A third-party provider can help XYZ close the gaps in as little as 12 months — 6 months ahead of the target Hans set for Melanie.
Summary: Four Ernst & Young Internal Audit professionals discuss the challenges and opportunities XYZ Technology Group faces and whether cosourcing is the right option for the company.
Perspective: Steve Singer, Global Internal Audit Leader
If I were XYZ’s CAE, I would start by capturing all of the stakeholders’ expectations in one place. I would also recommend that Internal Audit develop a Value Charter to identify key performance indicators and document goals that Internal Audit can work toward in helping the business meet its operating objectives.
Melanie needs to make each of the business operations leaders a partner in helping the company achieve its objectives. To start, she needs to pick a supportive business unit or two that will work with her to define the parameters for success, and then prove that there is an opportunity to improve the business through better risk management.
The other major opportunity Internal Audit has is to help the business perform better, smarter and faster. This includes seeking areas where Internal Audit could be more nimble and more efficient in terms of how it interacts with the business, as well as bringing actionable ideas for improvement to the business unit leaders.
Is cosourcing an option?
Cosourcing brings in a highly skilled third party to work with internal resources. This kind of arrangement can definitely work for XYZ, under the following conditions:
- Define the metrics from the beginning. In part, this means having the CFO specifically define the deliverables he expects will be achieved within his 18-month timeline.
- Tone from the top support. Malcolm needs to communicate the mandate and encourage the business units to support it.
- Open communication between the CAE and the Audit Committee. This includes robust discussion around not only issue tracking, but also issue trending in the Internal Audit reports Melanie sends to the Audit Committee, which can identify systemic issues within business units.
Perspective: Marshall Franklin, Internal Audit Leader, Europe, Middle East, India and Africa
One of the biggest challenges I see with XYZ Technology Group is the organization’s expanding risk profile.
A company operating in a fairly stable industry without a lot of change tends to know its risks and how to respond to them. But a company that’s in acquisition mode, especially in a fast-changing sector like technology, is generally going to have a considerable number of new risks every year that will need to be addressed.
XYZ has the added challenge of diverse international cultures, a challenge that didn’t really exist prior to the AttaBee acquisition. Melanie needs to understand the risk profile of both organizations in their newly merged state.
Is cosourcing an option?
XYZ has a real opportunity to keep in-house Internal Audit staff who have the right skill sets and then add specialized third-party resources who can address the various risks, as well as local resources who have the appropriate language and culture skills. The Internal Audit budget can remain the same, but the money will be used differently.
Under the old Internal Audit model, it would take at least three years for XYZ to migrate, train, teach and coach its in-house resources to adequately address the company’s new risk profile. XYZ can’t afford to wait that long. It needs appropriate risk coverage now.
A third-party provider can help XYZ develop a transformation plan that can close the gaps in as little as 12 months — 6 months ahead of the target Hans set for Melanie.
Perspective: Eric Chia, Greater China Risk Leader
The biggest challenge I see for XYZ is going to come from the cost side. The CFO, Hans, is looking to cut costs within the Internal Audit function to compensate for some of the unexpected expenses associated with the AttaBee acquisition.
Is cosourcing an option?
Involving a third party could initially appear to be more costly than recruiting resources internally, depending on skills, staffing levels and geographic locations. I think it’s more important to look beyond the cost itself and more toward the value and the efficiencies a third party can help Internal Audit deliver.
To determine the right cosourcing mix, XYZ will have to assess:
- What its current Internal Audit resources do
- What kind of additional risk coverage it needs following the acquisition
- What its needs are within each jurisdiction
- What key XYZ stakeholders expect of Internal Audit relative to driving tangible business value
From there, Melanie and the CFO can determine the right level of support needed from a third-party provider.
Perspective: Jacqueline Wagner, Former Fortune 100 CAE; Internal Audit consultant to Ernst & Young
Melanie needs to have auditors with up-to-the-minute skills in specific risk areas to address XYZ’s rapidly changing risk profile. Attracting the right people; keeping them current on the latest technology, methodology and knowledge; and maintaining their career satisfaction are some of the most powerful incentives a for cosourcing.
There are also the language and culture issues. XYZ has remote locations. It needs to have local resources who understand the language and the culture, but who can also be seen as being part of Internal Audit’s community.
Is cosourcing an option?
For cosourcing to be a success at XYZ, Melanie needs buy-in from Hans. She needs to present him with a business case that shows him how he can:
- Save money
- Retain the right people within Internal Audit based on XYZ’s evolving risk profile
- Demonstrate increased independence — as well as greater control — of the Internal Audit function
Without cosourcing, Melanie will not have the resources she needs to cover XYZ’s new and emerging risks, let alone transform Internal Audit into a strategic business advisor to the company.
