According to a survey conducted by The IIA’s Affiliate in 2016, the majority of publicly listed businesses in Malaysia, which is nearly 54%, had fully outsourced their internal audit functions. Moreover, IIA’s Survey also found that outsourcing is more common in smaller and mid-sized companies, and less so in the finance sector.
IIA’s Survey raises an essential question – Is outsourcing ICFR Audit a viable and sustainable option. Especially considering the number of organizations that may face challenges with ever-increasing Governance and Risk complexities.
A company’s internal control over financial reporting (ICFR) is a process that is designed to provide reasonable assurance concerning the dependability of financial reporting and the formulation of financial statements for external objectives, which are in accordance with the Generally Accepted Accounting Principles (GAAP).
There’s no doubt that professionals need to expand their skill-sets to keep up with the regulator and shareholder’s demands for assurance. Be it in terms of emerging risks and advisory services for risk, business, and operational strategies.
Management, BOD’s, and those responsible for rapidly evolving, tech-driven segments, will pursue arrangements that suit their demands and budgets the best.
While most believe that a well-resourced and independent internal audit department that comprises of the company’s executives and employees remains to be the best option for most organizations, outsourcing audit functions prove to an effective strategy
Due to such notions, most businesses miss out on the chance to explore alternative outsourcing strategies, including co-sourcing or financial advisory services. Such outsourcing services can augment the staff of ICFR Audit functions, and provide the required specializations that are either specific to engagements, or to fulfil the company’s temporary recruitment/staffing needs.
In 2015, a survey of IIA’s Common Body of Knowledge (CBK) found that nearly 38% of organizations turn to outsourcing services to meet their business demands, including functions such as HR administration, financial management, or GRC functions.
For example, in the United States, deployment of outsourcing strategies by large-cap corporations is even more prevalent. But, when an organization pursues to outsource their ICFR Audit entirely, the management and the BOD must understand their obligations. It ensures that the outsourcing service is of the highest quality and that it serves the organization’s best interests.
For organizations that are considering to outsource their ICFR Audit, you can refer to valuable resources mentioned in the IIA position papers. It outlines the critical organizational roles and responsibilities regarding the Audit. The role of Internal Auditing for resourcing the audit activities states that the organization should retain ownership of the audit function. Then, certify the quality of the same, no matter what method of service has been deployed, outsourcing or otherwise.
According to IIA, if an organization decides to outsource the complete ICFR Audit procedures, the management and executive board still must provide its oversight. It helps ascertain that the outsourcing services follow all necessary audit compliances.
Usually, an in-house liason, such as an executive or a senior management member, should be appointed the responsibility for ‘managing’ the ICFR audit activities. The BOD’s role or that of an equal regulatory body is critical for supervision concerning the ICFR Audit procedures, whether or not you outsource your audit functions.
The IIA’s position paper also states a list of few key considerations that organizations must make if opting to outsource IFC And ICFR Audit procedures:
The organization’s financial condition may necessitate outsourcing as the only practical option for acquiring skilled, timely and expertly delivered IFC and ICFR services.
No matter the size of the organizations – be it small, medium, or large companies, all can opt for outsourcing at any time. It may be for multiple reasons that include, but are not limited to, the following:
Short-Term Staff Shortages
Speciality Skill Needs
Analysis of Remote Business Locations
Especially for small and medium-sized organizations, outsourcing proves to be strategically smart. In case the company is either unable to or doesn’t want to hire full-time or permanent internal auditors, outsourcing ICFR Audit requirements and functions proves highly beneficial as you get expert delivery and save on costs.
A few jurisdictions may forbid outsourcing of ICFR audit functions. However, even if laws permit, outsourcing the IFC and ICFR audit procedures should be carefully performed by choosing a trusted and registered external auditing firm. Otherwise, it may pose compliance conflicts and possibly impair the company’s reputation.
TRC Corporate Consulting’s Internal Audit Professionals have extensive experience in delivering ICFR audit services to clients across many industries. At TRC Corporate Consulting, our collaborative approach and insightful framework can help you answer the following critical questions for your company’s ICFR Audit Procedures:
Positioning: Is the internal audit function of your company strategically positioned within the business to facilitate improved business performance
People: Does your internal audit team has the right staffing strategy to provide the established objectives
Processes: Do the company’s internal audit procedures support your business to achieve its financial objectives. Is the IA department receptive enough for shifting business demands
Besides, we supplement not only our qualified internal auditors but also help you with subject-matter experts for functions such as treasury, operational risk management, financial management, purchasing, shared services, tax, and several other functions. Some of our solutions include:
Establishing an Internal Audit function
Undertaking risk assessments
Developing assurance prospects
Classifying and supervising Key Risk Indicators (KRI)
Delivering specialist skills to implement audit engagements in specified areas such as fraud investigations, project supervision, and revenue assurance
Imparting training facilities for internal audit professionals.
TRC Corporate Consulting can help you align your IFC and ICFR Audit function’s with tactical objectives with crucial business processes. We also take into account the overall risk management, compliance supervision, accounting functions and company performance. As a result, we help you fulfil your ICFR Audit Requirements and effectively perform you IFC and ICFR audit procedures.