Outsourced vs in-house internal audit: which model is right?

Outsourced vs in-house internal audit, or a co-sourced blend of the two, is one of the first choices a board makes when it sets up or reviews its internal audit arrangements. Since the Global Internal Audit Standards took effect on 9 January 2025, the stakes are clearer.¹ The Standards apply in full whether an organisation employs internal auditors directly, contracts them through an external service provider, or both, and in every case the board keeps responsibility for supporting and overseeing the function.²

This article compares the three models on cost drivers, specialist skills, knowledge retention, continuity and independence. It explains what the board remains responsible for when it outsources, sets out the rule that stops your external auditor providing internal audit, and ends with a decision table. If you are starting from nothing, read our guide on how to set up an internal audit function alongside it.

The three models explained

The Global Internal Audit Standards (GIAS) define an external service provider as a resource from outside the organisation that provides relevant knowledge, skills, experience and/or tools to support internal audit services.² How much of the function sits with such a provider is what separates the three models:

• In-house: the organisation employs the chief audit executive (CAE) and the audit team. It owns the methodology, the working papers and the people.
• Co-sourced: the organisation employs the head of internal audit, and perhaps a small team, and buys in specialists or extra capacity that work under the head’s direction and methodology.
• Outsourced: an external provider delivers all or most of the plan, and a named individual from the provider usually acts as head of internal audit. The organisation keeps a sponsor, normally the audit committee chair, and a management contact.

An interim head of internal audit is a fourth, temporary option, often used to bridge a vacancy or to rebuild a function before deciding on its long-term shape.

What the board remains responsible for when it outsources

Outsourcing transfers delivery, not accountability. Under GIAS, the CAE is responsible for conformance with the Standards whether employed directly or contracted through a provider.² The board’s essential conditions under Standard 6.3 still include approving the charter, plan, budget and resource plan, and meeting the CAE without senior management present. Standard 10.1 notes that, whether the function is insourced or outsourced, the board should approve an adequate budget, and Standard 9.3 expects a documented methodology for managing external service providers where they are used.²

The Chartered IIA’s Internal Audit Code of Practice, effective from January 2025 for the financial services, private and third sectors, is direct on the point: where internal audit is outsourced, the Code still applies and accountability for the function must be retained by the organisation. Outsourced or co-sourced work should be subject to the same quality assurance and improvement programme as an in-house function, with results presented to the audit committee at least annually.³ For companies applying the UK Corporate Governance Code 2024, Provision 25 makes monitoring and reviewing the effectiveness of the internal audit function an audit committee responsibility, however the function is resourced.⁴

In practice, a board that outsources should be able to show it has:

• Named the individual who performs the CAE role and confirmed that person’s qualifications and independence.
• Approved the charter, plan and budget itself, rather than accepting the provider’s standard proposal.
• Agreed contract terms covering access, ownership of working papers, confidentiality, data protection, staff continuity and an orderly exit.
• Set performance measures that go beyond delivering the plan on time.
• Planned for an external quality assessment, which Standard 8.4 requires at least once every five years whoever delivers the work.² Our guide to preparing for an external quality assessment explains what assessors look for.

Cost considerations

Comparing day rates with salaries is the most common mistake in this decision. The useful comparison is the full cost of delivering the assurance the board needs, at the quality the Standards require. Standard 10.1 says the internal audit budget includes the resources needed for the function’s operation, including training and the acquisition of technology and tools.² The main cost drivers fall differently on each model:

Cost driver	In-house	Co-sourced	Outsourced
People	Salaries and on-costs are fixed, whatever the workload	Fixed core, variable specialist days	Largely variable, priced per day or per engagement
Recruitment and vacancies	Borne by the organisation, including gaps in coverage	Limited to the core team	Borne by the provider
Training and professional development	Funded by the organisation	Core team funded by the organisation	Built into the provider’s rates
Audit software and data tools	Bought and maintained by the organisation	Mixed	Often supplied by the provider
Specialist skills	Expensive to hold full time	Bought when needed	Drawn from the provider’s wider team
Management time	Line management of the team	Managing the core team and the provider	Contract management and oversight of the provider
Learning curve and transition	Lower once the team is established	Moderate	Higher at the start and whenever provider staff change

Two points are often missed. First, a small in-house team can spend a significant share of its time on administration, reporting and its own development, so productive audit days are fewer than headcount suggests. Second, outsourced fees rise if the provider has to relearn the organisation each year, which is why staff continuity belongs in the contract.

Skills and specialist expertise

Standard 9.4 requires the internal audit plan to consider coverage of IT governance, fraud risk, the effectiveness of compliance and ethics programmes, and other high-risk areas.² Few small teams hold all of those skills. The Standards anticipate this: the CAE should consider contracting an independent external service provider when the function collectively lacks the competencies to perform requested services, and providers may supply specialised skills, complete special projects or perform engagements.² The Chartered IIA Code expects skills and experience commensurate with the scale of operations and risks, and lists training, recruitment, secondment and co-sourcing as ways to achieve that.³

This is where co-sourced internal audit tends to be strongest. The in-house head sets the plan and owns the relationships, while cyber security, data analytics, fraud or other technical reviews are bought for the engagements that need them.

Knowledge retention and continuity

An in-house team accumulates knowledge of the organisation’s people, systems, culture and history that is hard to buy. It also carries key-person risk: in a team of two or three, one resignation can halt the plan. Standard 10.2 asks the CAE to consider succession planning for the CAE position, including discussions with the board.²

An outsourced model reverses the risk. The provider absorbs absence and turnover, but knowledge sits in the provider’s people and files. Sensible safeguards include a named engagement lead and core team, a commitment to give notice of changes, working papers the organisation can access, and a handover obligation if the contract ends.

Independence and reporting lines

Whatever the model, Standard 7.1 requires a direct reporting relationship between the board and the CAE, board authority over the CAE’s appointment and removal, and an annual confirmation of organisational independence.² The Chartered IIA Code says the CAE’s primary reporting line should be to the audit committee chair, who should be responsible for appointing the CAE and for determining when they should be removed.³ Where internal audit is outsourced, that means the audit committee, not management, should select, appraise and if necessary replace the provider.

Each model has its own threats to objectivity:

• In-house: familiarity with colleagues and career dependence on management. Standard 2.2 presumes objectivity is impaired if an internal auditor provides assurance over an activity they were responsible for within the previous 12 months, which matters when staff move into audit from the business.²
• Outsourced: commercial self-interest, such as reliance on the fee or the wish to sell other services, and self-review where the provider has advised on the controls it now audits. Standard 2.2 requires the CAE to confirm that previous advisory work does not impair objectivity before assurance work is done in the same area.²
• Co-sourced: both sets of threats, plus the risk that responsibility blurs between the head of internal audit and the provider unless roles are written down.

Can your external auditor provide outsourced internal audit?

Not while it is your statutory auditor. The FRC’s Revised Ethical Standard 2024, effective from 15 December 2024, states that the firm shall not provide internal audit services to an entity relevant to an engagement, or a significant affiliate of such an entity, where the firm is undertaking an engagement (paragraph 5.45). Paragraph 5.46 makes clear that this covers outsourcing the entire internal audit function, supplementing it in specific areas and occasional ad hoc work.⁵ The rule sits in the section that applies to non-audit services in any statutory audit engagement, so it is not confined to public interest entities.

For public interest entities, the Standard’s list of prohibited non-audit services also includes services related to the audited entity’s internal audit function, and that prohibition extends to the financial year immediately before the period being audited.⁵ Observations on internal controls or on the internal audit function that arise during the audit itself are treated as a by-product of the audit and are not internal audit services (paragraph 5.47).⁵ If you are tendering internal audit, check the bidders’ audit relationships with your group, and remember that appointing a firm as internal auditor may limit your options at the next external audit tender.

Outsourced vs in-house internal audit: which model fits which organisation

There is no universally right answer. The table sets out the factors that usually decide it.

Factor	Points towards in-house	Points towards co-sourced	Points towards outsourced
Size and complexity	Large, complex or multi-site	Mid-sized with some complex areas	Smaller or simpler operations
Volume of audit work	Enough steady work for a full team	Steady core with peaks	Too little for full-time roles
Specialist needs	Recurring, in-depth needs in the same areas	Periodic need for several specialisms	Broad needs, each occasional
Value of organisational knowledge	High, with a distinctive culture or systems	High for core areas	Lower, or offset by stable provider staff
Speed to start	Slower, as recruitment takes time	Moderate	Usually fastest
Board capacity to oversee	Oversees a CAE it employs	Oversees the head, who manages the provider	Must actively oversee the provider
Long-term intention	Building a permanent function	Building gradually	Assurance without building a team

Models also change over time. A common path is to start outsourced to get coverage quickly, appoint an in-house head once the plan justifies it, and keep a co-source arrangement for specialist work.

Housing associations

For registered providers in England, the Regulator of Social Housing’s Governance and Financial Viability Standard requires governance arrangements that include an effective risk management and internal controls assurance framework. Providers must adopt and comply with an appropriate code of governance, have a business planning, risk and control framework approved by the board and reviewed at least once a year, and certify their compliance with the Standard in their annual accounts.⁶ Whichever model a board chooses, it should be able to explain how internal audit contributes to the assurance behind that certification, and how the model covers the association’s highest risks.

How we can help

Innovatex Global provides outsourced, co-sourced and interim internal audit that conforms with the Global Internal Audit Standards, with a named lead and a team that stays with you. If you are starting from scratch, our internal audit function set-up service helps the board agree the mandate, charter and first risk-based plan before choosing a long-term model. We also support housing associations with assurance programmes built around their regulatory obligations. To discuss which model suits your organisation, book a free 20-minute call.

This article is general guidance, not legal advice. Take advice on your organisation’s specific circumstances.

Frequently asked questions

What is the difference between outsourced and co-sourced internal audit?

In an outsourced model an external provider delivers all or most of the internal audit plan, and one of its people usually acts as head of internal audit. In a co-sourced model the organisation employs its own head of internal audit and buys in specialists or extra capacity that work under that person's direction. In both cases the board remains accountable for overseeing the function.

Can our external auditor also provide internal audit?

Not while it is your statutory auditor. The FRC's Revised Ethical Standard 2024 prohibits an audit firm from providing internal audit services to an entity it audits, including outsourcing the whole function, supplementing it or ad hoc work. For public interest entities the prohibition also covers the financial year before the audited period.

Is outsourced internal audit cheaper than an in-house team?

Not necessarily. Outsourcing turns largely fixed salary, recruitment, training and technology costs into variable fees, which often suits smaller organisations, but a large and steady volume of work can favour an in-house team. Compare the full cost of delivering the assurance the board needs, including management time and transition, rather than day rates against salaries.

References

1. The Institute of Internal Auditors, 16 January 2025. The IIA Celebrates the Effective Date of the Global Internal Audit Standards
2. The Institute of Internal Auditors, 9 January 2024. Global Internal Audit Standards
3. Chartered Institute of Internal Auditors, September 2024 (effective from January 2025). Internal Audit Code of Practice: Principles on effective internal audit in the financial services, private and third sectors
4. Financial Reporting Council, January 2024. UK Corporate Governance Code 2024
5. Financial Reporting Council, January 2024 (effective 15 December 2024). Revised Ethical Standard 2024
6. Regulator of Social Housing, 31 March 2015. Governance and Financial Viability Standard – 2015