Skip to content

Strategic Business Leader · Management and internal control systems

Outsourcing and In-house Internal Audit for ACCA SBL

Updated 11 October 2026 · Fact-checked

An in-house internal audit team is employed by the company. An outsourced team is a separate firm hired under contract. In SBL, you compare them on cost, objectivity, expertise, flexibility, knowledge of the business and control, then recommend an option that fits the scenario and justify it.

Understand Outsourcing and In-house Internal Audit

Internal audit is an assurance and advisory activity inside a governance framework. It reviews risk management, controls and compliance. A company must decide who does that work. It can employ its own staff (in-house), buy the service from an outside firm (outsourcing), or mix both (co-sourcing).

In-house staff know the business, its systems and its culture. They are available all year and can respond fast. But they cost a fixed salary and training budget. A small team may lack specialist skills, such as IT or forensic work. Staff may also feel pressure from managers they audit, because those managers affect their pay and careers.

An outsourced provider brings a wide pool of specialists and can scale work up or down. Cost is often variable, and the provider may seem more independent. But it knows the business less well, and fees can rise. The company may lose control over scheduling and quality. Confidential data is shared with a third party, and there may be a conflict if the provider also does other work for the company.

The decision is not simply right or wrong. It depends on the company's size, complexity, risk profile, geography, regulation and the skills it needs. The audit committee should oversee the choice and the quality of the work either way. Management remains responsible for the internal control system, and the board cannot hand over that responsibility.

If the external auditor also provides the internal audit service, there is a serious threat to independence. Many governance codes and ethical rules restrict this, so recommend a different provider where it arises.

How to solve Outsourcing and In-house Internal Audit questions

Use this method for any question asking you to discuss, evaluate or advise on in-house versus outsourced internal audit.

  1. 1Read the requirement. Note whether you must list pros and cons, recommend, or advise a specific person such as the audit committee.
  2. 2Pick out scenario facts: size, number of sites, countries, current skills, past problems, regulation, budget and any hint of fraud or weak controls.
  3. 3Set out the options: in-house, outsource, or co-source. Show you know all three exist.
  4. 4Compare on set headings: cost, objectivity, expertise, knowledge of the business, flexibility, control and confidentiality. Tie each point to a scenario fact.
  5. 5Weigh the points. Say which factors matter most for this company and why.
  6. 6Make a clear recommendation. Add safeguards, such as contract terms, service levels and audit committee oversight.
  7. 7Close with the professional skills angle: a balanced, commercial and clearly worded conclusion for the reader named in the requirement.

Quickest way: The CO-ECK check

When to use it: Use when you have a few minutes to plan a short written answer and need a structure that cannot be missed.

  1. Write the letters C, O, E, K, F, C: Cost, Objectivity, Expertise, Knowledge of the business, Flexibility, Control.
  2. Beside each letter, jot one scenario fact that supports in-house or outsourcing.
  3. Mark the two or three factors that matter most for this company.
  4. Choose your recommendation in one sentence, with a reason.
  5. Write the answer: each point as a short paragraph with a point, a scenario link and a conclusion. Finish with safeguards.

Common mistakes in Outsourcing and In-house Internal Audit

  • Listing generic advantages and disadvantages with no link to the scenario.

    Students memorise a list and write it out.

    Fix: Attach every point to a fact in the case. Say why it matters for this company.

  • Saying outsourcing is always cheaper or always more objective.

    Students treat a tendency as a rule.

    Fix: Say it depends. Fees can exceed salaries for heavy use, and a provider may soften findings to keep the client.

  • Forgetting that management and the board stay responsible for controls after outsourcing.

    Students think the duty moves with the work.

    Fix: State that responsibility remains with the board. Recommend audit committee oversight, a clear contract and monitoring of quality.

  • Ignoring co-sourcing.

    Students see it as a choice of two.

    Fix: Mention a hybrid, such as an in-house team plus an outside firm for specialist IT or overseas work, when it suits the facts.

  • Making no recommendation.

    Students fear picking the wrong side.

    Fix: Always conclude. Any option with a reasoned case and safeguards earns credit.

Worked examples

Example 1

Medinova Ltd is a mid-sized pharmaceutical group with sites in four countries. It has no internal audit function. The board is considering a team of three employees. The audit committee chair has asked you to advise whether the work should instead be outsourced.

Show the solution
  1. Facts: four countries, regulated industry, no existing function, likely need for varied skills.
  2. Cost: a team of three means fixed salaries, training and systems. Outsourcing gives variable fees and avoids set-up costs, but fees may be high if work is constant across four sites.
  3. Expertise: three staff are unlikely to cover pharmaceutical regulation, IT and local rules in every country. A firm can supply specialists.
  4. Objectivity: a provider is outside the management chain, so may be freer to report bad news. But it may wish to please the client to keep the contract.
  5. Knowledge and control: in-house staff learn the business deeply and respond quickly. Outsourcing means less control over scheduling and shared confidential data, so the contract needs confidentiality clauses.
  6. Recommendation: start by outsourcing or co-sourcing, since the function is new and needs wide skills. Consider building a small in-house core later. The audit committee should approve the plan and review results.

Answer: Recommend outsourcing or co-sourcing at first. It gives broad expertise across four countries and avoids set-up costs. Protect against weaker business knowledge and confidentiality risk through a clear contract, service levels and audit committee oversight. Review in-house options once the function matures.

Example 2

Harbour Retail plc has an in-house internal audit team of two. Recent reports have been mild, and the head of internal audit reports to the finance director, who sets her bonus. A non-executive director suggests outsourcing to the company's external audit firm. Evaluate the suggestion.

Show the solution
  1. Identify the problem: the head of internal audit reports to the finance director, who sets her bonus, so objectivity is at risk. This is a self-interest and intimidation threat.
  2. Outsourcing could improve objectivity by removing that reporting line and could bring more skills to a team of two.
  3. But the proposed provider is the external auditor. It would review controls it also relies on for the external audit, which threatens independence.
  4. It may then be seen as auditing its own work. Ethical rules and governance codes discourage or restrict this.
  5. Better alternatives: keep the team but make the head report to the audit committee, with the committee deciding her pay; or outsource to a different firm.

Answer: Do not outsource to the external audit firm, because it creates an independence conflict. Fix the real weakness by having the head of internal audit report functionally to the audit committee. If more skills are needed, use a different firm for co-sourcing.

Exam tips

  • Always link points to scenario facts. Generic lists earn few marks.
  • Give a firm recommendation with safeguards. A balanced discussion with no conclusion loses marks.
  • Watch for hidden clues: a small team, many countries, an external auditor as provider, or a reporting line to the finance director.
  • Use the audit committee in your answer. It oversees appointment, scope, independence and quality in either option.
  • Write in the format asked, such as a report or briefing note, and address the named reader.

Practice questions from Management and internal control systems

Outsourcing and In-house Internal Audit in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Outsourcing and In-house Internal Audit: frequently asked questions

What are the main advantages of outsourcing internal audit?

Access to specialist skills, flexible resourcing, no need to recruit and train, and often a perceived higher independence. It can also cut fixed costs for smaller companies. You should still note the drawbacks in your answer.

What are the main disadvantages of outsourcing internal audit?

The provider knows the business less well and may have less commitment to it. Fees can rise, control over timing and quality is weaker, and confidential data is shared. There may also be conflicts if the provider does other work for the client.

Is in-house internal audit more objective than outsourced?

Not necessarily. In-house staff depend on management for pay and careers, which can weaken objectivity. Outsourced providers may also soften findings to keep the contract. Objectivity depends mainly on reporting lines and safeguards.

Can the external auditor also do the internal audit?

This creates a serious threat to independence, because the firm would be reviewing controls it relies on in the external audit. Governance codes and ethical rules restrict or discourage it. In SBL you should recommend a different provider.