Strategic Business Leader · Audit and compliance

Internal Audit Function: Outsourcing and In-House Options for SBL

Updated 11 October 2026 · Fact-checked

Internal audit can be in-house, outsourced or co-sourced, or a company may have none. You decide by weighing cost, skills, independence, size, risk, regulation and control over the work. In SBL, recommend one option, justify it using scenario facts, and note the risks of your choice.

Understand Internal Audit Function: Outsourcing and In-House Options

Internal audit gives the board independent assurance on risk management, internal control and governance. It also advises management on improvements. The question is who does this work and whether the organisation needs it at all.

There are four options. An in-house function uses the company's own employees. An outsourced function is run by an external provider, often an audit or consulting firm. A co-sourced function mixes the two: a small in-house team buys in specialist skills or extra capacity when needed. The fourth option is no function, where management and the audit committee rely on other monitoring.

No single option is best. The right choice depends on the organisation. A large, complex, regulated group with continuous risks usually benefits from an in-house team that knows the business. A small or mid-sized company with limited need may find outsourcing cheaper and more flexible. Specialist areas such as IT security or treasury often justify co-sourcing.

Whether a function is needed at all depends on scale, complexity, risk and regulation. Listed companies under many governance codes should review annually whether they need one, and explain their conclusion if they do not. Small, simple, owner-managed businesses often do not need one. Management supervision, strong controls and the external audit may be enough.

Independence matters in every option. An in-house team should report to the audit committee, not the finance director. An outsourced provider must not also be the external auditor, because that creates a self-review threat. Using the same firm for both roles is usually prohibited for listed companies.

Key rules to remember

Decision factors for the function: Need for internal audit = f(scale, complexity, diversity of operations, risk, regulation, culture, cost-benefit, management information quality); This is a checklist, not a calculation. Use it to structure any answer on whether a function is needed.
Core cost-benefit test: Establish a function only if the expected benefit of assurance ≥ the cost of providing it; Benefits are hard to quantify, so argue them in words: fewer losses, better controls, stronger governance.
Independence rule of thumb: Internal audit reports to the audit committee; the external auditor should not run internal audit for the same client; The second part is a self-review threat. It is a firm rule for listed or public interest entities, and a safeguard issue elsewhere.

How to solve Internal Audit Function: Outsourcing and In-House Options questions

Use this method for any question on in-house, outsourced or co-sourced internal audit, or on whether a function is needed.

1Read the requirement. Decide if you must recommend an option, evaluate the options, or advise on whether a function is needed.
2Pull out scenario facts: size, number of sites, complexity, listing status, industry regulation, recent control failures, skills in the finance team and budget.
3Link each fact to a factor: cost, skills, independence, knowledge of the business, flexibility, control over the work, confidentiality.
4Give advantages and disadvantages of each realistic option, tied to the facts. Avoid generic lists.
5Make a clear recommendation. Co-sourcing is often sensible where specialist skills are needed but a full team is too costly.
6Add safeguards for your choice, such as reporting to the audit committee, a service level agreement, and not using the external auditor.
7Show professional skills: write for the stated reader, stay commercial, and note any scepticism about management's motives.

Quickest way: Facts, factors, recommendation

When to use it: When time is short and the task asks you to advise or recommend on the internal audit function.

List three or four scenario facts in the margin.
Match each to one factor: cost, skills, independence, control, knowledge.
Write one advantage and one disadvantage for the option you favour.
State the recommendation in the first line of your answer, then justify it.
Finish with one safeguard, such as audit committee oversight.

Common mistakes in Internal Audit Function: Outsourcing and In-House Options

Listing generic pros and cons of outsourcing with no link to the scenario.
Students memorise the list and write it out as a recall exercise.
Fix: Open each point with a scenario fact, such as 'With only two sites and a small finance team...', then give the effect.
Saying outsourcing is always cheaper or always more independent.
It sounds true and appears in many textbooks.
Fix: Say it depends. Providers charge fees and may lack business knowledge. Independence can also be weakened if the provider wants to keep the contract.
Recommending the external auditor to run internal audit.
It looks efficient and the firm already knows the company.
Fix: Point out the self-review and independence threat. Recommend a different provider.
Forgetting the option of no internal audit function.
Students assume every company must have one.
Fix: For small, simple entities, argue that management monitoring and the external audit may be enough. For listed companies, mention the annual review under governance codes.
Not giving a clear recommendation.
Students fear picking the wrong option and hedge on both sides.
Fix: Choose one option and justify it. Markers reward a reasoned view, even if they would pick differently.

Worked examples

Example 1

Zentra Foods is a listed manufacturer with 14 plants in five countries. It has no internal audit function. Two plants recently reported inventory frauds that went undetected for over a year. The board is considering outsourcing internal audit to a large accounting firm. Advise the board on whether to outsource or build an in-house function. (10 marks)

Show the solution

Recommendation first: build an in-house function, possibly co-sourced for specialist areas.
Scale and complexity: 14 plants in five countries create continuous, varied risks. A permanent team can monitor them and build knowledge of the business.
Risk: two undetected frauds show weak controls. Regular, visible internal audit presence also deters fraud.
Skills and cost: an in-house team costs more to set up. But frequent work across many sites would make outsourcing fees high over time.
Outsourcing downsides: the provider may lack deep knowledge of plant processes. Staff may rotate. The board has less control over scope and timing.
Co-sourcing: use a firm for specialist work such as IT or forensic investigation of the frauds, where the team lacks skills.
Safeguards: the head of internal audit reports to the audit committee. The provider must not be the external auditor.

Answer: Zentra should set up an in-house internal audit function reporting to the audit committee. It should co-source specialist work such as forensic and IT reviews. The scale, multi-country operations and recent frauds justify a permanent team. Outsourcing everything would be costly and less informed about the business.

Example 2

Kiran Crafts is a family-owned maker of handmade furniture with one workshop, 30 staff and an owner who approves all payments. It is not listed. The owner asks whether it needs an internal audit function. Advise the owner. (8 marks)

Show the solution

Recommendation first: a full internal audit function is probably not justified at present.
Size and complexity: one site and 30 staff means simple operations. The owner can see most transactions directly.
Cost-benefit: a full-time auditor would cost more than the likely benefit.
Regulation: the company is not listed, so governance code requirements do not apply.
Existing controls: the owner approves payments, which acts as a strong control. But this relies on one person, so segregation of duties and fraud risk should be kept under review.
Alternative: buy in occasional reviews from a provider, for example once a year, if the owner wants assurance. The external auditor, if any, should not do this.
Triggers to revisit: growth, new sites, lending covenants or control failures.

Answer: Kiran Crafts does not need a permanent internal audit function now. Owner supervision gives enough control for a small, simple business. It could buy in occasional outsourced reviews, and should revisit the decision as it grows or if control problems appear.

Exam tips

Start with the recommendation, then justify it. This helps the marker find your view quickly.
Use scenario facts such as size, sites, listing status and recent failures. Generic lists score poorly.
Always discuss independence, and name the audit committee as the reporting line.
Consider all four options, including no function and co-sourcing, before settling.
Use the professional skills marks by matching tone to the reader, for example a short, commercial memo to the board.

Practice questions from Audit and compliance

Internal Audit Function: Outsourcing and In-House Options in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Function: Outsourcing and In-House Options: frequently asked questions

What are the advantages of outsourcing internal audit?

Outsourcing gives access to specialist skills, flexible capacity and often lower fixed costs. It can also improve independence because the provider is outside the management structure. The trade-offs are weaker knowledge of the business, less control and ongoing fees.

What are the disadvantages of an in-house internal audit function?

It has higher fixed costs and may lack specialist skills. Staff can also lose objectivity if they are close to colleagues or career-linked to management. It is often best where the business is large and complex.

What is co-sourcing in internal audit?

Co-sourcing combines a smaller in-house team with an external provider. The provider supplies specialist skills or extra capacity at peak times. It suits organisations that need ongoing assurance but cannot justify every skill in-house.

When does a company not need an internal audit function?

Small, simple businesses with strong management oversight and limited risk may not need one. The cost may outweigh the benefit. Listed companies under governance codes should review annually whether one is needed and explain their decision.

Can the external auditor also provide outsourced internal audit?

For listed and other public interest entities this is generally prohibited because of the self-review threat. In other cases it needs strong safeguards and is often avoided. In exam answers, recommend a different provider.