Effective approaches to co-sourcing your internal audit

AUDIO | October 31, 2023

Authored by RSM US LLP

Internal audit has grown significantly in recent years. Some organizations handle their own audit function, maintaining a full staff in-house. Others outsource it completely, hiring a third-party provider to manage everything from financial controls to Sarbanes-Oxley (SOX) compliance. In between those two ends are a variety of blended solutions, also known as “co-sourcing.”

Episode 2 of our new podcast, “Material Observations: Insights on Internal Audit,” details the different types of co-sourcing available to companies, as well as their pros and cons. Listen in as Katie Landy, RSM risk consulting principal and host, talks about the most effective approaches to co-sourcing with her guests, Eliot Mitchell, RSM risk consulting director, and Anne Slattery, RSM risk consulting partner.

From talent and experience to training and tooling, the internal audit panel shares insights from their real-life experiences, including two of the insiders’ perspectives as co-sourcing clients on the other side of the internal audit table.

Whether your company currently co-sources, outsources or handles its internal audit function in-house, listen to our latest podcast episode to learn some new approaches and benefits to consider moving forward.

Edited transcript

Katie Landy: Hello and welcome to episode two of RSM's Material Observations, Insight on Internal Audit, where we explore what's happening in internal audit today. I'm your host, Katie Landy, risk consulting principal at RSM. Today, I'm joined by Anne Slattery, risk consulting partner at RSM, and Eliot Mitchell, risk consulting director at RSM. We're talking about effective approaches to co-sourcing. Let's get started.

Hello, and a warm welcome to my friends and colleagues, Anne and Eliot. Thrilled to have you both here with me today.

Eliot Mitchell: Thanks, Katie.

Anne Slattery: Thanks, Katie. Happy to be here.

KL: On the topic of co-sourcing, we've certainly seen this become a very popular practice in recent years, obviously offering numerous benefits to organizations. With that said, let's start by defining co-sourcing and what it means. We know that can look different depending on the size of an organization, the complexity of organization, and of course, the respective internal audit functions. So Anne, maybe I'll start with you.

AS: Yeah. And I think it's such a good question because we've really seen it evolve over the years. And on one end of the spectrum, you have complete outsourcing where there's no one in-house internal audit and it's all outsourced to a provider, like RSM or another firm, from the internal audit director all the way down to kind of the associate level folks and reporting to the audit committee and doing all the things, all the internal audit and maybe SOCs.

Then on the other end of the spectrum, you have maybe a full group that you're just kind of supporting barely, maybe a project-based approach where they maybe just need a cyber individual or they need one person for SOCs. So mostly it's done in-house.

And then there's that, my favorite situation, I guess, or partnership I should say, is the co-source where you have that institutional knowledge of one or more people inside the organization and then you're partnering completely with that firm. So most of the times, at least in my experience, there's only a few people in that co-source internally, maybe between one and five. And then most of the legwork is done by a firm like RSM.

EM: Yeah, and I think we've had experience in all three models, loan staff, co-source, and outsource. And certainly there's benefit, pros and cons to each model. I think we find co-sourcing to be the best medium where management maintains control of the internal audit function. They are the ones that are liaisoning the most with leadership and with the business.

But what you really get in that co-sourcing model that I think is attractive is you eliminate the need to do heavier recruiting. You have faster agility to getting talent that brings the whole power of a partnership to the arrangement. You have scale of geographic resourcing and technical capabilities with the ability to bring the power of firm in. And maybe a loan staff model, it's a little bit harder to bring immediate technical support and maintain that technical support throughout the needs that you have within your internal audit function.

And again, just I think what you really find in a co-sourcing model that differentiates too is you get the value of having a dedicated team and a dedicated leader oftentimes that can see eye to eye and work collaboratively with the chief audit executive and help support some of the C-suite-level conversations and thinking that the chief audit executives are looking for.

So lot of cool things about a co-sourcing model. We see that really picking up and being a major opportunity for growing companies.

KL: So fun fact about me, and I think you both know this, I myself am a former RSM client where I used RSM in a co-sourcing capacity. So I'm pretty confident I could answer this question based on my experience. And Eliot, you alluded to this in some of your responses, but when we think about the overall benefits and even the value proposition of a co-sourcing model, what else can we share with our listeners today on that specific approach?

EM: Well, Anne, I've had the privilege of working with you on one of your co-sourcing client's recently, so this is top of mind. I think the first thing, I'm just going to use this as an example. The first thing I've noticed that our client is really appreciating is that we're bringing a more variable, deeper talent pool to what their needs are. They came to us and were really looking for a number of different very specific things to help bolster their internal audit function. They already have a big team, but they're looking for that deeper, more robust talent pool.

And what I've gotten to do with you, Anne, is just come in and bring my specific area of expertise and you've been able to bring other teammates experiences and expertise in while being the face of the relationship and working at the C-suite, CAE level to make sure it flourishes. So I mean, that's to me, deeper talent experience and capabilities is the biggest differentiator. The other thing, and one of my co-sourcing client's where we're really making a big difference is with training and tooling.

So I think bringing the power of a firm, the power of a consulting team to a co-source internal audit relationship, what we bring is variance and experience and a lot of our partnership and real partnership relationships, the CIE is saying, "I'd love for you to bring some of your talent and team to help train my staff and help build some of my internal audit team up so that we're growing and we're building some of the same capabilities that you guys are bringing to the table."

We're also bringing in the co-source relationship much more tooling, automation, technology advancements that I think many chief audit executives are craving to help bolster what they're doing.

So those to me are the two, deeper experiences and talent. And then training and tooling are two of the biggest differentiators from my perspective.

AS: I couldn't agree more. Katie, one of the many things we have in common is that I too, I didn't use to use RSM, but I was internal audit director on the other side of the table. And one of the things that really drove me to co-source, and one of the things that really inspired me to come back to consulting is that I really wanted to look at everything within the organization and with the talent. And not that they weren't talented, it's we just did not have the expertise. There was no way we could hire a person that had that skillset.

And so I found myself co-sourcing and reaching out to firms with those specific skills and was able to make such a bigger impact inside the organization where I worked through the co-source model. So that really inspired me to say, "Okay." When I was shifting my career, I saw how really just neat and challenging of a job it was to identify, look at an organization and identify all the different needs they might have and then go into the firm and reach it back into the firm, into the expertise that we have and pool them and get the right people involved.

So I think from the perspective of the board of directors inside an organization and just from a governance perspective, knowing that you have that full bench backup people that can come in and help you in an emergency or in a situation that's very technical and that have experience with other clients, that's another big thing, that they can bring you perspective. That's just not possible if you're only seeing one organization. I think to me, those are the things that are just really outstanding about the co-source model and how beneficial it can be for both parties.

KL: When I think about some of the value you guys were each describing, it's allowing our clients and even our teams to go deeper on topics that maybe we wouldn't have traditionally covered. Fortunately, unfortunately, internal audit will always be a compliance function, but what we've seen, I think we can all agree that it has really transformed in our careers in terms of the types of work and the types of value we're bringing to organizations.

What comes to mind more recently when we think about a lot of the challenges organizations had throughout the pandemic and all the supply chain disruptions, RSM has experts in the operations and supply chain space that has then partnered with internal audit. And we are bringing new insights to organizations that if we had only taken a traditional internal audit practitioner approach, we would never have delivered on.

So I think that's just so exciting. I'm sure, and I know each of you have great relationships throughout the firm as well. Any other value or partnerships that you are kind of most proud of and would like to share?

EM: So the job of the chief audit executive is difficult, all right? Like you said, Katie, there's the compliance aspect of what they have traditionally always been focused on, but a dynamic internal audit department is really looking at any risk across an enterprise and trying to figure out how can we bring unique projects or dynamic projects to address those risks and solution them. And so if you think about it from that perspective, the chief audit executives at dynamic companies, they are not going to be able to address all of those different areas by themselves or with certain areas of expertise they have within their team.

So I think to answer your question, Katie, some of the more valuable and exciting internal audit type of projects that I'm seeing more and more of are those in which some of our co-source clients are asking us to help them address challenges they haven't been able to address before, like how do we help our organization begin to grow top-line revenue faster than we have in prior years?

That's not typically something that internal audit is on the front page to be trying to help with, but chief audit executives are more and more getting smart to try to push for those, to push towards addressing those risks and bringing... We've been able to on some of our clients, bringing some of our strategy, management consulting, sales operations type of technical support into the internal audit relationship to help bring technical consideration into a more traditional audit program around that type of risk, as an example. I was able to help lead one of those projects recently for a client, and we were able to uncover all sorts of just simple value-adds that are helping drive sales incentives, sales operations in a way forward that's helping that company with their top-line revenue expectations.

So I think that there are numerous other examples like that where the dynamic needs on risk management are changing and being able to bring the full power of technical capabilities to those needs is really rewarding.

AS: I love the way that it's evolving where internal audit is being invited into more of those operational efficiency, just executive C-suite conversations. But when you think about it, it feels to me like it's really evolved over the last, or at least for me over the last five to seven years. And when you think about it from the C-suite perspective, they already have us in there looking at every facet of their organization from a compliance perspective or from an internal audits perspective. So to waste those insights and for us to not be stretching beyond that is really inefficient for the client themselves. So I think it's really fantastic that we're seeing a lot more asks.

I'm going to go a little narrower in my answer on something that I think our team has really mastered that is new for us and just kind of beyond compliance. But we've recently been asked, probably started three years ago, to do full-scale risk management reviews of commodity trading and hedging groups within organizations. Katie, I know you and I worked on one together recently, and the team has now completed four or five of those end reviews all with different commodities. But the final product being that we're giving the board of directors and the risk management team at that organization comfort that their risk tolerance and their processes are within what they're comfortable with, and that what's actually happening matches up to the risk vision for the organization so they're not hindering themselves from process perspective or they're not overly risk adverse and they're not too liberal.

So that has been a really interesting skillset to develop for our team. And then also we have partnered with technical accounting who are just experts in the accounting side of that and really brought together a team that can, it's like a SWAT team for those types of audits. And it happened very organically and I think it's bringing a lot of value to our clients. So definitely proud of coming out of the woodworks with that.

And then the other one I can't not mention because Katie, I know you specifically have shared some of your deliverables and really great work around ESG and developing control frameworks around ESG for our clients. And so I think that that one is something that the firm should be very proud of. And I know that Eliot, you too have been involved in some of those.

KL: Appreciate those insights and some really great examples. I think it's fair to say these benefits are very clear, they're very compelling. But let's switch gears for a second. Want to talk a little bit about the challenges, when we think about co-sourcing the challenges that are presented there as well. But really if we look at those challenges, they're really opportunities. How can we make the experience for the client, for our teams that much better when we kind of take a step back and look at some of the lessons learned over our co-sourcing experiences?

So I'll ask each of you to share where have you had some challenges, how have you overcome them? And then how have you applied that to engagements going forward?

AS: Immediately comes to mind is just navigating an organization, people getting buy-in from the customer, not the CFO, not the board of directors. You get buy-in from them, but you need buy-in and you need to partner with the people you're either sometimes auditing, sometimes doing process reviews for, whatever it is. And that is an art. And it takes a lot of work and it takes a lot of patience. And I think that's truly the most satisfying part of our job is when you can get to that level where you build trust and they actually come to you for help. But it takes a while to get there.

So I think that's the biggest one. And then I think just similarly, how much does the organization know about what internal audit is and the support structure you get inside a company? So navigating that is a challenge, but also such a reward when it works well.

EM: Yeah, that's spot on, I think. And you're thinking from our perspective, and we have those challenges every day. I'm going to take it in a little different direction, try to think of it from the perspective of the chief audit executive. And if you're picking a model between a loan staff, co-source, and outsource model, there's so many pros to a co-source model. I have to imagine though that from the audit leadership side of an organization, taking the leap into now being a relationship manager and really overseeing the work of not just your direct reports, but now another firm that as you're really counting on and you're really expecting to be able to deliver dynamic work, stay on task, stay on time, bring expertise globally anywhere you need, that I think is an art form of its own that chief audit executives are trying to navigate.

And so from what we try to bring is making sure that we can make the relationship management aspect of how we serve our clients as seamless as possible. And I think it starts with, like I was mentioning earlier, if we're working in a co-sourced relationship, it's critical that we're bringing a leader of that function from our team and we're trying to bring the same type of talent and expertise that the chief audit executive has themselves so that we can see eye to eye, that we can work collaboratively and we build that trusted partnership that the leadership of internal audit function believes they have a companion right next to them that can help navigate and orchestrate all the different ins and outs of what you're needing from that provider support.

And I think that's where we've had the most fruitful relationships is where we have an Anne, who is a former chief audit executive that can sit right next to the chief audit executive for her clients and say, "I've been there. I've done that. Here are 20 different ideas for how we tackle these different risks together," versus a chief audit executive feeling like they're constantly having to pool from a pool of team, pool of resources and oversee and manage the day-to-day of what they're doing. That's on us. And I think we really do a great job of trying to bring that leadership, management, and delivery excellence to ease that relationship management stress from the clients.

AS: Eliot, I love that you went to the other side of the table because just to get a little vulnerable here, I recall reporting, my first year reporting to the audit committee when I was in that seat. And I mean, frankly, I was terrified. I had this group underneath me and then this co-source partner, and I would not have gotten through that if that partner at that firm had not been so supportive, pulling in the resources I needed, helping summarize what are the important things. And it's not that I didn't know anything. I did, but I needed that lift. "Here's a better presentation. Here's a better way to frame it. Let's look at this too."

So I think about that a lot when I'm supporting others now, and that's really just, that's the role we want to play. So if you can get to that point where somebody is trusting you to help them look good and present well, then you've done a good job.

KL: I think being that extension, when we say we as a team, it's not we, the RSM team and we, the client team, it's the collective we. And I think you guys hit the nail on the head, and I know we all feel this. That's not always a guarantee. And that takes time to develop those relationships and build that on trust. And we all get in a cadence of working together. But when we do that and we do it well, it's extremely, extremely powerful.

I know that, obviously, we all have different backgrounds and we've done, we work within different industries, but we've worked across a number of different co-sourcing engagements, different size of companies, some domestic, some global. And I just want to think about and how we could share with our listeners, if a company is thinking about seeking a co-source provider, what are some of those characteristics of a business partner, a co-source provider that they should really be considering? What would you maybe, hey, this should weigh more heavily in your decision, hey, this is a more nice to have? So if you were going to kind of advise somebody, how would you do that?

EM: I love advising people, so I'll go first. Number one for me is understanding. You want a provider that can really understand the business challenges of your industry, right? I mean, if you're a chief audit executive and you were one of our national leaders in industrials, if you're a chief audit executive that is navigating some of the challenges of that industry every single day with a large oil and gas company, let's say, then you want to be able to make sure that your provider has seen the same challenges and can go deep on what's going on in the industry and how we address the different risks and opportunities associated with that.

So to me, that would be number one is just really knowing that you're working with a leadership team in your co-source relationship who knows the business challenges that your company's going through and has seen it and can adapt to them.

I really, I'll hit it again, I just think the dedicated leadership of a director, chief audit executive type of person that you know is your go-to source that is trusted and has been in your shoes before, I think I would be looking for that in a co-source relationship because it's just critical to being able to feel like you have somebody on your team in that same view as you that can help navigate the demand of what a chief audit executive has to do with their C-suite-level leaders and boards and audit committees.

And then the last one I have is just depth of talent and technology skills. So whether it's international capabilities, whether it's operational supply chain technical skills, whether it's cybersecurity risk, you want to make sure that you're entering into a co-sourced relationship with a provider who's deep on talent, and then can also bring simple and smart technology into the way that we deliver and the way that we enhance what internal audit is going to do.

So that could be simple automation, building data analytics into your internal audit program, using best in practice technology advancements like large language models, AI and making our jobs of writing reports a little easier, bringing ideas and technology advancements into their relationship. That's what you're looking for in a provider, and I think critical to making sure that the co-source arrangement goes well.

AS: So I think you're spot on. I would say the first thing that comes to my mind is the ability to flex on top of what Eliot said, of course. But I think the ability to flex to what the company and the organization needs. So honestly, I feel like this is why some consultants get a bad rap is because they come in and they just throw the most advanced, fancy solution at things. And so I really feel, I mean, I have to say at RSM, I don't see that. I see our ability to understand what the client wants, and maybe we say, "Okay, down the line, here's your maturity level," and really meet them where they are.

But then at the same time, we have some really big accounts with advanced technology, advanced infrastructure that do want some of that more advanced solution. So I really value that because I think that in order to really be a part of our client's team and an extension of their team, we have to understand where they are. And I think we're good at doing that.

And then just on a more surface level, I think it's important for, say you're in the interview process for a co-source arrangement. You're across the table from a couple different firms. Something I think is important to look at is how the team interacts with one another and how is their chemistry, how are they bouncing off each other, and are you only meeting with partners or can you talk to somebody that you're going to be working with day-to-day and how valued are those folks.

And so I really value that, again, about our teams and our ability to showcase that because it's true. So I think that if I were to give advice going into an evaluation process, I would really look for that.

KL: I think everything that you guys just described is so important because a lot of this is qualitative. And it's hard, when we think about making a decision like this, there is quantitative components that have to be considered. But it's hard to put a price tag on some of these more qualitative metrics. And Anne, what you just described, observing the team, you may not get that opportunity, but it really drives the power of having that opportunity to be together before you make that investment in that relationship going forward. So I love what each of you guys just shared.

I'm going to move on to my last question. And there's a quote that I heard someone say once, and I really like it. "The quickest path between yourself and another person is a story." I myself love to learn from stories, and I think it's extremely powerful to share with our teams, with our clients, our listeners here. And it really gives people something to remember, something to consider, really something to connect with. So just thinking about each of your careers as internal auditors, what is one or two things that you are most proud of? Or do you have a memorable experience that really has stuck with you throughout your career?

AS: So overall, it's the relationships. It's the someone calling my cell phone and asking... If they call my cell phone or text me and ask me for advice on something or help with a presentation, I mean, that is what I am here for. That's why I do this job. So I think it's that informal communication after you've built a relationship and you're the person they think of to shoot a note to, that when they need something, it means the world to me. And that is what I think I'll remember long after I do this job.

One specific experience I'm going to share just because it's pretty recent. We have been working with a client for a long time, I'd say five, six years. They are in the beginning, it was a small engagement. We just did their local operations in the US from a SOCs perspective. And they've done a ton of acquisitions and we were a part of each of those with a similar team and been together with that team, not only from our side, but from their side. And we recently, after all those years of different time zones, because a lot of those acquisitions were international, we recently took this amazing trip to visit those sites and meet everyone in person that we've been on Zoom calls with three years and toured the operations. Just, it was probably a client trip of a lifetime in terms of what we were able to establish in building relationships and working onsite with those folks for a week.

The best part about it was the teams that work together, not me and the other partners and the CAE, but the actual teams that are constantly cracking up at weird times on calls over Zoom, being there at dinner together and getting to celebrate a little bit of all that hard work that's gone into building those relationships. So it was just a really neat experience with people that we have built a great relationship with.

EM: That's awesome. I'm going to make fun of myself from the consulting side of things for a second. Two things that come to mind that really get me excited in our role. This is very internal audit nerdy. But the first is when you're working in a co-source relationship, when you're going into an internal audit project with an auditee or stakeholder who could not be less interested in working on that particular project. And by the end of the project they're seeing the value you've provided and that we've created something that they didn't expect and that we're actually helping them get things that they wanted by bringing valuable recommendations upward to their leadership through internal audit. That's the coolest feeling. And had a situation like that just a week ago with a client that was really great.

The other one, in co-sourcing, again, this is a benefit of co-sourcing from my perspective, but in some client relationships that I've found really valuable, we've actually been doing work to help train individuals on the internal audit team. And an example I'm working on right now that is really rewarding is this client of ours started a co-sourcing relationship looking for us to just kind of help around certain technical audits. And we've actually built the relationship to be much more dynamic where they'd like us to help them completely work with their team to develop a data analytics program for their internal audit function and train their people on how to use analytics throughout the audit engagement.

And so we're building a tailored, structured analytics development program for them, a training program, and we're meeting with their team who couldn't be more excited about learning a...

AS: That's awesome.

EM: ... technical skill every single day.

AS: All right, we got to talk about that offline, Eliot. [inaudible].

EM: The reward on that is so cool. It's so cool. And that's the co-sourcing differentiator, right? I think if you're in a loan staff engagement, you're not even thinking that way. You're just saying, "I need hours from somebody to execute a project." If you're fully outsourced, you're not getting, there isn't anybody in the internal audit function to train. So I mean, to me, that's really cool and something that is really rewarding.

KL: I just love each of those stories. I think it really demonstrates and showcases the power of co-sourcing.

So with that, thank you. Thank you to RSM's Anne Slattery and RSM Eliot Mitchell for sharing each of your insights and your expertise on this topic that is near and dear to each of our hearts. And thank you to our listeners for joining today.