Co-sourcing is how most internal audit functions buy the skills and the capacity they do not have: a penetration tester for the cyber audit, a quantitative reviewer for the model risk audit, an actuary, a forensic accountant, or simply twelve hundred hours of process audit work when the plan is bigger than the team. It is also the purchase most functions make without a clear view of what the market charges, because rate cards are confidential, quotes are bundled, and the comparison with in-house cost is usually done on salary rather than on what an hour of productive audit work costs. The figures below are illustrative US ranges for 2026, drawn from engagement letters, proposals and budgets in the mid-market, and they move with location, specialism and the state of the firms’ calendars; treat them as the shape of the market and adjust to your own quotes.
This guide gives the rate ranges by level and firm tier and what moves a quote within them, blended rates and how to read them, the five pricing models and the risk each shifts, the in-house comparison done properly, the hidden costs on both sides, the contract terms that protect the function, the negotiation levers that work, how to budget a program, the sourcing rules that constrain regulated organizations, and three worked examples from the companies used across this site. The sourcing options guide covers the choice between in-house, co-sourced, outsourced and hybrid models; the selecting a consulting firm guide the RFP; the ROI of co-sourcing guide the business case; and the when to co-source guide the signs that you need to.
In this guide
- Hourly rates by level and firm tier
- What moves a quote within the range
- Blended rates and how to read them
- The five pricing models
- The in-house comparison, done properly
- Hidden costs on both sides
- Contract terms that protect the function
- Negotiation levers that work
- Budgeting a co-source program
- Sourcing rules in regulated organizations
- Three worked examples
- Questions about co-sourcing rates
- Related guides
Hourly rates by level and firm tier
Firms price by staff level, and the levels map loosely to the in-house ladder: partner or managing director, director or senior manager, manager, senior associate, associate or staff, with specialists (penetration testers, data scientists, actuaries, forensic accountants, valuation and quantitative reviewers) priced on their own scale regardless of level. Four tiers of provider operate in the US market: the national and global firms (the largest accounting firms and the national consultancies), the regional firms, the boutiques (internal audit and risk specialists, often founded by former national-firm partners) and nearshore or offshore delivery centers used by all three, plus independent contractors who work under the function’s direction. The table gives standard (list) hourly rate ranges before discount; most engagements settle at 10 to 30 percent below list for volume or term, which the negotiation section covers.
| Level | National and global firms | Regional firms | Boutiques | Nearshore and offshore centers | Independent contractors |
|---|---|---|---|---|---|
| Partner or managing director | $500 to $900 | $350 to $550 | $300 to $500 | Not applicable (oversight from onshore) | $175 to $300 (former partners) |
| Director or senior manager | $350 to $550 | $250 to $375 | $225 to $350 | $90 to $150 | $125 to $200 |
| Manager | $275 to $400 | $200 to $300 | $175 to $275 | $70 to $110 | $100 to $160 |
| Senior associate | $200 to $300 | $150 to $225 | $135 to $200 | $45 to $80 | $80 to $125 |
| Associate or staff | $150 to $225 | $110 to $165 | $100 to $150 | $30 to $55 | $60 to $95 |
| Specialists (cyber testing, data science, actuarial, forensic, quantitative) | $300 to $650 | $250 to $450 | $250 to $450 | $80 to $160 | $150 to $350 |
Two cautions on reading the table. The national firms’ partner rates are rarely paid in volume; partners appear on an engagement for oversight hours (5 to 10 percent of the total), and the blended rate depends far more on the mix below them. And the offshore column is a delivery option within a firm’s quote rather than a separate purchase for most functions: a national firm’s proposal for a 2,000-hour process audit program might put 40 percent of the hours in a delivery center, which is how its blended rate reaches the regional firms’ level. The internal auditor salary guide gives the in-house pay figures the rates are ultimately built on.
What moves a quote within the range
| Driver | Effect on rate | Why |
|---|---|---|
| Specialism | Up 25 to 100 percent over generalist rates at the same level | Scarce skills (penetration testing, model validation, actuarial review, forensic technology) are priced on a separate scale |
| Location | Up 15 to 30 percent in the largest metropolitan markets; down 10 to 20 percent in smaller ones | Firms price to local salary markets and client expectations |
| Volume and term | Down 10 to 30 percent for multi-year commitments above roughly 1,000 hours a year | Predictable utilization is what firms sell their partners on |
| Timing | Up 10 to 20 percent for work in the first calendar quarter or year-end; down for summer and fourth-quarter fill-in | Firm calendars peak with SOX and external audit seasons |
| Independence and regulatory constraints | Up where the firm must be independent of the external auditor and the pool shrinks | Listed companies cannot use their external auditor for internal audit work |
| Staff continuity | Up 5 to 10 percent for named staff and guaranteed continuity | The firm gives up flexibility in deploying people |
| Scope definition | Fixed fees carry a 10 to 20 percent premium over estimated time and materials | The firm prices the risk of overrun |
| Relationship history | Down for incumbents who know the systems; up for a first engagement with learning curve | Onboarding hours are real and someone pays them |
| Offshore mix | Down 15 to 35 percent on the blended rate as the offshore share rises | Delivery center rates are a third of onshore |
| Deliverable standard | Up where the firm’s workpapers must meet the function’s methodology and GIAS conformance rather than the firm’s own | Review time and rework |
Blended rates and how to read them
Most proposals quote a blended hourly rate: total fee divided by total hours, with the staff mix assumed. A blended rate of $190 for a 1,000-hour process audit program from a national firm, which is what MidState Beverage pays in the worked example below, typically decomposes as 60 hours of partner time at $600, 150 of senior manager at $400, 300 of manager at $300, 390 of senior associate at $220 and 100 of staff at $160, less a volume discount. The blended figure is useful for comparison and dangerous for control, because the firm controls the mix: an engagement staffed heavier at the senior level than proposed costs more at the same blended rate if the hours grow, and one staffed lighter delivers less experience than was bought. Functions that manage co-sourcing well ask for the mix in the proposal, the actual mix on each invoice, and a right to approve substitutions above a level; they compare the blended rate with a leverage ratio (hours at manager and above as a share of total; 40 to 50 percent is typical for audit work needing judgment, 25 to 35 percent for testing-heavy programs) rather than with other firms’ blended rates alone. A low blended rate achieved with 60 percent staff hours on a risk assessment engagement is not a saving.
The five pricing models
| Model | How it works | Who carries the risk | Fits | Watch for |
|---|---|---|---|---|
| Time and materials | Hours billed at rates by level, plus expenses; an estimate is given | The buyer carries overrun risk | Specialist reviews of uncertain scope; advisory work; first engagements | Estimates that become floors; scope growth without change orders |
| Capped time and materials (not-to-exceed) | Time and materials billed up to a ceiling; the firm absorbs hours above it unless scope changes are agreed | Shared: buyer pays actuals below the cap, firm absorbs above | Most audit engagements with definable scope | Firms stop work at the cap; the cap set at the estimate rather than above it |
| Fixed fee | A price per engagement or deliverable regardless of hours | The firm carries overrun risk and prices it in (10 to 20 percent) | Repeatable engagements (annual SOX testing, recurring process audits); budget certainty | Scope defined tightly by the firm; quality squeezed when hours run over; change orders for everything |
| Retainer or managed service | A fixed annual fee for a defined volume of hours or a defined program, with the staff mix and governance set in a multi-year contract | Firm carries utilization risk; buyer commits volume | Hybrid functions buying 1,000 or more hours a year; fully outsourced functions | Unused hours; the mix drifting toward junior staff; lock-in at renewal |
| Outcome-linked | Part of the fee tied to results (recoveries from a payables analytics engagement; milestones met) | Shared | Recovery audits; implementation projects | Independence: an auditor paid on findings has an incentive to find them; unsuitable for assurance work |
The model shapes behavior on both sides, and the choice should follow the work. Assurance engagements belong on capped time and materials or fixed fee; advisory and specialist work on time and materials with a cap once the scope is understood; standing programs on a retainer with the mix and the governance written in. Outcome-linked fees are for recovery work and nothing that produces an opinion. Whatever the model, the engagement letter should fix the hours, the mix, the deliverables, the standard the work meets and the review the function will perform, because a fee is only as good as the scope it buys.
The in-house comparison, done properly
The comparison most committees see is a co-source rate against an in-house salary divided by 2,080 hours, which makes every firm look expensive and every hire look cheap. The right comparison is loaded cost per productive hour. Loaded cost adds benefits and payroll taxes (25 to 35 percent of salary), training and certification, travel, tools and licenses, recruiting amortized over expected tenure, and a share of management time. Productive hours subtract vacation, holidays, sick leave, training, administration, department meetings and planning from the paid year; a well-run function gets 1,400 to 1,550 chargeable hours from an auditor, and functions that assume 1,800 are planning fiction. On that basis an in-house senior auditor in a US regional market costs about $75 to $110 per productive hour, a manager $110 to $150, and a specialist the function could not hire at all. Against that, a co-sourced senior from a national firm at $150 to $275 is 1.5 to 2.5 times the in-house hour, and the difference buys three things the in-house hour does not include: no idle time (the firm’s hours are consumed only when work exists), no recruiting and tenure risk, and access to specialists and surge capacity. The arithmetic favors in-house staff for steady, predictable, generalist work above about 1,400 hours a year per role, and co-sourcing for specialist, intermittent or peak work; the sourcing options guide works a full cost comparison for a 4,000-hour program, and the true cost of an internal audit guide the cost of a single engagement.
| Cost element | In-house senior auditor (US regional market) | Co-sourced senior (national firm) |
|---|---|---|
| Base salary or rate | $95,000 to $120,000 | $200 to $300 list; $150 to $275 negotiated |
| Benefits, payroll taxes | Add 25 to 35 percent | Included |
| Training, certification, tools, travel | $6,000 to $12,000 a year | Included (travel often billed separately) |
| Recruiting amortized; management time | $5,000 to $10,000 a year | Contract administration $5,000 to $15,000 a year |
| Loaded annual cost | $135,000 to $175,000 | Hours purchased times rate |
| Productive hours | 1,400 to 1,550 | All hours billed are productive (review time is yours) |
| Cost per productive hour | About $90 to $125 (lower in smaller markets) | $150 to $275 plus the function’s review time |
| What the hour includes | Institutional knowledge; continuity; availability for the unexpected | Specialist depth; no idle time; surge capacity; an outside view |
Hidden costs on both sides
Co-sourcing carries costs the invoice does not show. Onboarding: every new firm team learns the systems, the people and the methodology, at the buyer’s expense in hours and the function’s in patience; functions that rotate firms every year pay it every year. Review: the function must review the firm’s work to its own standard (Standard 9.5 and the function’s quality program require it), and review of co-sourced workpapers typically costs 10 to 15 percent of the hours purchased. Management: scoping, scheduling, invoice review, change orders and relationship management take a manager’s time. Knowledge loss: what the firm learns leaves with it unless the contract requires knowledge transfer and the function captures it. Dependence: a function that co-sources its specialist work for a decade never develops the skill and pays the premium forever, which may be the right choice for actuarial review and the wrong one for data analytics. On the firm’s side, the hidden costs explain the rates: unbilled proposal and relationship time, bench time between engagements, training, and the partner’s oversight hours that are discounted or absorbed. A function that understands the firm’s economics negotiates better, because it knows which concessions are cheap for the firm (term, predictability, offshore mix) and which are expensive (named senior staff, first-quarter timing, fixed fees on open scope).
Contract terms that protect the function
| Term | What to require | Why |
|---|---|---|
| Rates and mix | Rate card by level fixed for the term with any escalation tied to a published index and capped; proposed staff mix per engagement; invoices showing hours by person and level | Controls the blended rate drift that erodes savings |
| Named staff and continuity | Key personnel named; replacement only with the function’s approval; knowledge transfer at the firm’s cost on substitution | Onboarding costs fall on the buyer otherwise |
| Scope and change | Written scope per engagement; a change order process with approval before hours are incurred; a not-to-exceed on time-and-materials work | Prevents estimate creep |
| Standards and methodology | Work performed under the function’s methodology and the Global Internal Audit Standards; workpapers in the function’s format or system; the function’s review and sign-off | The chief audit executive remains accountable for conformance |
| Independence and conflicts | Firm confirms independence from the external auditor relationship (for listed companies) and discloses other services to the organization; staff rotation for long-running assignments | Regulatory and objectivity requirements |
| Work product and access | Workpapers and deliverables owned by the organization; regulators’ and external auditors’ access to the firm’s work; retention terms | Examiners and external auditors will ask |
| Confidentiality and data | Data handling, location (onshore or offshore), security standards, breach notification, return or destruction | Audit data is among the most sensitive the organization holds |
| Quality and remedies | Rework at the firm’s cost for work that fails the function’s review; service levels for delivery dates; fee holdbacks | Gives the review teeth |
| Termination and transition | Termination for convenience with notice; transition assistance; no lock-in through proprietary tools | Preserves the sourcing option |
| Expenses | Travel policy applied; caps; technology charges excluded or itemized | Expenses can add 5 to 15 percent otherwise |
Negotiation levers that work
Rates are negotiable in proportion to what the function can offer the firm, and the levers are predictable. Term and volume: a two- or three-year commitment to a minimum annual volume buys the largest discount (10 to 30 percent off list), because utilization is what firms sell their partners on. Timing flexibility: work the firm can schedule in its off-peak months is cheaper than work due in March. Offshore mix: accepting delivery-center hours for testing and documentation, with onshore staff on judgment and client contact, lowers the blended rate by 15 to 35 percent; the function should decide the mix, not discover it on the invoice. Competitive process: three proposals against the same scope, compared on mix and leverage as well as blended rate, with the incumbent included; the selecting a consulting firm guide gives the RFP method. Bundling: one firm for several specialist needs buys scale, at the cost of concentration. Rate card over blended rate: negotiating the card by level with a controlled mix beats negotiating a blended figure the firm can meet by staffing down. Fixed fees for the repeatable: annual SOX testing and recurring process audits can be fixed once the scope is known, usually at a saving against the prior year’s actuals. Expenses and extras: travel caps, no technology or administrative surcharges, and partner oversight hours included rather than billed. What does not work is squeezing the rate on specialist work where the pool is small; the firm will decline or staff down, and the function needs the skill more than the firm needs the engagement.
Budgeting a co-source program
A co-source budget is built from the plan, not from last year’s spend. For each engagement in the risk-based plan, the capacity model (the audit plan guide shows MidState’s) identifies the hours the in-house team cannot cover and the skills it does not have; the co-source budget is the sum of those hours at the negotiated rates, plus a reserve of 10 to 15 percent for the engagements the year will add, plus the review hours the function will spend on the firm’s work. Functions typically co-source 10 to 30 percent of their hours in the hybrid model, more in the early years of a function and in regulated industries with specialist requirements; a fully outsourced function buys all of it. Survey benchmarks of total internal audit cost (a small fraction of a percent of revenue, varying widely by industry and size) are too coarse to set a co-source budget and useful only to sanity-check the total; the plan is the budget’s source. Report the program to the audit committee as hours and skills bought, the blended rate, the firms used, the review results and the knowledge transferred, so that the committee sees what the money bought rather than only what it cost. The internal audit KPIs guide includes the co-source measures worth tracking.
Sourcing rules in regulated organizations
Three sets of rules constrain who can be bought. Listed companies in the United States may not use their external auditor for internal audit outsourcing services (Sarbanes-Oxley section 201 prohibits internal audit outsourcing by the auditor), which removes the firm that knows the company best from the pool and raises the price of the rest. Banks are subject to the 2003 Interagency Policy Statement on the Internal Audit Function and Its Outsourcing (with the Federal Reserve’s 2013 supplemental guidance), which permits co-sourcing and outsourcing but holds the board and management responsible for the function, requires a written contract with specific terms (scope, access, independence, examiner access to workpapers), expects the institution to retain the competence to oversee the firm, and warns against the external auditor providing internal audit services; examiners read the contracts. Public bodies buy through procurement law, with competitive tendering above thresholds, framework agreements and Yellow Book or equivalent standards written into the contract; the internal audit in government guide covers the environment. Under the Global Internal Audit Standards, the chief audit executive remains accountable for the work of external service providers and must ensure they conform with the Standards (Domain III and Standard 9.5), which belongs in the engagement letter whatever the sector.
Three worked examples
The three companies used in examples across this site buy co-sourced hours for different reasons at different prices, which illustrates the market better than any one case.
| Element | MidState Beverage | Brightwater Foods | Lakeshore Bancorp |
|---|---|---|---|
| Organization | Three-state drinks distributor, about $221 million revenue, six-person audit function | $180 million food manufacturer, three plants; chief audit executive plus one in-house auditor | $9 billion regional bank; 22-person function |
| What is bought | 140 hours of ERP access review expertise inside the 550-hour FY27 user access audit (role design analysis across 74 roles); plus a standing 1,000-hour process audit program for depot rotations and analytics support | A hybrid arrangement: the regional firm that once performed the whole outsourced function now delivers about 1,000 hours a year of process audits and specialist reviews under the CAE’s direction | 180 hours of quantitative review in the annual model risk framework audit; 120 hours in the allowance audit; penetration testing in the cyber program |
| Provider tier | National firm for the ERP specialist work; the same firm’s delivery center for part of the process program | Regional firm | National firm’s quantitative practice; a boutique for penetration testing |
| Pricing model | Capped time and materials for the ERP review; a two-year retainer for the 1,000-hour program | Fixed fee per process audit from an agreed catalog; time and materials for specialist reviews | Capped time and materials per engagement; a three-year rate card |
| Rates | ERP specialist at $285 (manager level, specialist scale); program blended $190 with 35 percent delivery-center hours | Blended $165 on the fixed-fee catalog; specialist reviews $250 to $400 | Quantitative reviewers $310 to $420 by level; penetration testing $275 blended |
| Annual co-source spend | About $230,000 (the ERP review $40,000; the program $190,000) | About $165,000 | About $380,000 across engagements, 6 percent of the function’s budget |
| Share of total audit hours | About 14 percent | About 35 percent, falling as a second in-house auditor was funded | About 4 percent, all specialist |
| Negotiated terms that mattered | Named ERP specialist; delivery-center share fixed at 35 percent; invoices by person and level; work in the function’s audit management system | Reporting rerouted from the finance director to the CAE when the CAE arrived; fixed fees set from the prior year’s actual hours; rework clause used once | Three-year rate card with escalation capped at a published index; examiner access to workpapers; independence confirmation annually |
| Lesson | The specialist hours were the best money in the plan: the 74-role analysis found what six hundred generalist hours would not | The same firm at the same rate became a different purchase when the CAE scoped and reviewed the work | Specialist review is the only purchase; the function’s own staff cost less per productive hour than any firm for the rest |
MidState’s chief audit executive reports the co-source program to the audit committee each year on one page: hours and skills bought, the blended rate against the prior year, the mix delivered against the mix proposed, the review results, and what the function learned that it can now do itself (the analytics support hours fell by a third in the second year as the analytics/IT auditor took over the routine scripts). Brightwater’s committee learned from the sourcing transition that the price of a firm’s hours is a small part of their value; Lakeshore’s learned, as the model risk management audit guide records, that a co-sourced reviewer’s six hours reading an assumption log found a finding the bank’s own validators had missed. The one-person audit shop guide shows co-sourcing from the solo auditor’s side, and the first 90 days as CAE guide the moment a new CAE renegotiates an inherited arrangement.
Questions about co-sourcing rates
What does internal audit co-sourcing cost per hour?
In the US mid-market in 2026, negotiated blended rates for general audit work run about $150 to $225 an hour from national firms (lower with a large offshore share), $130 to $190 from regional firms and $120 to $180 from boutiques, with specialists (cyber testing, model validation, actuarial, forensic) at $250 to $450 or more. Partner oversight is priced higher but is a small share of hours.
Is co-sourcing more expensive than hiring?
Per productive hour, usually yes: an in-house senior auditor costs about $90 to $125 per productive hour fully loaded against $150 to $275 co-sourced. The co-sourced hour carries no idle time, no recruiting risk and access to specialists, so it is cheaper for intermittent, specialist or peak work and more expensive for steady generalist work above about 1,400 hours a year.
What is a blended rate?
The total fee divided by total hours for an assumed staff mix. It is useful for comparison and weak for control, because the firm decides the mix; ask for the mix in the proposal and on invoices, and compare the leverage ratio (share of hours at manager and above) as well as the rate.
Which pricing model should internal audit use?
Capped time and materials or fixed fees for assurance engagements with definable scope; time and materials with a cap for specialist and advisory work; a retainer with the mix and governance written in for standing programs of 1,000 hours or more a year. Outcome-linked fees belong only in recovery work, never in assurance.
Can a listed company use its external auditor for internal audit work?
No. Sarbanes-Oxley section 201 prohibits the external auditor from providing internal audit outsourcing services to its audit client, and banking guidance warns against it for banks. The co-sourced firm should confirm its independence from the external audit relationship.
How much of the audit plan should be co-sourced?
Whatever the plan’s skill and capacity gaps require: hybrid functions typically buy 10 to 30 percent of their hours, more in a function’s early years or in specialist-heavy industries. Build the budget from the capacity model engagement by engagement, add a 10 to 15 percent reserve and the review hours, and report what the hours bought.
Related guides
- In-house, co-sourced or outsourced internal audit — the sourcing decision and a full cost comparison.
- How to select an internal audit consulting firm — the RFP method.
- When to co-source your internal audit — the ten signs.
- Co-sourcing vs outsourcing — the board-level comparison.
- The true total cost of an internal audit — costing a single engagement.
- Internal auditor salary guide — the in-house pay the rates are built on.
- How to build the internal audit plan — the capacity model the budget comes from.
- Internal audit KPIs and metrics — co-source measures to report.
- The one-person audit shop — co-sourcing from the solo auditor’s side.
- Your first 90 days as CAE — renegotiating an inherited arrangement.
- Internal audit in banking — the 2003 interagency statement on outsourcing.
- Internal audit in government — procurement rules for public bodies.
- Assurance vs advisory — why outcome-linked fees do not fit assurance.
Leave a Reply