Question

1. There has been a trend in recent years for companies to outsource their IT function. What effect does this have on IT internal controls? How does management and the auditor get comfortable with internal controls when functions are outsourced?

2. Many companies are now outsourcing their internal audit function. What are your thoughts on this and does this have an impact on accounting for payroll? What are the advantages and disadvantages of this?

Answer 1

1.

Outsourcing a range of business functions has become common practice for enterprises across the world. According to the Arvato UK Outsourcing Index, the value of outsourcing contracts in the private sector swelled to £4.9 billion in 2017, representing a nine percent increase on the year before.

This particularly applies to the outsourcing of IT functions, which accounted for a massive 73 percent of the UK outsourcing industry in 2017. This volume is also doubling each year, with more than twice as much spent on IT outsourcing in 2017 (£3.8 billion) than 2016 (£1.7 billion).

Effect on IT Internal Control:

Outsourcing means that internal resources are made available for different purposes, rather than trying to accommodate many extra IT functions. In cases where all IT functions are operated in-house, staff may end up dabbling in areas - such as IT or accounts - that they weren't specifically brought on to do. This can end up sapping their capacity to help in areas where they can bring more innovative potential.

This depends on context, but if you replace an in-house team with outsourced workers, this can have a detrimental effect on employee morale. It can also increase anxiety in the workforce, as people worry that their jobs may be at risk too.

A positive work culture can engender high levels of employee satisfaction and productivity, and is therefore something you do not want to jeopardise at any cost. To avoid this, have clear discussions with employees about the outsourcing, the reasons for it and how it will work in practice for any departments closely linked to the functions being outsourced.

"Many organisations continue to under-invest in the skills needed to manage outsourcing deals, either in terms of managing broader retained organisations or in vendor management abilities,"."This can hamper transition and transformation activities which often causes value to be eroded over the life of a contract as deals fail to keep pace with evolving business needs or technological changes."

Management and the auditor get comfortable with internal controls when functions are outsourced:

This removes the necessity for expensive training of employees and providing other employee benefits such as insurance or sick pay. You can also hire on a per-project basis, meaning you only pay contractors for the work completed, rather than tying your business into a lengthy contract. Having said this, some contractors can quickly seek to renegotiate the terms of the work, and employers may find the total cost of outsourcing steadily inching up.

"Outsourcing still offers an opportunity to reduce costs through offshoring, although care always needs to be taken to factors such as the cost of remote working methods, taxes and transfer pricing, for instance," says Pepper. "Additionally, it can improve access to scarce skills at times of peak demand, for instance in cybersecurity."

2.

The practice of outsourcing some or all of the internal audit function to an independent third-party firm affords an organization numerous benefits over maintaining an employee-only internal audit function. Examples of these benefits include:

• An independent internal audit review allows for control of employment costs related to the internal audit function. Many organizations may not have the size and cash flow to support a full-time audit staff. Even in larger organizations, using a combination of employee and consultant internal auditors allows for flexibility with respect to expenditures in this area.
• Independent consultants will often specialize in particular industries and bring an in-depth knowledge of that industry, utilizing years of experience to support an internal audit function within an organization, regardless of the age or experience of the particular organization.
• Independent consultants are often aware of issues, both industry-specific and general, that the individual organization may not be privy to, thereby being in a position to offer guidance across those areas to help alleviate the risks and possible negative impact on the organization.
• An independent internal audit review allows an unbiased assessment specific to the organization’s industry of operation. This allows for new ideas to be communicated to improve efficiency and effectiveness of operations, improve internal controls, and reduce risk.
• The independent audit function, often results in the development of benchmarks, which management and employees may use as a standard to measure performance.
• There is an element of independence added to the internal audit function that may not be effectively realized using only employee internal auditors that are being directly paid and possibly influenced by the organization itself.
• The independent approach allows for outside consulting and advisement of industry best practices, which allows the organization to generate a set of operational standards by which the internal audit team can examine and judge compliance, resulting in a more in depth internal audit.

What are the advantages of outsourcing internal audit? In my view, internal audit departments gain a few key advantages when they engage in a sourcing relationship. First, the department becomes scalable. The in-house team can be easily supplemented with additional resources to assist in execution to bring a particular subject matter expertise that may not already exist internally. Second, outside firms have global internal audit practices that all follow consistent methodologies and have local expertise. As a company expands, for example, internal audit is able to keep pace and understand new geographies without needing to expand the internal team immediately. Third, the outside firms provide services to myriad clients across all sectors. Our business serves clients that reach across nearly every major corporate category and size. Having an outside partner that shares experiences across those verticals can streamline and simplify work, when there’s already a built in familiarity from an external partner. At Bank of America Merchant Services, we find tremendous value in understanding leading practices as well as leveraging the firm’s existing tools and frameworks. This support enables us to provide a more consistent, consultative audit approach in the long-run that will enhance the business that ultimately enhances our client’s experience.

What are the biggest drawbacks? Cost and continuity of resources are typically the biggest drawbacks of outsourcing or co-sourcing. It is typical for a comparable resource at a service provider to cost approximately three to five times the hourly cost of an internal associate. However, this often makes sense if the resources are augmenting a team for a specific period of time or bringing unique expertise. As for continuity, sourcing relationships can be challenging if the people assigned are constantly changing. Besides the administrative aspects of onboarding, managing, and separating contractors, sourcing partners do not have the insight gained from being part of a company’s day to day operations. When I was at a Big Four accounting and consulting firm delivering internal audit sourcing services, I felt like I knew so much about my client’s business. However, after taking the general auditor role at Bank of America Merchant Services, I quickly learned that my knowledge and my team’s knowledge of the processes, risks, and controls were deeper and more relevant than in an outside role.