioning between models
- Hybrid patterns that work
- A sourcing decision checklist
- Mistakes that undo sourcing decisions
- A worked example: Brightwater Foods
- Questions about sourcing internal audit
- Related guides
The five sourcing models
Three words cover most conversations (in-house, co-sourced, outsourced), but functions in practice sit on a five-point scale, and the two middle points behave differently enough to deserve their own names.
| Model | Who does the work | Who leads | Typical user |
|---|---|---|---|
| 1. Fully in-house | Employees of the organization | An employed chief audit executive | Larger organizations; regulated firms; anyone with a stable, broad risk universe |
| 2. Co-sourcing for skills | Employees, plus a firm for specialist engagements (IT, cyber, actuarial, model risk, forensics) | The employed CAE directs the firm’s work | Mid-size functions whose universe is more technical than their team |
| 3. Co-sourcing for capacity | Employees, plus firm staff who work the plan alongside them, often seasonally | The employed CAE | Functions with peaks (SOX season, acquisitions) or vacancies |
| 4. Managed service | A firm delivers the whole plan under a multi-year contract, with a named engagement lead who acts as the day-to-day head of audit | An employed executive is accountable to the board; the firm’s lead runs delivery | Mid-size companies that want a function without building one; private-equity portfolio companies |
| 5. Full outsourcing | A firm performs all engagements, often project by project | The firm, reporting to the audit committee, with a designated internal liaison | Smaller companies; newly listed companies in their first years; some public bodies |
The models compared on what matters
Eight dimensions decide the choice, and no model wins all of them. The table rates each model on each; the paragraphs after it explain the two dimensions people most often get wrong, cost and independence.
| Dimension | In-house | Co-source (skills) | Co-source (capacity) | Managed service | Full outsource |
|---|---|---|---|---|---|
| Cost per hour | Lowest at steady volume | Low base, high specialist hours | Low base, premium for peaks | Medium to high | Highest per hour; lowest fixed cost |
| Institutional knowledge | Highest; accumulates | High for the core; specialists learn the context each time | High for the core | Medium; depends on team continuity | Low; resets with staff rotation |
| Specialist skills | Limited to what you can hire and keep | Best of both | Core skills only | Broad, from the firm’s bench | Broad |
| Flexibility of capacity | Low; hiring is slow | Medium | High | Medium (contract minimums) | High |
| Independence from management | High if reporting lines are right; risk of capture over time | High | High | Medium; depends on who sponsors the contract | High from management; a different risk: dependence on the firm’s other relationships |
| Board’s access to one accountable person | Yes | Yes | Yes | Partly; the accountable executive is often part-time on audit | Weak unless a liaison is designated |
| Speed to stand up | Slow (6 to 18 months to hire and build) | Medium | Medium | Fast (weeks) | Fast |
| Quality program and Standards conformance | Owned; must be built | Owned | Owned | Firm’s methodology; organization still accountable | Firm’s methodology; organization still accountable |
On cost, the common error is comparing a firm’s hourly rate with an employee’s salary divided by 2,080 hours. A fair comparison uses fully loaded cost per productive audit hour: salary plus benefits, training, certification, tools and management time, divided by the hours actually spent on engagements (typically 1,350 to 1,550 a year after leave, training, administration and planning). On that basis, an in-house senior auditor in a US regional market costs something like $75 to $110 per productive hour, a co-sourced senior from a national firm $150 to $275, and a specialist (penetration testing, actuarial, forensic accounting) $250 to $450. Figures vary by market and year; the pricing guide gives the current ranges and the structures behind them. The point is that in-house wins per hour only when volume is steady and skills are general; the moment a specialist is needed for 150 hours a year, the firm wins.
The rules that constrain the choice
Sourcing is a governance decision, and several rulebooks have a view. The constraints below apply to US-listed companies, banks and public bodies; private companies elsewhere are freer, but lenders and acquirers increasingly expect an audit function and ask who provides it.
| Rule | What it says | Effect on sourcing |
|---|---|---|
| Sarbanes-Oxley Act, Section 201 | A registered public accounting firm may not provide internal audit outsourcing services to its audit client | The external auditor is off the list of providers; a different firm must be used |
| NYSE Listed Company Manual 303A.07 | Each listed company must have an internal audit function | The function may be outsourced, but it must exist and the audit committee must oversee it |
| Interagency Policy Statement on the Internal Audit Function and Its Outsourcing (2003) and the Federal Reserve’s 2013 supplemental statement | Banks may outsource internal audit work, but the board and management remain responsible; the arrangement needs a written contract, oversight by the audit committee, and a designated internal manager; the external auditor is not an acceptable provider | Banks commonly co-source but rarely fully outsource; examiners test the oversight |
| Global Internal Audit Standards, Domain III | The board is responsible for the function’s mandate, independence, resources and quality regardless of how it is sourced, and an accountable chief audit executive must be designated | Outsourcing the work does not outsource the accountability |
| Public-sector frameworks (GAGAS; state and local statutes) | Many jurisdictions require an internal audit function or audit committee and set independence rules for providers | Procurement rules and rotation requirements often apply to providers |
| UK Corporate Governance Code (2024) and the FRC’s Audit Committee and the External Audit: Minimum Standard | The audit committee must monitor and review the effectiveness of the internal audit function, or consider annually whether one is needed | The “do we need one” question must be answered on the record each year |
A decision matrix by size and situation
Size is the first filter and situation the second. The matrix gives the model that fits most organizations in each cell; the exceptions are regulated firms, which skew in-house at every size, and private-equity portfolio companies, which skew toward managed services because the sponsor wants a standard product across holdings.
| Organization | Steady state | Standing up a function | Peak or transformation | Specialist need |
|---|---|---|---|---|
| Under $100 million revenue, unregulated | Full outsource or a one-person function with co-source | Full outsource for 1 to 2 years | Firm project | Firm project |
| $100 million to $1 billion | Small in-house team with co-sourcing for skills | Managed service, then hire a CAE in year one | Co-source for capacity | Co-source for skills |
| $1 billion to $10 billion | In-house with 10 to 25 percent co-source | Hire the CAE first, co-source the first plan | Co-source for capacity | Co-source for skills; consider hiring if recurring |
| Over $10 billion | In-house with specialist co-source | Rare; usually an existing function | In-house plus firm | Hire specialists; co-source the rarest |
| Regulated bank or insurer (any size) | In-house led, co-source for skills; full outsourcing discouraged by supervisors | Hire the CAE before the charter is approved | Co-source with examiner-ready oversight | Co-source (model risk, cyber, actuarial) |
| Newly listed company | Build toward in-house within three years | Managed service or full outsource for the first plan; the government and pre-IPO guides cover the special cases | Co-source SOX season | Co-source |
The economics: a worked cost comparison
Take a company that needs about 4,000 hours of audit work a year: eight process audits, SOX support, follow-up and a small analytics program. Three ways to buy those hours, at illustrative US mid-market rates (adjust to your market; the structure matters more than the figures):
| Line | In-house (3 staff) | Co-sourced (2 staff + firm) | Managed service |
|---|---|---|---|
| Salaries and benefits | $420,000 (manager, senior, staff) | $300,000 (manager, senior) | $0 (accountable executive’s time not charged) |
| Training, certification, travel, tools | $45,000 | $30,000 | $0 |
| Firm fees | $40,000 (one specialist review) | $190,000 (1,000 hours at a blended $190) | $640,000 (4,000 hours at a blended $160 under a multi-year contract) |
| Management time (CFO/committee oversight, contract administration) | $20,000 | $30,000 | $60,000 |
| Total | $525,000 | $550,000 | $700,000 |
| Productive audit hours delivered | About 4,100 (3 × 1,450 minus planning and admin, plus 200 firm hours) | About 3,900 | 4,000 (contracted) |
| Cost per productive hour | $128 | $141 | $175 |
| What the money does not buy | Specialist depth; surge capacity | Continuity on the firm side | Institutional memory; a full-time advocate inside the building |
Two observations change decisions. First, the in-house option is cheapest only if the three people are fully productive; a vacancy for six months removes a third of the hours and the cost per hour climbs past the co-sourced figure. Second, the managed service’s premium buys speed and breadth, and in a company that has never had a function, the first two years of a managed service often cost less in total than a failed in-house build (a CAE hire that does not work out, a half-staffed first plan, an external assessment that finds the quality program missing). The right comparison is cost over three years including the failure cases, not cost in a steady state that may never arrive.
Independence and accountability under each model
Independence is the dimension where intuition misleads. An outside firm feels more independent than employees, and from management it usually is. But independence in the Standards’ sense is about where the function sits and who it answers to, and an outsourced function sponsored and managed by the chief financial officer is less independent than an in-house function reporting to the audit committee. Three tests apply to every model. Does the function’s leader, employee or firm partner, have direct and private access to the audit committee? Does the committee, not management, approve the plan and the scope changes? Can the function report a finding about the executive who signs its invoices or its paychecks without that person being able to end the arrangement? Where any answer is no, the model is not independent whatever the org chart says. The independence and objectivity guide gives the full set of threats and safeguards; the Standards also require that the organization designate a chief audit executive, or an equivalent accountable executive, even when all the work is done by a firm, so that Domain III has someone to land on.
Contract clauses that make a sourced arrangement work
Most disappointing co-sourcing and outsourcing arrangements fail on things the contract never addressed. The clauses below come from arrangements that worked; the choosing a provider guide covers selection and the managing the provider guide the relationship.
| Clause | What it should say | Why |
|---|---|---|
| Reporting line | The firm’s engagement lead reports to the audit committee chair for the work, with administrative coordination through a named executive | Keeps the arrangement independent of the sponsor |
| Named team and continuity | Named lead and core staff; replacement only with the committee’s agreement; minimum notice; knowledge-transfer obligations | Rotation is where institutional knowledge leaks |
| Methodology and standards | Work performed in conformance with the Global Internal Audit Standards and applicable Topical Requirements; the organization’s methodology where one exists | The organization is accountable for conformance |
| Workpapers and ownership | Workpapers, reports and data belong to the organization and are delivered in a usable format at each engagement’s end and on exit | Protects against lock-in and supports examiner and external-auditor access |
| Independence and conflicts | The firm discloses other services to the organization and its affiliates; no provider may be the external auditor; the firm does not design controls it later audits | SOX 201 and the Standards’ objectivity rules |
| Access and confidentiality | Access rights for the firm; data handling, location and security requirements; subcontracting prohibited without consent | Audit data is among the most sensitive the organization holds |
| Pricing and change control | Blended rates by level, fixed fees per engagement where scope is stable, a rate-change cap, and a change-order process for scope growth | Prevents the budget surprises that end arrangements |
| Service measures | The KPIs below, reported quarterly to the committee | Makes performance visible |
| Exit and transition | Notice periods; transition assistance; handover of open issues and the universe; no fee for returning the organization’s own records | Every sourced arrangement ends; plan the ending at the start |
Measuring the provider
Measurement is where sourced arrangements most often drift. The firm reports hours and deliverables because that is what the invoice is based on; the committee needs to know whether the plan was delivered, whether the findings were worth having and whether management acted on them, which no invoice shows. Agree the measures before the first engagement and put them in the contract, so that the quarterly report to the committee is a contractual deliverable rather than a favor.
A sourced function should be measured the way an in-house one is, with a few measures added for the relationship itself. Plan completion against the approved plan; hours delivered against contracted hours; report issuance within an agreed number of days of fieldwork end; findings accepted by management as a share of findings raised; validation of prior findings completed on time; staff continuity (share of hours delivered by the named core team); satisfaction scores from auditees and the committee; and, for quality, the results of the organization’s own review of a sample of the firm’s files each year. The KPI guide gives definitions and targets. One measure deserves emphasis for sourced arrangements: the number of findings about areas close to the sponsoring executive. A provider that never finds anything in finance while being paid by finance is telling you something.
Transitioning between models
From outsourced to in-house is the common direction as companies grow. The sequence that works: hire the chief audit executive first, before the first employee auditor, and give the CAE six months with the firm still delivering the plan; have the CAE write the charter, the strategy and the methodology (the first 90 days guide covers that stretch); hire the team against the next year’s plan; and keep the firm on a co-source footing for specialist work rather than ending the relationship, because the universe will contain things the new team cannot do. Insist on the handover clause: the universe, the open issues, the risk assessment and every workpaper come across before the contract lapses.
From in-house to co-sourced or outsourced usually follows a cost program, an acquisition or the departure of a CAE. The risks run the other way: loss of institutional knowledge, a plan that shrinks to what the firm quoted, and an audit committee that loses its direct line. Protect against them by writing the knowledge down before people leave (the universe, the issue log, the risk assessment, the methodology), by naming the accountable executive and giving that person time, and by contracting for continuity. The when to co-source guide gives the signals that the time has come, and the cost and return guide the business case.
Hybrid patterns that work
The five models are points on a scale, and most functions over about $500 million of revenue end up with a deliberate hybrid. Four patterns recur in functions that get good value from them. Core and flex: an in-house team sized for the base plan (process audits, follow-up, committee reporting) with a standing co-source agreement that supplies 15 to 30 percent of hours for peaks and specialist work, drawn down against a pre-agreed rate card. Specialist panel: two or three firms pre-qualified for distinct specialisms (cyber and cloud, actuarial or model risk, forensics), each with a master agreement, so that an engagement needing a specialist starts in days rather than after a procurement. Guest auditor program: employees from the business join engagements for a rotation, bringing process knowledge and taking control awareness back; it adds capacity cheaply and builds the function’s reputation, with the objectivity rule that a guest never audits their own area. Reverse secondment: an in-house auditor spends a season inside a co-source firm’s practice or a sister company’s function to bring back methods; rarer, but the functions that do it tend to keep their people longer.
What the hybrids share is that the in-house chief audit executive owns the universe, the risk assessment, the plan, the quality program and the relationship with the committee, and buys everything else as needed. Where that ownership sits with the firm instead, the arrangement is a managed service whatever it is called, with the accountability consequences described above.
A sourcing decision checklist
Twelve questions, answered in writing for the audit committee, produce a defensible decision and a paper trail an external assessor or examiner will accept. Most boards that regret a sourcing choice skipped three or four of them.
| Question | Points toward |
|---|---|
| How many audit hours does the risk-based plan require each year, and how stable is that number? | Under 2,500 and volatile: sourced; over 3,000 and stable: in-house core |
| What share of the universe needs specialist skills we do not have? | Over 20 percent: co-source for skills whatever the base model |
| Are we regulated, and what do our supervisors expect of the function’s leadership? | Banks and insurers: an employed CAE |
| Who would the audit committee call at 7 a.m. after a fraud or a cyber incident? | If the answer is “the firm”, designate an accountable executive now |
| Is our external auditor on the list of candidate providers? | Remove it (SOX 201; supervisory guidance) |
| How much institutional knowledge is in people’s heads rather than documents? | A lot: do not move to a firm until it is written down |
| What is the fully loaded cost per productive hour of each option over three years, including the failure cases? | The comparison above |
| Can the model flex by 30 percent in either direction within a quarter? | If not, add a co-source agreement |
| Who owns conformance with the Standards and the quality program? | Always the organization; name the person |
| Does the proposed contract include the nine clauses above? | If not, it is not ready to sign |
| Will the function still be independent of the executive who manages the budget? | Reporting line to the committee chair in writing |
| What does the exit look like in year three? | Transition clause and data ownership agreed up front |
Examiners and external assessors ask a version of the same questions. A bank examiner reviewing a co-sourced function will look for the written contract, the audit committee’s approval of the arrangement, evidence that the committee reviews the firm’s work and performance, the designated internal manager, and the independence analysis; an external quality assessor will look for who owns the methodology and the quality program and whether the firm’s work is reviewed by someone in the organization. Both find the same weakness most often: an arrangement everyone understands but no one documented.
Mistakes that undo sourcing decisions
Letting the chief financial officer sponsor, select and manage the provider, so that the function is independent on paper and captive in practice. Hiring the external audit firm for internal audit work at a US-listed company, which Section 201 prohibits, or at a bank, which supervisors reject. Buying hours without buying a plan, so the firm audits what is easy to scope rather than what is risky. Accepting the firm’s methodology wholesale when the organization’s own exists, and then failing the external assessment because no one owns conformance. Treating co-sourced specialists as interchangeable, so that the penetration tester who learned the environment last year is replaced by someone who starts from zero. Letting the contract lapse into year four with the original rates and the original scope while the organization has doubled. And the mirror-image in-house mistake: building a team for the steady state and then having no way to flex when the acquisition, the regulatory finding or the ransomware event arrives.
A worked example: Brightwater Foods
Brightwater Foods, the private food manufacturer used in examples across this site ($180 million revenue, 600 staff, three plants), began with internal audit as a fully outsourced arrangement sponsored by its finance director: a regional firm performed four reviews a year, scoped by finance, reported to the finance director, with a summary to the board. It satisfied the lender’s covenant and little else. Two things exposed its limits. The firm’s first cybersecurity assessment found the company at Level 1 maturity with flat plant networks and no immutable backup, and the finding sat for sixty days past its due date because the sponsor was also the budget holder who had deferred it. And the board, prompted by a new independent director, asked who the firm actually answered to.
The board formed an audit committee and hired a first-time chief audit executive, a senior manager from a larger manufacturer, who negotiated functional reporting to the committee chair before accepting. In the first ninety days she kept the firm but rerouted its reporting to herself and the committee, rebuilt the universe in six weeks, escalated the backup finding in week five (it was funded within the month), and wrote a charter the committee approved from an eleven-page day-90 report. The sourcing model that emerged is model 2 in the table: a two-person in-house function (the CAE and a second auditor funded from the same report) with the firm retained for cyber, plant safety and the first fraud analytics run. Total cost rose from about $120,000 a year under the outsourced arrangement to about $410,000, and the committee judged the increase worth it after the first year’s findings, which included a $279,000 recovery from the procure-to-pay analytics the firm would never have been asked to run. The first 90 days, one-person shop and year-one plan guides tell the rest of the story.
Questions about sourcing internal audit
What is the difference between co-sourcing and outsourcing internal audit?
Co-sourcing supplements an in-house function with a firm’s people for specific skills or capacity, under the in-house chief audit executive’s direction. Outsourcing has a firm perform the whole function, with the organization retaining accountability through an audit committee and a designated executive.
Can a company’s external auditor also do its internal audit?
Not for a US public company: Sarbanes-Oxley Section 201 prohibits the registered audit firm from providing internal audit outsourcing services to its audit client. US banking supervisors also reject the arrangement. Private companies elsewhere may be allowed to, but the independence problem is the same.
Is outsourced internal audit cheaper?
Per hour, no: firm rates are two to three times an employee’s fully loaded cost. In total, sometimes: for small or new functions, a firm avoids the fixed cost of a team, the risk of a failed build and the cost of specialists you would otherwise hire for occasional work.
Who is accountable for an outsourced internal audit function?
The board, through the audit committee, and a designated executive inside the organization. The Standards and banking supervisors are explicit that the work can be outsourced but the responsibility cannot.
When should a company move from outsourced to in-house internal audit?
When the plan needs more than about 2,500 to 3,000 hours a year of general audit work, when institutional knowledge is becoming the binding constraint, when regulators or lenders expect an employed head of audit, or when the board wants one accountable person it can call. Hire the chief audit executive first and keep the firm for specialist work.
What should a co-sourcing contract include?
A reporting line to the audit committee, named staff with continuity obligations, conformance with the Standards, ownership of workpapers, independence disclosures, access and data-handling terms, pricing with a change-control process, quarterly service measures, and exit and transition assistance.
Related guides
- Internal audit co-sourcing: what it is — the model defined, with its uses.
- Co-sourcing vs outsourcing — a board-level comparison.
- When to co-source internal audit — the signals.
- Choosing a co-source provider — selection criteria.
- The cost and return of co-sourcing — the business case.
- Managing the co-source provider — the relationship.
- Co-sourcing rates and pricing models — what the help costs.
- What is a chief audit executive? — the role every model needs.
- Your first 90 days as CAE — taking over from a firm.
- Establishing internal audit in a small company — the build.
- The one-person audit shop — the smallest in-house model.
- The year-one audit plan — the first plan under any model.
- Independence and objectivity — the tests that apply to every model.
- The audit committee charter — the committee’s oversight duties.
- Internal audit KPIs — measuring any function.
- The Global Internal Audit Standards — Domain III on the board’s responsibilities.
- Pre-IPO SOX readiness — the newly listed company’s sequence.
- Standing Up Internal Audit After an IPO: The First 18 Months — the first 18 months: charter, plan, staffing, SOX and the committee.
Leave a Reply