Internal audit functions co-source for sound reasons. Specialist depth in domains such as cybersecurity, IT general controls, AI, and complex regulatory areas is expensive to build and maintain internally. Audit calendars vary in intensity, and permanent staffing for peak load is inefficient. External providers bring methodologies, benchmarks, and specialist personnel that supplement internal capabilities effectively.

The arrangements that deliver lasting value share several design features. This article examines those features and the design choices that support effective co-sourcing relationships over time.

Defining the relationship's intended outcome

Effective co-sourcing arrangements begin with explicit alignment on what the arrangement is intended to achieve. The objectives differ across organizations and across audit areas. Some functions co-source primarily to access specialist depth that would not otherwise be available. Some seek flexibility in audit capacity. Some are addressing specific quality concerns in prior audit work. Some are positioning the function for an expansion of scope.

The intended outcome shapes many subsequent design choices, including the scope of the arrangement, the seniority of the personnel expected, the methodology expectations, and the reporting model. Functions that articulate the intended outcome explicitly tend to design arrangements that meet it. Functions that engage providers without this clarity often find that the arrangement does not align with what they actually needed.

Structuring the seniority of provider personnel

One of the most consequential design choices is the seniority and continuity of the personnel the provider commits to the engagement. Co-sourcing arrangements that specify only the volume of work and the deliverables expected give the provider considerable latitude in staffing. Arrangements that specify named senior personnel, minimum involvement levels, and substitution requirements produce more consistent outcomes.

Effective specification typically includes the named senior practitioner expected to lead the work, the minimum percentage of the engagement that named personnel will deliver, the procedures for client approval of substitutions, and the escalation path when staffing changes are proposed. These provisions are reasonable and most providers can accommodate them. They produce arrangements where the senior judgment that justifies the rate is actually delivered consistently.

Aligning methodology and quality standards

Co-sourced work typically integrates with the internal audit function's existing methodology, work paper standards, and reporting conventions. Arrangements that establish this alignment explicitly at the outset avoid friction throughout the engagement.

The alignment typically covers the audit standard the work will follow, the work paper format and review standards, the findings classification and rating scheme, the reporting format expected, and the integration with audit committee reporting cycles. Providers with experience across multiple internal audit functions can typically accommodate a range of standards. The work to align expectations is well spent.

Establishing quality oversight beyond deliverable acceptance

Most co-sourcing arrangements include quality oversight in the form of deliverable review. The deliverable is reviewed against engagement specifications and either accepted or sent back for revision. This form of oversight is necessary but limited. It catches deliverables that do not meet specifications, but it does not always surface subtler quality issues such as the depth of insight in findings, the level of business context in recommendations, or the accuracy of the audit team's understanding of the client's specific environment.

More effective oversight includes qualitative review beyond deliverable acceptance. This may include periodic structured review of work paper quality, reviewer assessment of the seniority and depth of the audit team, comparison of findings across audits to detect patterns suggesting systemic issues, and direct feedback channels with the audit committee or other senior stakeholders. Arrangements that include this dimension of oversight tend to maintain quality over multi-year periods more effectively than those that rely only on deliverable acceptance.

Maintaining institutional knowledge

The longer a co-sourcing relationship runs, the more institutional knowledge accumulates within the engagement. Provider personnel develop familiarity with the client's environment, control framework, prior findings, and operational context. This accumulated knowledge improves audit efficiency and depth substantially. It also creates concentration risk if it resides primarily in a small number of provider personnel who may rotate to other engagements.

Effective arrangements include explicit attention to institutional knowledge maintenance. This may include knowledge transfer requirements for personnel rotations, structured documentation of client-specific context that survives personnel changes, periodic refresh of the provider's understanding of client priorities and changes, and continuity provisions in the engagement letter. These provisions support sustained engagement effectiveness even as individual personnel change.

Periodic review of the arrangement itself

Co-sourcing arrangements benefit from periodic review at the arrangement level rather than only at the engagement level. The questions in this review include whether the original objectives of the arrangement are being met, whether the arrangement is still well matched to the function's current and projected needs, whether the provider continues to bring the depth and currency that justified the arrangement initially, and whether alternative arrangements would better serve the function.

This review is sometimes treated as a procurement exercise prompted by contract renewal. It is more usefully treated as a strategic review prompted by the function's evolving needs. The review may conclude that the existing arrangement remains the right choice. It may conclude that adjustments to scope, methodology, or staffing would strengthen the arrangement. It may conclude that the function's needs have changed in ways that warrant a different approach. In any case, the review supports informed decisions rather than continuation by inertia.

The relationship dimension

Beyond the contractual and structural design elements, co-sourcing arrangements depend on the working relationship between the function's leadership and the provider's senior personnel. Effective relationships are characterized by candor about the audit function's priorities and constraints, willingness on both sides to address concerns directly when they arise, and mutual investment in making the arrangement work over time.

These relationship qualities cannot be fully specified in contract terms. They are nonetheless among the most important determinants of whether an arrangement delivers value. Functions that select providers based primarily on commercial terms and methodology, without sufficient attention to the relationship dimension, sometimes find that the arrangement performs less well than expected despite meeting contractual requirements. Functions that invest in the relationship dimension tend to extract more value from co-sourcing arrangements over time.

The objective

The objective of effective co-sourcing design is straightforward. The arrangement should deliver the depth, flexibility, and quality that motivated the decision to co-source, sustained over the period the arrangement operates. Achieving this requires design choices that are explicit rather than implicit, oversight that goes beyond deliverable acceptance, and ongoing attention to whether the arrangement continues to serve the function's evolving needs. The investment in these design elements is modest relative to the value of arrangements that perform well over multi-year periods.