Strategic Business Leader · Internal control and management reporting

Internal Audit Outsourcing and Review of Controls for ACCA SBL

Updated 11 October 2026 · Fact-checked

Outsourcing internal audit means a firm, not an employee team, performs the work. It gives expertise and flexibility but can weaken organisational knowledge, control and confidentiality. To review controls, internal audit identifies risks, tests controls, judges effectiveness, and reports findings with practical recommendations to the audit committee.

Understand Internal Audit Outsourcing and Review of Controls

Internal audit gives the board independent assurance on risk management, internal control and governance. It does not run the controls. Management does. Internal audit checks whether they work and reports where they do not.

A company can run internal audit in-house with its own employees, outsource it to an external firm, or use a co-sourced mix. The choice depends on size, complexity, cost, the need for specialist skills and how much the board values deep business knowledge.

Outsourcing has clear attractions. You get specialist skills (IT, fraud, treasury) when you need them. Costs are more flexible because you pay for work done rather than carry a permanent team. The provider is often seen as more independent because its staff have no career ties inside the company. The drawbacks are real too. Outsiders know the business less well. Quality and continuity can suffer if the provider rotates staff. Confidential data is shared with a third party. Management must still oversee the provider. Independence can also be at risk if the same firm is the external auditor or sells consulting services to the company.

Reviewing controls follows a logic. Start with the objectives and risks. Identify the controls meant to address them. Test whether they are well designed and operating as intended. Then judge effectiveness and report. A good report states the finding, the risk it creates, the cause and a specific, practical recommendation with an owner and timescale.

In SBL, you are expected to apply this to the case. Do not recite a list. Say which advantage or disadvantage matters most for this company, and recommend a course of action.

Key rules to remember

Internal audit report structure: Finding → Risk/Impact → Cause → Recommendation → Management response; Use this order for every control weakness you report. It shows you understand why the weakness matters, not just what it is.
Control review sequence: Objective → Risk → Control → Test → Conclusion; A sound approach to evaluating any control. Design effectiveness asks if the control would work. Operating effectiveness asks if it did work.
Outsourcing decision test: Benefit (skills, flexibility, independence) vs Cost (knowledge loss, confidentiality, reduced control); Weigh both sides against the facts in the scenario and reach a reasoned conclusion.
Reporting line: Internal audit reports to the audit committee, not to the finance director alone; This protects independence and ensures findings reach those charged with governance.

How to solve Internal Audit Outsourcing and Review of Controls questions

Use this method for any question on outsourcing internal audit or reviewing and reporting on controls.

1Read the requirement and note the verb: discuss, evaluate, recommend, or advise. Note who you are writing for, such as the audit committee or the board.
2Identify the key facts in the scenario: company size, complexity, geography, past control failures, current internal audit set-up, and any independence concerns.
3For outsourcing, list advantages and disadvantages, then keep only those that fit the facts. Link each point to the company.
4For control review, link each weakness to a risk, then to a consequence for the business such as fraud, error, loss or non-compliance.
5Give specific recommendations. Say what to do, who should do it and how it reduces the risk. Avoid vague advice like 'improve controls'.
6Reach a clear conclusion or recommendation, for example in-house, outsource or co-source, with the reason.
7Format as required (report, memo or briefing). Use a professional tone and keep it clear for professional skills marks.

Quickest way: Fit-to-facts shortcut

When to use it: Use when time is tight and you need a structured answer within a few minutes.

Write three headings: Benefits, Drawbacks, Recommendation. For control reports use Finding, Risk, Recommendation.
Pick the two or three points that the scenario evidence supports most strongly.
Give each point one sentence of explanation and one sentence applying it to the company.
Finish with a one-line conclusion that answers the requirement directly.

Common mistakes in Internal Audit Outsourcing and Review of Controls

Listing generic advantages and disadvantages with no link to the scenario.
Students memorise lists and write them out.
Fix: Choose points that match the company's facts and refer to them by name, for example its overseas sites or its fraud history.
Recommending outsourcing or in-house without a conclusion.
Students fear being wrong and stay neutral.
Fix: Take a position and justify it. A reasoned view earns marks even if another view is possible.
Writing vague recommendations such as 'strengthen controls'.
Students identify the weakness but do not think through the fix.
Fix: State the specific control, who owns it and how it addresses the risk, for example independent review of supplier bank detail changes.
Ignoring independence and ethics issues when the outsourced provider is also the external auditor.
Students treat outsourcing only as a cost decision.
Fix: Flag self-review and familiarity threats. Suggest a different provider or clear safeguards.
Confusing the role of internal audit with that of management.
Students think internal audit designs and runs controls.
Fix: Say management owns controls. Internal audit assesses them and reports, and should not take on management decisions.
Reporting weaknesses without explaining the risk or impact.
Students describe what is wrong but stop there.
Fix: Add a sentence on the consequence, such as financial loss, misstatement or regulatory breach, to show why it matters.

Worked examples

Example 1

A listed retailer with 60 stores in four countries has a small in-house internal audit team of three. The board is considering outsourcing the function to a large accountancy firm. The company's external auditor is a different firm. Advise the audit committee on whether to outsource.

Show the solution

Identify the facts: a wide geographic spread, a small team with limited capacity, and no conflict with the external auditor.
Advantages that fit: the provider has international reach and can cover all four countries. It can supply specialist skills, such as IT and inventory controls, that a team of three cannot. Costs become more flexible.
Disadvantages that fit: the provider will know the retail business less well at first. Staff may change. Sensitive sales and customer data is shared with a third party. Management must still supervise the provider and agree the scope.
Independence: the firm is not the external auditor, so the main independence threat is avoided. The audit committee should still confirm the firm sells no conflicting consulting services.
Weigh up: the limited scale of the current team and the international spread favour outsourcing, or at least co-sourcing, so the company keeps a small in-house team for business knowledge.
Safeguards: a clear service contract, confidentiality terms, key performance measures, and reporting directly to the audit committee.

Answer: Recommend outsourcing, ideally on a co-sourced basis. The external provider gives international coverage and specialist skills that a three-person team cannot. The risks of lost business knowledge and data confidentiality can be managed through a keeping a small in-house team, a strong contract, and direct reporting to the audit committee.

Example 2

Internal audit at a manufacturer finds that purchase orders above a set limit are often approved by only one manager, and that goods received notes are not matched to invoices before payment. Draft the main findings and recommendations for the audit committee.

Show the solution

Finding 1: high-value orders are approved by only one person.
Risk: there is no check on a single approver. This raises the risk of fraud, collusion with suppliers or unauthorised spending.
Cause: the approval policy has no second approver requirement above the limit, or it is not enforced.
Recommendation 1: require two authorised approvers above the limit, built into the purchasing system so it cannot be bypassed. Finance should review a monthly exceptions report.
Finding 2: goods received notes are not matched to invoices before payment.
Risk: the company may pay for goods not received, or pay incorrect amounts or duplicates. This leads to financial loss and misstated payables.
Cause: payment is processed without a three-way match of order, receipt and invoice.
Recommendation 2: introduce a three-way match before any payment is released. Exceptions should be investigated by someone independent of purchasing. Assign the accounts payable manager as owner with a timescale.
Ask management to respond with agreed actions and dates, and plan a follow-up review.

Answer: Two weaknesses: single approval of large orders and no three-way matching. Each creates risks of fraud and loss. Recommend dual approval enforced by the system, and a three-way match before payment, with named owners, deadlines and a follow-up review by internal audit.

Exam tips

Always tie advantages and disadvantages to the scenario. Generic lists score poorly.
Give a clear recommendation. SBL rewards judgement and commercial awareness.
For control weaknesses, use finding, risk, recommendation. Add the owner where you can.
Watch for hidden independence issues, such as the same firm acting as external auditor and internal auditor, and raise them.
Use the format asked for, such as a report to the audit committee, and write professionally for the professional skills marks.

Practice questions from Internal control and management reporting

Internal Audit Outsourcing and Review of Controls in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit Outsourcing and Review of Controls: frequently asked questions

What are the main advantages of outsourcing internal audit?

You gain specialist skills, flexible costs and often greater perceived independence. A provider can also cover several locations. You should still link these to the company in the question.

What are the main disadvantages of outsourcing internal audit?

The provider may lack deep knowledge of the business and may change staff. Confidential data is shared externally, and management must still oversee the work. Independence can be at risk if the provider also does other work for the company.

How do you evaluate the effectiveness of internal controls?

Link each control to a risk, then assess its design and whether it operates in practice through testing. Conclude on whether the risk is reduced to an acceptable level. Report weaknesses with recommendations.

What should an internal audit report recommendation include?

It should state the finding, the risk it creates, the cause and a specific action. Add who should act and by when. Recommendations should be practical and proportionate to the risk.