Co-sourcing means you keep a function and buy outside help for part of it. The clearest definition, the one in the internal audit standards, measures a quantity, how much of the function you contracted out, and that says nothing about who is running the work. Three different buyers are sold that arrangement, under three different rulebooks, and a proposal can use the word while meaning any of them. What resolves it is not the share of hours and not the label on the invoice. It is two questions, who holds the function and who directs the work.
What Co-Sourcing Means
Co-sourcing is a division of labor inside a function you still hold. You keep the function, its plan and its accountability, and an outside provider does part of the work inside that structure.
The internal audit standards do define it. The glossary of the Global Internal Audit Standards defines outsourcing as contracting with an independent external provider of internal audit services, then splits the term: fully outsourcing a function refers to contracting the entire internal audit function, while partially outsourcing, also called cosourcing, indicates that only a portion of the services are outsourced.
Read what that definition measures. It is a share, not a structure. A provider doing a small slice of the work and a provider doing most of it are both co-sourcing under that wording, and so is a provider who effectively runs the function while you keep a title. The word tells you the size of the portion. It does not tell you who is running it.
Nor does it turn up where you might expect. The word appears nowhere in the Securities and Exchange Commission's auditor independence rule and nowhere in the AICPA Code of Professional Conduct, both of which govern these arrangements under other language.
What Is the Difference Between Co-Sourcing and Outsourcing?
Outsourcing moves a function out of the organization. Co-sourcing leaves it where it is and buys labor or expertise into it. In the standards' own terms the two sit on one scale rather than in separate boxes, which is why they blur so easily in a sales conversation.
The blur matters because the obligations attached to an arrangement do not follow the word. They follow the facts: who is accountable for the result, who directs the work, where the people sit, and what the governing rules say about each. Judging a provider works the same way, which is why comparing audit outsourcing companies starts from what kind of provider you are looking at rather than from what the category calls itself.
The Three Buyers Behind the Same Word
Three buyers shop for that division of labor. Each has its own rulebook and its own idea of what "part of it" covers.
Internal Audit Co-Sourcing
The buyer is an audit committee, or the chief audit executive, the person accountable for the internal audit function inside a company that already runs one. The provider supplies specialists or testing capacity for parts of the plan. This version has the most rules attached to it, because the identity of the provider can affect your external auditor's independence, and one candidate is restricted more tightly than the rest. Internal audit co-sourcing sets out which candidate that is, what the audit committee has to approve first, and what stays with the organization whoever does the testing.
Finance Co-Sourcing Inside a Company
Here the buyer is a company's own finance department, most visibly in private capital fund administration, where an outside administrator keeps the books and calculates values for a fund. Administrators in that market describe an arrangement where they work inside the client's accounting system rather than their own, so the records stay in the client's environment and the client's team can read them without asking. That description is what gives the word its weight there. If you run a CPA firm, this is not your market: the buyer is a finance team carrying its own books, not a practice carrying other people's.
A CPA Firm Buying Preparer Capacity
The buyer is a partner or firm owner who needs returns and workpapers prepared under the firm's review, without hiring. The same shape describes that purchase: the firm keeps the engagement, the review chain and the signature, and buys hands for the preparation. The mechanics of that arrangement, including who directs, who reviews and who signs, sit in accounting staff augmentation.
The Test That Resolves It: Who Holds the Function, Who Directs the Work
Two questions settle which of the three you are being sold, and they do it faster than any provider's diagram.
Who holds the function. Whose name is on the result, who answers for it to the board, the client or the regulator, and who carries the consequence when it is wrong. That answer moves in a contract, never in a brochure.
Who directs the work. Who sets the plan, assigns the tasks, defines the standard, reviews the output and decides what happens next. This one moves quietly, one delegation at a time, and it is usually the answer that has already drifted by the time somebody asks.
Two questions, two answers each. That makes four arrangements to tell apart, not two.
- You hold it, you direct it. The provider supplies capacity or a named skill inside your process. The standards' wording covers this arrangement and the next one alike. Only here do accountability and control both sit with you, which is what makes it the version a firm can defend.
- You hold it, the provider directs the work. Managed delivery. Real, common and often sensible, but accountability sits with you while daily control does not, so the review you keep is the only thing standing in front of the result.
- The provider holds it and directs it. Outsourcing, whatever the proposal calls it. Everything the rules say about handing a function over now applies.
- The provider holds it, you direct the work. Treat this as a warning rather than a model. Somebody has been sold accountability they cannot exercise, and under pressure it tends to resolve in the wrong direction.
Notice what is absent from all four: the share of hours. A provider doing most of the testing under your plan and your review sits further from outsourcing than a provider who does a thin slice of it and owns the plan.
What the Word Obliges a Provider to Do
On its own, nothing. Co-sourcing is not a defined service, a scope, a service level or a standard of care. It describes a shape, and a shape carries no duties.
That is not a new complaint. Setting out procurement guidance for public entities in 2001, New Zealand's Office of the Auditor-General grouped contracting out, co-sourcing and outsourcing together as terms for one situation, an entity arranging for someone else to do work it would otherwise do itself, and noted in a footnote that "the term co-sourcing is a marketing term used by outsourcing companies." The guidance then used a single word, outsourcing, for all of it.
So read the word as a heading and look at what sits under it. Three things it never changes by itself:
- It does not change who signs. The signature and the final judgment stay where the engagement puts them, and no provider's operating model moves them.
- It does not change the disclosure rules when work crosses a border. Whether the person belongs to your firm or a provider's, and which country they sit in, are separate questions with separate consequences. Outsourcing vs offshoring works through the four combinations and the consent that the border triggers.
- It does not change an independence analysis. If the provider also performs your audit, review or other attest work, the analysis runs on what the firm actually does, not on what the arrangement is called, and the internal audit rules are where that gets decided.
Reading Co-Sourcing in a Live Proposal
Four questions turn that test into something a proposal has to answer. Ask them in this order, because the first answer changes what the rest mean.
Who is accountable for the result, in writing? Not who is responsible for their own work, which every provider will say. Who answers for the function's output. If nobody can point at a clause, the word is doing the job a clause should be doing.
Who approves the plan and the priorities? Plan ownership is where control actually sits. A provider that writes the plan and hands it to you for signature has taken more than the page suggests.
Who reviews the output, and against whose standard? A provider's internal review is not your review. Ask what reaches you, in what state, and what your own people are expected to do with it before it goes anywhere.
What does the exit look like? Notice periods, handover, and what happens to files, workpapers and system access. A model genuinely built around a function you hold will have an answer ready, because the function has to keep running after the provider leaves.
Read the four answers together. If they all point back at you, you are buying capacity. If one points at the provider, that is the clause to negotiate before you discuss anything else. If two or more do, you are buying a managed service, which is a perfectly good thing to buy as long as you know that is what you bought.
Name the Piece You Actually Want to Buy
Co-sourcing describes a division of labor, not a product. The useful preparation is to answer the two questions yourself before a provider answers them for you: name the function, name who holds it, name who directs the work, and name the piece you actually want to buy. Hand that to a provider and its answer will tell you which of the four arrangements you are actually being offered.
Then test it on real work rather than on the model. Accountably is offshore accounting and tax staffing for US CPA, EA and accounting firms. We place trained accountants and tax preparers inside the firm, on your software and your SOPs, in about 3 to 4 weeks, with the engagement, the review chain and the signature staying with the firm. Since 2022 that has meant 20+ US firms and 30+ placements.
If capacity is the constraint, don't trust us, test us. We run a Free 40-Hour Proof Pilot: a fixed block of your own representative work, prepared on your software and your SOPs and put through full multi-layer review, so your reviewer grades real output before a client file is at stake. If someone is not the right fit in the first 30 days, our 30-Day Fit Guarantee replaces them free.