Role

This section deals with the role and rationale of IA and whether it should be in-sourced or outsourced (make or buy).

In 1957, MacPherson, Sinnott and Stokvis placed the internal audit profession in the realm of the industrial revolution and subsequent growth of scale and complexity of organizations, thereby explaining the rationale for internal audit from the perspective of Agency Theory.

From what the speakers said the answer to the questions, "Why does IA exist?" and "Why do some companies have them and others don't?" was simple: management needed them. The simple truth must be that there is no other answer than that. Since internal auditing is not mandatory, a direct need must be met. That in itself doesn't end the dispute. Take a look at the following.

In an IIA Inc study (1997a) pertaining to outsourcing the following was noted: "we need to think about what is truly 'unique' about the internal auditing function. When we asked internal auditors to define what was 'unique internal auditing', no one thing stood out. The closest thing to being unique is the internal control orientation of existing external internal auditing departments." (1997a, page xii) If the internal audit community isn't able to formulate what is unique about them, then there is really a need to worry! The same study also concluded that internal auditing is not homogeneous (1997, 125). Therefore, we shouldn't hold our breaths waiting for an

one size fits all answer to what it is and isn't. The study also concluded that if a function is not unique, it will be more susceptible to outsourcing.

If management has a need, then the option is to either create one internally or hire them in the market: make or buy. There is a market where these services can be obtained. The best suited candidates would be the public accountancy or specialized firms. There has always been some kind of animosity between internal audit practitioners and external parties providing internal audit services. This should come as no surprise, since out- or in-sourcing will impact the job market for internal auditors and the services of internal audit from an expert perspective might be rendered by an outside provider. On the other hand, internal auditors can make their career within the professional auditing firms as well.

The Research Foundation of the IIA ordered a study (1997a) on the outsourcing issue.

Although the study was quite lengthy – almost 150 pages – the lack of substantiating data was staggering. The study concluded: "There is not a large enough database available to reach any final conclusions about total outsourcing, but it is safe to say that there have been many successful partial and full outsourcing arrangements." From a scientific perspective that is a disappointing conclusion.

The IIA Inc. Standards (2001d) do not deal in any shape or form with the make or buy issue.

In 1998 it published "A perspective on Outsourcing of the Internal Auditing Function", which, since it never achieved the status of a "standard", was deemed a professional practice pamphlet. According to this pamphlet, it is best to keep IA in house. What else might one expect from the IIA Inc?

A study of Widener and Selto (1999), using a Transaction Cost Economics perspective, is useful for studying the outsourcing issue. There are two main conclusions to be learned from it. One, the higher the Asset Specificity the less outsourcing will be used. This is consistent with the findings of Williamson (1996): Asset Specificity is the most determining factor in the question of make or buy. Two, the more often internal audit is used, the more often the function is positioned internally. For a more detailed discussion we refer to Chapter 4.

The issue is whether buying internal audit services would be valued by outsiders due to a perceived increase of "independence" of the outside provider compared with an internal provider. An interesting experiment was done by Lowe, Geiger and Pany (1999). One hundred and seventy-seven loan officers were supplied with a realistic loan application for a medium-sized retail grocery company and asked to evaluate auditor independence, assess the reliability of financial statements and decide whether they should, or should not, grant the loan. The participants were given the same information, except for the description of IA, which varied as follows:

1. Not outsourced, done in-house.

2. Outsourced to an external auditor other than the one that performed the company's external audits.

3. Outsourced to their own external auditor, which performed management functions.

4. Outsourced to their own external auditor; same personnel used for the internal and external audits.

5. Outsourced to their own external auditor; different personnel used for the internal and external audits.

When number 3 came to the fore independence and reliability ratings dropped, and loan officers were least likely to grant loans. By contrast, with number 5 - same external audit company, different personnel - independence and reliability ratings were significantly higher and loan approvals were the highest. These results were consistent with the AICPA's position of allowing external auditors to perform outsourced internal audit activities for clients as long as they did not perform management functions in connection with the internal audit.

However, the results also show that perceived auditor independence and financial statement reliability could be enhanced by requiring CPA firms that perform internal audit services for clients to use different personnel for each type of engagement. The study was done from the perspective of the external auditor providing internal audit services, and not at the perceived differences in independence between internal and external auditors providing the same services per se. The data, however, does provide support that there is no real gain in the perceived level of independence either by in- or outsourcing IA. Further, the current status of corporate governance affairs, as described in Chapter 4, prohibits certain outsourcing to the current external auditor, even if they do they use different personnel for each type of engagement.

In the financial services industry (full) outsourcing is prohibited if it is economically viable to afford one. Recently, the Sarbanes-Oxley Act law and the subsequent guidelines from the SEC and the Public Company Accounting Oversight Board (PCAOB) prohibit certain internal audit services to be delivered by the external auditor signing off on the annual report. Besides that, there are no Corporate Governance regulations and recommendations that provide clear guidelines regarding the make or buy issue. Professional bodies like IIA Inc and AICPA only provide guidelines about how to cooperate. We will come back to that later in this chapter.

While the outsourcing issue has sparked much concern and discussion among internal auditors themselves, there doesn't seem to be any evidence indicating that it is happening on a large-scale. True, there are cases of it here and there. But this seems to be limited and more an example of co-sourcing, whereby the external provider is compensating for a shortage in staff or skills on the part of the in-house IA. For the moment at least, I conclude that it is "Much ado about nothing". Competition in itself is prima facie healthy, not just from the perspective of management, but also from the profession, because stretches professionals to the limits of their competence. In addition to the data already provided here and in Chapter 4, the survey (see Chapter 6) will provide some more data to back this up.

Concluding this section, one might say that despite the fact that there are no laws making IA mandatory (with the exceptions for the financial services industry), developments show an increasing interest. Surely, management must have an intrinsic motive to have IA. Much of the why of that will be discussed in Chapter 4. But perhaps there are less obvious reasons that also might explain this need. In the Chapter 5 case studies and Chapter 6 survey some answers will become apparent.