Culture of Compliance is available on iTunes, Google Play Music and Spotify. Listen now using the player below or download for later. (If you do not see a player, please accept functionality cookies and refresh the webpage.)
A Different Approach to Internal Audit Transcript
This transcript was assembled by hand and may contain some errors.
It has been edited for readability.
Sabrina: Welcome to Frazier & Deeter’s Culture of Compliance podcast series, where we discuss compliance as a competitive advantage in today’s marketplace. This is Sabrina Serafin, Partner and National Practice Leader of Frazier & Deeter’s Process, Risk and Governance (PRG) practice. Today, we’re talking to Bradley Carroll, a Principal here at Frazier & Deeter, who is going to talk to us about outsourcing and co-sourcing of the internal audit function
Today’s discussion is based on a session in which Bradley participated as a panelist at last year’s Financial Services Exchange for the Institute of Internal Auditors, when he served as the Senior Vice President and Director of Internal Audit with State Bank. Bradley, welcome.
Bradley: Good afternoon.
Sabrina: Could you give us a bit of a background about your career and how you’ve spent time on both sides of the internal audit table as a customer and now as a service provider?
Bradley: Sure, I started my career in Internal Audit at Central Bank in Monroe, Louisiana, which is a $900 million bank, and that was a great first exposure to get a good foundation to learn what internal auditing was. From there, I moved to Carter’s children’s wear in Atlanta, Georgia, where I doubled the size of the staff when I joined. It was a great opportunity early in my career to get exposed to a lot of internal audit methodology. I was managing a portion of the internal audit department; many people with two years of experience don’t have that opportunity.
From Carter’s, I moved to Wachovia Bank, a $72 billion bank, so it was on a different scale from Central Bank. But again, I learned a lot there. We had an incredible audit methodology training program and a great deal of support to learn internal audit theory. I passed the CPA exam when I was there and decided that I needed to trade banker’s hours for CPA hours, and I spent the next 14 years doing that. I worked for a small firm, then started my own firm and eventually sold the business to my partners and moved back into banking.
I was fortunate enough to be hired as the Chief Audit Executive at State Bank, which was a $5 billion community bank, and it was a new position, new department, so I got to create it in my own image. And it was a great challenge and great fun. State Bank has recently been purchased by Cadence Bank, and it was time to move on, and so I’ve just recently joined Frazier & Deeter in their PRG group, and I’m looking forward to the next chapter.
Sabrina: And we’re happy to welcome you! Based on your very storied past, we want to discuss today the pros and the cons of outsourcing and co-sourcing internal audit, and first, in case we have listeners who have never thought about a sourcing option, can you talk about the situations in which outsourcing or co-sourcing makes sense?
Bradley: Certainly. I think that you have to start with the IIA standards on proficiency, which is standard 1210: you can’t provide audit services unless you have the proficiency on staff to do so. When you look at today’s business, with the speed of business, with the changing environment, with big data, it is very hard to have the subject matter experts on staff full time. Richard Chambers, who’s the president of the IIA, has even said that co-sourcing and outsourcing are leading-edge practices in internal audit. In order to add value and to be a part of the strategic solution for your company, you have to be moving forward with them.
I think in some areas you will see that it is cheaper to completely outsource the internal audit function than to have full-time employees, when you consider their benefits and the other costs besides salary. I think there are many times that you see small entities that do not have the resources to have internal audit in-house. Many times, they will have someone who is called the Internal Auditor who has never been trained in internal audit; they just don’t have that capacity and the resources. There are times when you are short-staffed to your audit plan, so you’ve got excess capacity that you have to fill up, which could be temporary, and you don’t want to hire a full-time employee, so you look to either co-sourcing or outsourcing.
There are other times where you need a subject matter expert in an area for a limited period of time, and you cannot, again, in today’s business environment, have every subject matter expert on an audit staff, so you hire them as needed. There are times where you would have a full-time employee that’s on leave, and you need someone to more or less back-fill those positions. So, I think those are a lot of the times that you look at different sourcing options besides insourcing.
Sabrina: Excellent points, and I want to call attention to the fact that at the Financial Services Exchange panel, there were a number of questions from the audience asking specifically about some of the challenges of outsourcing. So, you just went through a lot of the advantages; let’s talk on the other side of the table.
Bradley: Outsourcing presents a lot of challenges, because they’re not your employees. They’re not invested in the company. You have challenges with them understanding your company culture; they may not have their finger on the pulse; they may not understand who the key players are; they don’t understand the politics; they’re not involved in the grapevine. They walk in to do a specific set of procedures, and then they move on.
With outsourcing, many times the cost can be greater than having it insourced, which I think you’ll find is regional. With outsourcing, you have to determine if you want to use one provider for all or if you want to piecemeal it with multiple providers based on their individual experiences. I think that you sometimes lose some continuity because there is turnover, and you won’t have the same auditor on the same job the next year. Larger companies that are providing outsourced services tend to staff who’s available at that time, rather than who’s familiar with your job. You may feel like you’re training someone every year. Your quality assurance and improvement program is much more difficult to establish and show the progress that you’re making when you have outsourced internal audit.
Many times, with the outsourced internal audit, you will see that you get either checkbox audits or drive-by auditing, where it’s not providing a lot of depth; it grabs the low-hanging fruit and moves on. Standards require that we add value and that we’re a part of the strategic plan and helping the organization achieve its strategic plan. That’s difficult if you’re using co-sourced or outsourced services.
Sabrina: Since you brought it up, let’s turn to co-sourcing. It’s not as widely understood. Let’s talk about how it works and how it differs from a fully outsourced internal audit program.
Bradley: Sure, I’ll start with the differences first, if you don’t mind. I think the differences are: if you’re going to build a fence, you can go contract with a fencing company and tell them, “Here’s the scope,” which would be your property line, and you could outsource them building the fence for you. Tell them that, “This is where I want it,” and “let me know when you’ve got it done.” They provide all the expertise, materials, they do it their way, it gets done.
Co-sourcing is when you go grab your handyman neighbor and bring him over and say, “We’re going to build a fence.” And you’re out there with the posthole digger and the level and the nails, and he’s got some more expertise than you do, but you have some basic knowledge, and he’s providing a little bit more knowledge in certain areas to help you get that fence built. So, that’s a co-sourcing arrangement.
Co-Sourcing is truly a temporary or supplemental audit team or an audit individual, a subject matter expert. They typically will follow your audit methodology, they will use your internal audit software and they will use your internal audit programs. The team may be integrated with in-house as well as co-sourced staff; typically, the Chief Audit Executive (CAE) issues the report in the standard format for the entity and the CAE basically is just managing an additional head count or multiple headcounts for a temporary period of time until that audit is over or until other resources are back in play.
Sabrina: Great analogy. Do you have any advice for our listeners or for organizations that are considering their options regarding their approach to internal audit? And let’s talk about how sometimes this has to be sold to the organization, even when the Chief Audit Executive believes that this is the right solution.
Bradley: I think the first point you’ve got to make is that it’s not a one size fits all; it is a one size fits one. Because something works for another organization that may look similar to yours, it may not work for yours, so you have to analyze, and through that analysis you should be able to sell it. That analysis should talk about the subject matter expertise. You should look at the standards that you have to meet, you should look at the cost and what value is it going to add. I think all of those are some things you have to look at in order to be a successful audit department. Just because it works at one entity, it’s not going to work at yours.
I think you have to start out by defining your goals: what is your objective of the overall audit plan, how do you meet that objective, is it an outsource solution, is it a insource and co-source solution, do you have the talent, do you have the proficiency, do you have the hours to meet the audit plan and how do you supplement that? You have to balance if you need so many hours. Those hours should probably go to an area where you also need a subject matter expert so that you’re not having in-house staff idle. So, it’s a balancing act, it’s an a la carte menu at times where you have to maximize the exposure to external resources and maximize your internal resources. I think you have to select someone who agrees with your internal audit methodology and your audit approach so that they are a partner with you, someone who is not going to just check the box or do some drive-by auditing but are going to add value to your internal audit function.
Sabrina: On that note, which I think is the most important point, I want to thank Bradley for participating on our podcast and for sharing your insights. For our audience, thank you for listening to Frazier & Deeter’s Culture of Compliance podcast; please join us for our next episode as we continue to discuss transforming various compliance requirements into investments in your business.