Co-sourced and outsourced internal audit for mid-sized companies

The Global Internal Audit Standards apply to all three models. They say so directly: the function can employ its internal auditors, contract them through an external service provider, or do both. Which one fits depends on how much audit work the plan holds and whether anyone on your payroll can lead it.

The Standards add that when resources fall short, a chief audit executive can contract with an external provider for specialized skills, special projects or whole engagements. They also say an adequate budget should be approved by the board whether the function is insourced or outsourced. Hiring in-house later is a normal next step: the charter, plan and workpapers transfer to the new head of internal audit.

No fieldwork starts before the charter exists. Standard 6.2 has the chief audit executive develop and maintain a charter that states, at a minimum, the function's purpose, its commitment to follow the Standards, its mandate (scope and types of service) and its position and reporting relationships. The chief audit executive must discuss the proposed charter with the board and senior management. Standard 7.1 then has the chief audit executive confirm the function's organizational independence to the board at least once a year.

For a co-sourced function the charter also records the split. It names the engagements Finbryn supports, the audits your staff keep, who supervises each and where the workpapers live. The audit committee approves the engagement letter, because the function reports to it. A letter signed only by the CFO makes internal audit look like part of finance, which is the wrong signal to an auditor, a lender or a board member who reads it.

The reporting line has two halves. The Standards describe functional reporting to the board, which keeps the function free of interference, and an administrative line that is often to a member of management and, as leading practice, to the chief executive. Write both into the charter: the committee for plan, results, resourcing and independence, and a named executive for invoices, access and logistics.

Independence is where a co-sourced model is most likely to go wrong. Standard 2.2 tells internal auditors to refrain from assessing activities they were previously responsible for. For a provider that also keeps books or runs payables, the consequence is concrete. Finbryn's independence policy: we do not perform internal audit work on a process we run for you, or ran for you in the previous 12 months. The engagement letter lists the processes we operate and the ones we review, and the audit committee confirms that list each year. The policy follows Standard 2.2 of the Global Internal Audit Standards, which presumes objectivity is impaired when an internal auditor provides assurance on an activity they were responsible for within the previous 12 months.

Two outside rules point the same way. The NYSE lets a listed company outsource its internal audit function to a third-party provider other than its independent auditor. The SEC's independence rules for audit firms generally bar internal audit outsourcing tied to a client's internal accounting controls, and any management function (17 CFR 210.2-01(c)(4)). A private company is bound by neither, but its external auditor will ask the same question, and the answer should be on paper before the audit starts.

If the person leading the function takes a temporary non-audit role, such as acting controller during a vacancy, Standard 7.1 requires independent third-party assurance over that area for the length of the assignment and the following 12 months.

A private company has no listing rule to meet, so the trigger is usually a contract or a plan. NYSE Section 303A.07(c) requires each listed company, subject to the exemptions in Section 303A.00, to maintain an internal audit function, in place by the first anniversary of its listing date. On July 31, 2026 the NYSE filed rule change SR-NYSE-2026-37 to extend that window to five years. The SEC published it for comment on August 18, 2026 and on September 25, 2026 extended its deadline to act to November 16, 2026 (Release No. 34-106502). Until the SEC approves it, the one-year window applies. The NYSE's filing says issuers have told it that building a capable internal audit function in the first year of listing is hard, which is a reason for a company planning a listing to start earlier whichever window applies.

Outside a listing, read the credit agreement and the grant terms first, and the investor reporting package after that. If one of them calls for an internal audit function or internal audit reports, its wording sets the scope. If none does, the case rests on risk. In the ACFE's 2024 study of 1,921 fraud cases, organizations with an internal audit department had a median loss of $120,000 against $210,000 for those without one, a difference of 43%. The ACFE adds that a control being present does not mean fraud cannot occur, so read the figure as a reason to test, not a promise of protection.

Standard 8.4 requires an external quality assessment of the internal audit function at least once every five years, performed by a qualified, independent assessor or assessment team. A self-assessment with independent validation also meets the requirement, and when selecting the assessor, the chief audit executive must make sure at least one person on the assessment team holds an active Certified Internal Auditor designation. The chief audit executive develops the plan for the assessment and discusses it with the board.

A provider cannot assess its own work, so the assessor is always a third party. Finbryn puts the quality assessment in the charter at the start and records its timing on the audit committee calendar. A new function gives the committee little to compare against, so the plan also sets out what the committee should expect to see in each report and how often.

Internal audit support here is planned and reported against the IIA Global Internal Audit Standards for management and the audit committee. Conformance is the chief audit executive's to demonstrate through the function's quality program. It is not an external audit, review, compilation or attestation, and Finbryn gives no opinion on financial statements or on internal control over financial reporting under AICPA or PCAOB standards.

The board keeps the duty to oversee the function. It approves the charter, the plan and the budget, it names or approves the chief audit executive, and it decides what to do with a finding. Finbryn does not manage the company's risks, does not take on management responsibilities and does not report to the CFO alone. If the committee wants an opinion on the financial statements, an independent public accounting firm provides it. If a finding looks like fraud, Finbryn stops testing that area and recommends a specialist, with forensic accounting support as the starting point.