Outsourced internal audit, enterprise risk and governance support

Start with a charter and a reporting line, then a plan. Under the Global Internal Audit Standards (effective January 9, 2025), Standard 6.2 has the chief audit executive maintain a charter stating the function's purpose, mandate and reporting relationships, and Standard 9.4 bases the annual plan on a documented risk assessment that the board approves (checked 2026-10-16). Then pick in-house, co-sourced or outsourced staffing. Co-sourced and outsourced internal audit compares the three.

It drafts the charter with you, builds the annual risk assessment and audit plan, tests the processes on that plan with walkthroughs, samples and evidence, writes up findings and follows each one until management closes it. Under Standard 11.3, results go to the board and senior management periodically and for each engagement as appropriate (checked 2026-10-16). Finbryn does this for management and the audit committee and gives no opinion on your financial statements.

No. An external audit is performed by an independent public accounting firm and ends in an opinion on your financial statements. Internal audit is a function that works for management and the board and gives no such opinion. SOX 404(b) adds an auditor attestation on internal control, but only for accelerated and large accelerated filers other than emerging growth companies, which the JOBS Act of 2012 exempts, and the SEC's rule exempting non-accelerated filers took effect September 21, 2010. See internal audit vs external audit vs SOX.

To the board or its audit committee, with day-to-day logistics handled by management. The Global Internal Audit Standards (effective January 9, 2025) say the board retains responsibility for supporting and overseeing the function even when a provider supplies the auditors, so the audit committee approves the engagement and receives the provider's reports (checked 2026-10-16).

No listing rule applies to it. The New York Stock Exchange requires each listed company to maintain an internal audit function under Section 303A.07(c), in place by the first anniversary of listing, and lets it be outsourced to a provider other than the independent auditor (NYSE Listed Company Manual, checked 2026-10-16; filing SR-NYSE-2026-37 of July 31, 2026 would extend the window to five years and is pending at the SEC). A private company decides for itself, or because a lender, investor, grant-maker or industry regulator asks. Check your credit agreement and grant terms first.

No. This work is not an external audit, review, compilation or attestation, and Finbryn gives no opinion on financial statements or on internal control over financial reporting under AICPA or PCAOB standards. Findings are facts, criteria, causes and recommendations reported to management and the audit committee, as Standard 11.3 describes (Standards effective January 9, 2025). If a lender or regulator needs an opinion, an independent public accounting firm issues it.

No. Finbryn's independence policy: we do not perform internal audit work on a process we run for you, or ran for you in the previous 12 months. The engagement letter lists the processes we operate and the ones we review, and the audit committee confirms that list each year. The policy follows Standard 2.2 of the Global Internal Audit Standards, which presumes objectivity is impaired when an internal auditor provides assurance on an activity they were responsible for within the previous 12 months. If Finbryn keeps your books or runs your payables, someone else reviews those processes or they stay out of the plan (Standards effective January 9, 2025).

There is no list price. The fee depends on how many audits are in the approved plan, how large each process is and how much of the work your staff keep. The Standards expect the board to approve an adequate budget whether the function is insourced or outsourced (checked 2026-10-16). Finbryn confirms the fee in writing before fieldwork starts, and pricing explains how work is scoped.