For community banks, a strong internal audit program is a critical tool for ensuring regulatory compliance, managing risk, maintaining operational efficiency, and inspiring confidence in their financial and reporting practices. It also can help prevent and detect fraud. According to the Association of Certified Fraud Examiners’ most recent report on occupational fraud, though tips are by far the most common way frauds are exposed, internal audits are the second most common method. The report found that internal audits are associated with significant reductions in the magnitude and duration of frauds.
Internal audits aren’t the same as external audits, which focus on ensuring that financial statements are free from material misstatement and comply with Generally Accepted Accounting Principles or other relevant frameworks. Both types of audits are essential for a bank’s financial health, providing a robust framework for accountability and transparency. However, internal audits involve different procedures, are usually broader in scope, and can be tailored to fit your bank’s risk-management, operational and governance needs.
One question many banks face is whether to conduct internal audits in-house or to outsource the internal audit function. The answer to that question depends on your bank’s circumstances. Let’s look at some factors to consider.
Pros of outsourcing
Outsourcing internal audits offers several important advantages over conducting them in-house, including:
Improved independence and objectivity. Outsourced internal auditors are usually independent, objective and less susceptible to influence from bank management, providing a fresh look at the bank’s operations and internal controls. Outsourcing also makes it easier to rotate internal auditors, which can be a challenge with an in-house internal auditing department.
Access to expertise. Outsourced internal auditors possess specialized expertise and skills that would be challenging or cost-prohibitive to maintain in-house. This is particularly true for banks in smaller communities as well as those that plan to offer new products and services or expand into new markets.
Access to technology. Outsourced internal auditors often have access to sophisticated technology tools that would be impractical for a bank to purchase in-house.
Reduced costs. By allowing banks to avoid overhead and fixed labor costs associated with an in-house staff, outsourcing can reduce costs. It also gives banks the flexibility to quickly scale their internal audit programs up or down as their needs change or special projects arise.
If your bank’s management concludes that the pros of outsourcing the internal audit function outweigh the cons, it’s critical to handle outsourcing relationships with care.
Cons of outsourcing
Perhaps the biggest disadvantage of outsourcing is that outsourced internal auditors may initially lack an in-house auditor’s deep and broad familiarity with the bank’s operations. This creates a learning curve that may counteract the cost-effectiveness of an outsourced audit. One option is to outsource the internal audit function to the bank’s external auditor. But be sure to weigh the potential impact of such an arrangement on the external auditor’s independence when considering this approach.
Outsourcing arrangements may result in conflicts of interest, mistakes or misaligned goals if not carefully managed. For instance, outsourced internal auditors might recommend additional auditing activities to increase their fees, or their perceived goals might not be aligned with the bank’s goals for the internal audit function. To avoid these issues, it’s important to
1) prepare a comprehensive engagement letter or contract that spells out the audit’s scope and the parties’ expectations regarding the auditing firm’s activities and advice,
2) promote open and ongoing communication, and
3) monitor the auditor’s activities closely.
Co-sourcing: The best of both worlds?
Co-sourcing — that is, splitting internal audit activities between in-house and outsourced auditors — may offer the best of both worlds. For example, it allows a short-staffed bank to maintain the advantages of in-house auditors while gaining access to the additional human resources.
And co-sourcing can be a good way to conduct special-purpose audits, such as anti-money laundering/countering the financing of terrorism (AML/CFT) audits or IT audits. These require specialized skills that the in-house auditing team might not possess.
The buck stops here
Outsourcing the internal audit doesn’t absolve your bank’s management or board from responsibility for it. Among other things, understand and follow the federal agencies’ guidance on managing third-party risks, including the Federal Deposit Insurance Corporation’s “Interagency Policy Statement on the Internal Audit Function and Its Outsourcing.” Failure to properly manage these risks can hurt your bank’s reputation, and weaknesses in the internal audit process may lead regulators to conclude that your bank isn’t operating in a safe and sound manner.
Sidebar: Review outsourcing agreements carefully
When managing relationships with outsourced vendors and other third parties, scrutinize the contract or engagement letter. Under banking agency guidance, an agreement should, among other things:
- Define the parties’ expectations and responsibilities,
- Establish the fees and scope of the work,
- Set responsibilities for providing and receiving reports and other information,
- Outline the process for changing the agreement’s terms or terminating it,
- Provide that internal audit reports are the bank’s property,
- Specify how long the vendor must retain workpapers,
- Acknowledge that vendor-provided internal audit services are subject to regulatory review and provide that examiners will be granted full, timely access to reports and workpapers,
- Prescribe a process for resolving disputes and allocating the cost of damages arising from errors, omissions or negligence, and
- State that the vendor will comply with any applicable regulations or professional standards.
© 2024
