Outsource v. In House
Running Head: INTERNAL AUDITING: OUTSOURCE V. IN HOUSE
Internal Auditing: Outsource V. In House
Gina Boling
Davenport University
February 21, 2012
Page 1

Outsource v. In House
Abstract
Sarbanes-Oxley has had significant impact on the auditing profession. What impact does outsourcing v. internal auditing have on external audit fees? Can an external auditor be more reliant on outsourced internal audit work?
Page 2

Outsource v. In House
Since the passage of the Sarbanes-Oxley Act of 2002, auditing has become a hot topic.
Sarbanes-Oxley impacted auditing by emphasizing the role of auditing in public corporate accounting and detailing requirements that affect auditing practices. While Sarbanes-Oxley places restrictions on the auditing profession, it does not prohibit outsourcing of the audit function. This paper will examine outsourcing of the audit function and potential benefits and downfalls for companies that choose to delegate this responsibility. This paper will examine whether the external auditor can do a better job with an independent outsourced internal audit department or if it could be reasonable to expect that a drop in quality would occur due to outsourcing.
The Sarbanes-Oxley Act of 2002 had a widespread impact on accounting for public companies and managerial responsibility related to financial reporting. Title II of SOX relates to auditor independence and sets requirements for external auditors dealing with public companies. Section 201 of Title II prohibits CPA firms from providing external audit services in addition to internal accounting services. Sections 206 deals with conflicts of interest and seeks to establish a more independent role for the external audit function. Sarbanes-Oxley also set new responsibilities for the audit committee which an internal audit group would report to and that would be liaison between an external auditor and management (University of Cincinnati, 2011).
Sarbanes-Oxley also impacted management’s responsibility over financial reporting.
Title III of Sarbanes-Oxley deals with management’s responsibility and seeks to establish more
Page 3

Outsource v. In House responsibility and transparency in corporate accounting. Section 302 establishes managerial responsibility over financial reporting and requires company officers to certify in their annual or quarterly reports that the financial statements are true, accurate, and fairly presented. Section
302 also requires that management establish and maintain a system of internal controls.
Management is ultimately responsible for the internal control program and to ensure it is functioning properly (University of Cincinnati, 2011).
The regulations of Sarbanes-Oxley have changed the nature of public accounting. While there are restrictions as to what services outside firms can perform for public companies, outsourcing was not altogether banned. The FDIC published regulation 5000- statement of policy that discusses the internal audit function and its outsourcing. This policy sets the characteristics for the internal audit function, effect of outsourcing arrangements on the independence of external auditors, and prohibition on internal audit for firms doing internal and external audit work.
Businesses today operate in a dynamic environment of constantly changing rules and regulations. Outsourcing of the internal audit function has many advantages for businesses.
Foremost, expertise may be one of the greatest benefits of outsourcing. This type of expertise could be very costly if a company tried to compile the same types of individuals in an in-house internal audit team. Overlapping positions may be eliminated and fixed cost employees would be replaced with variable cost workers of the outsourcing firm (Aldhizer Et al., 2003).
Page 4

Outsource v. In House
Companies may benefit from the experience of firms providing their internal accounting services by providing of best practices and identification of areas of improvement (Quality Auditing,
2010). These types of arrangements also may allow for more flexibility of company resource allocation. All of these measures may lead to a reduction of costs and increased efficiency of the internal audit function.
While there are several benefits to outsourcing the internal audit function, there may also be disadvantages. An in-house internal audit department may have stronger ties to the company and to the data, this would allow for more in-depth knowledge of company operations and transactions which would give a company maintained internal audit department an advantage over an outsourced department. Outsourcing the internal audit function may appear to be a cost saving measure but it may end up being more costly than expected. The Institute of Internal
Auditors estimates that internal auditing services can be up to ten times the amount of external audit fees (Aldhizer, Et al, 2003). Independence in fact and appearance must also be maintained to be Sarbanes-Oxley compliant. A company cannot have its internal audit or other ancillary services provided by the same company that provides the external audit services. Loss of control is also another disadvantage of internal audit outsourcing (Businesscompetence.com, 2012).
This loss of control could be very detrimental due to the managerial responsibility requirement of
Sarbanes-Oxley. Whether or not the internal audit function is in-house or outsourced, management is ultimately responsible for the information in the financial reports and the internal controls in place.
Page 5

Outsource v. In House
The question of analysis is whether an external auditor can do a better job due to outsourcing of internal audit function or if outsourcing is being done for cost saving, does it drive down the quality of the internal audit function and in turn increasing the work of the external auditor. To properly analyze this question we will address its different components.
First we will look at the expectations gap, reliance of external auditors on the internal audit department, and the quality issues of internal audit out sourced and in-house.
This question can be looked at from two perspectives, reality and perception. Are outsourced internal audit departments held in higher regard than in-house departments? If this is the case, then the external auditor could have more assurance that the financial statements are fairly presented and the internal controls are functioning as needed. In reality, this is an example of where an expectation gap can become a problem. If the external auditor perceives the outsourced internal audit to be superior to that of an in-house team, they may lower the firm’s detection risk and erroneously issue a satisfactory audit report for the company’s financial statements. The Institute of Internal Auditors conducted a study in 2008 ‘Co-Sourcing and
External Auditors’ Reliance on the Internal Audit Function’. This study looked at three types of internal audit arrangements, in-house, outsourced, or co-sourced and evaluated external auditors perceptions of the reliability of each internal audit type. The results of this study showed that external auditors had a statistically significant response level in comparing the quality of inhouse versus outsourced or co-sourced arrangements. Co-sourced or outsourced arrangements were also rated higher in external auditor perception of objectivity, competence,
Page 6

Outsource v. In House skill, and independence. This gives credence that an internal audit group that is outsourced may be superior to that of an in-house group.
The relationship between reliance of the external auditor and the internal auditor is also central to the question. The PCAOB Auditing Standard No. 5 discusses this issue in depth.
During the engagement planning, the external auditor will evaluate the extent that they will rely on the work of others. The external auditor may use the work of others or even enlist the help of the internal audit team for purposes of the internal control audit. The auditor may also use the work of others to obtain evidence to support the auditor’s assessment of control risk over the financial statements (PCAOB.org, 2012). When using the work of others, the auditor must also assess the competence and objectivity of the source. This indicates that external auditors may rely on internal audit work and this practice is acceptable by professional standards as long as the external auditor has pursued their due diligence to evaluate the quality of the sources they are relying on.
Finally, quality is a factor in the question of external auditor’s ability to rely on the outsourced internal audit. Is an outsourced internal audit department better or lower quality than in-house departments? When we looked at the positive attributes of having an outsourced internal control department we saw that they tended to be more specialized, more objective, and with greater experience levels than their in-house counterparts. This suggests that an outsourced team may be of higher quality and technical capabilities. If the outsourced internal control
Page 7

Outsource v. In House department is of higher quality than in in-house team, outsourcing for cost savings would not reduce the quality of the internal control function and perceived risk will not be impacted.
Can an external auditor do a better job relying on an outsourced internal audit team or will does outsourcing for cost savings measures show a drop in quality and a higher perceived risk of outsourced internal audit? The components evaluated, the expectations gap, reliance of external auditors on the internal audit department, and the quality issues of internal audit out sourced and in-house do not show that an outsourced internal audit is of lesser quality or perceived reliability. The reliability of an in-house versus outsourced team does seem to be a factor that influences perceived risk of a company’s internal audit department thus driving external auditor work and driving up fees.
Other factors may be more pivotal in increasing detection risk and in turn, increasing external auditor work necessary. The overall risk of the firm is the largest factor in detection risk. External auditors are less likely to rely on internal audit work for high risk firms. External auditors show preference for work done by internal auditors that are outsourced for high risk firms (IIA, 2008). The preference of outsourced internal audit in high risk firms may be due to the more objective nature of an outsourced team. For a high risk firm, weak internal controls or history of internal fraud may put a company in a better position to benefit from the use of an outsourced internal audit function. In the early years, this may increase perception risk of a company and causing higher external audit fees but in the long run, the company will benefit from having an objective, experienced audit team directing its internal accounting actions.
Page 8

Outsource v. In House
The question proposed suggests that if an outsourced internal audit is done for cost saving measures that quality will go down and fees will go up because the external auditor must perform a more in depth audit. Looking at the rising cost of external audit fees, we can take a different approach to explain effect of internal audit fees. To begin this analysis, we can rule out whether an audit team is in-house or outsourced. There was not any research to suggest that an in-house internal audit function was detrimental to a company’s increased perceived risk, nor was there any evidence to support that an outsourced internal audit department may increase external audit fees by increasing perceived risk. Perceived risk and audit fees being central to the question we may examine other factors that may affect these areas. Prior to the passage of the Sarbanes-
Oxley Act of 2002, many CPA firms were in the business of providing external audit services, internal audit services, and other roles which put the external accountants in a position of wearing conflicting hats in performing a company’s accounting services. Since the passage of
Sarbanes-Oxley, accounting firms are no longer allowed to perform both internal and external accounting services. With the passage of SOX, a new market was open for CPA firms that lost client base because they were performing multiple services for their clients. This loss of income would increase elasticity for a perfectly competitive market where the CPA firm has become the price taker rather than the price maker. This concept takes risk and out sourcing versus in-house out of the equation and show that prices may be driven down due to the newly competitive nature of the market. Over time, firms would be able to re-establish their client base until equilibrium has been reached and prices equalize.
Page 9

Outsource v. In House
Another factor that may affect price is firm size and the overall economic conditions.
The market as we know it today may look much different in the future, many factors affect the rise and fall of fees of external audit services. The overall economic conditions may benefit or hinder companies in the setting of fees. The market conditions will affect demand and the ability of a company to grow and become more efficient.
A company’s decision to maintain an in-house or outsourced internal audit function may involve several factors. Weighing the pros and cons of an outsourced internal control department is the most important step a company can take to ensure it is making the best decision to operate at its ultimate efficiency capacity. The comparison of external audit work required and the resulting fees does not seem to have a strong connection with whether a company utilizes an internal audit function that is in-house or outsourced. There are benefits and negatives for both sides. The needs of the company must be examined to determine which is best for the company and achieving its future goals. Management holds ultimate responsibility over the financial reports and internal controls regardless of whether the function is in-house or outsourced. Sarbanes-Oxley requires this certification from management and the decision to outsource or keep in-house has no bearing on management’s responsibilities.
Other factors are more prevalent to suggest that external accounting fees may be more significantly affected as compared to the outsourcing/in-house decision. Factors under the company’s control are history, following proper procedures to lower risk, and maintaining a
Page 10

Outsource v. In House strong system of internal controls. The factors under the CPA firm’s control are competitive drive, quality and, perceived quality of outsourced work. Factors out of both of their control are the nature of the market and regulatory factors.
This analysis has shown that the decision to outsource is not cut and dry. Whether the driving factor is cost savings, increased reliability, or the desire to decrease perceived risk, a company must look at several areas to determine if outsourcing is right for them. Sarbanes-
Oxley has impacted internal and external auditing along with the operating environment of businesses today. SOX compliance may direct a company with a higher perceived detection risk to outsourcing as outsourced departments are given higher marks in objectivity and experience.
Looking at cost we found that outsource vs. in- house did not have a significant impact on factors that may affect external auditor’s scope of work and fees. Professional standards lay out how an external auditor should conduct an engagement, what types of work they should rely on, and how they should go about verifying accuracy of the financial statements and effectiveness of internal control. These factors alone are more significant in the scope of external audit work. The decision to outsource or keep an in-house team does not seem to be a significant factor in detection risk or a decrease in audit fees.
Page 11

Outsource v. In House
References
Aldhizer, G, Cashell, J. & Martin, D. (2003). Internal audit outsourcing. The CPA Journal. Retrieved
February 23, 2012 from http://www.nysscpa.org/cpajournal/1996/1096/features/Outsourcing.htm
Business-competence.com (2012). Internal audit outsourcing services. Retrieved February 20, 2012 from http://www.business-competence.com/internal-audit-outsourcing.html
Desai, N., Gerard, G., & Tripathy, A. (2008). Co-sourcing and external auditors’ reliance on the internal audit function. Retrieved February 19, 2012 from www.the
iia .org/download.cfm?file=5743
FDIC.gov. (2010). 5000-Statements of policy. Retrieved February 19, 2012 from http://www.fdic.gov/regulations/laws/rules/5000-3250.html
Institute of Internal Auditors. (2009). IIA position paper: the role of internal auditing in resourcing the internal audit activity. Retrieved February 19, 2012 from www.the
iia .org/download.cfm?file=66876
PCAOB.org. (2012). Auditing standard No 5. Retrieved February 19, 2012 from http://pcaobus.org/Standards/Auditing/Pages/Auditing_Standard_5.aspx
Quality Auditing Services. (2010). Outsourcing your quality QMS audits. Retrieved February 20, 2012 from qualityauditing .com/.../ Outsourcing %20your%20 Internal %20 Audits .doc
University of Cincinnati. (2011). Securities lawyer deskbook. Retrieved February 20, 2012 from http://taft.law.uc.edu/CCL/SOact/toc.html
Page 12