Recipe for purchasing internal audit services
My top nine advise
In my first blog I made the statement that the role and tasks of internal audit have changed and developed over past decades, although the expectation for the added value striving from it has remained almost unchanged through this time. In my opinion internal audit can create value to the organization in very many ways. One of them is using external service providers in individual, risk based, internal audit engagements. Internal audit may acquire external specialist services to for example to add audit resources or complement existing audit expertise with specialist knowhow and thereby ensure the success of the internal audit engagement and added value to the organization. Internal audit engagements can also be entirely executed by purchased services. In this situation the organization typically still employs internal audit professional who is independent in internal audit matters and reports directly to chief executive officer, audit committee and the board of directors.
Internal audit may have indirect impact on an organisations revenues although its operations are not revenue accumulating by nature. Successful and well targeted internal audit engagements may however support an organization's profitability and facilitate obtaining goals. It is therefore fully justified to conclude that internal audit function needs to be successful when acquiring external services the same way as the rest of the organization is.
Purchasing internal audit services from external service provider requires specialist expertise. I list below some of my thoughts and advice about how to avoid most of the mistakes related to purchasing internal audit services. As always, the responsibility weather or not to follow them remains the responsibility of oneself.
1) Tender, tender, tender
Don`t forget the importance of tendering when acquiring services from external service provider. During the tender process you will learn about the subject, get to know top specialists and be able to deepen your knowledge about the internal audit engagement area in dialogue with the specialists. So don´t underestimate the meaning of tendering, even if your sector or organization would not necessarily require it when purchasing external services.
2) Familiarise yourself with the services providers profiles and make sure that they have enough relevant internal audit experience from your industry.
I personally value industry experience high, although sometimes added value may stem from the fact that the internal auditor has no prior industry experience and may thus be able to view the target area with out-of-the-box mindset.
3) It is people´s business.
Did you feel good chemistry between yourself and the key people from the internal audit engagement team from the get-go? Great if that happened. Dare to trust intuition when choosing among service providers. You can only make first impression once. If collaboration feels challenging before it has really started, it most likely will be going forward as well. Remember to ask yourself if you met the service provider with an open mind and if you were easily approachable before accusing the service provider being socially challenged. Collaboration is a two-way street. Although you are the buyer and the party with money, you have a role to play in making sure that the collaboration really works.
4) Pay attention to the knowhow of the professionals presented in the offer document.
Ensure that the offered internal audit team has enough seniority and specialist expertise that is required in making the engagement a success. You have to have vision of what kind of expertise you want to have in the engagement team. And then the most important thing: Communicate your needs clearly also to the service provider. The service provider is not a mind reader, does not know your organization and people involved as well as you do. You should have vision what kind of purchased specialist resources makes the most out your organization in terms of collecting information. Keep in mind that seniority is expensive and on the other hand junior specialists have important role to play which is not advisable to be undermined.
5) Challenge the service providers on the internal audit engagement objectives and scope.
By ensuring already in the planning stage that all parties understand the objectives and scope in the same way you are making sure that the end result meets your expectation. Remember to communicate to the team any material observations that you have made about the business area so that the internal audit can be targeted from the start to the identified risk-based weaknesses which should be scrutinized in more detail.
6) Know the specific internal audit engagement area sufficiently well already in the first meeting.
Make necessary investigations in your organization before meeting the external services providers - you save everyone´s time and efforts. In other words, know what you want already in the first meeting. You can´t expect the service provider to meet your expectations if you have not decided what you want from the internal audit engagement.
7) Make clear what your role is in the internal audit engagement.
Are you in or out? Let everyone know what you will take part in and what not. Let them know also what your concrete contribution to the internal audit engagement is. This is not just a responsibility of the service provider.
8) Remember to follow accumulated costs during the engagement, not just in the beginning and at the end.
Let them know how you follow and monitor costs, and agree a clear procedure in the event that the accumulated costs overrun the estimated costs.
9) If the internal audit engagement fails, have a direct and honest conversation with the external service provider and especially with yourself.
Did you give clear instructions for the service provider and was the objectives of the engagement even obtainable?
10) What would you add to the list? Reach out to me. You can find my contact details from the Contact page.