Internal audit co-sourcing is a model where your internal audit function keeps ownership of the audit plan, the direction, and the conclusions, while an outside provider supplies extra people and specialist skills to do the work alongside your team. It sits between running the function entirely in-house and handing the whole thing to an outside firm. You stay in charge; you rent capability and keep control.
That distinction is the whole decision. A busy season, a cyber-risk audit, a new location, or a wave of resignations can all leave a function short of hours or short of a skill it does not employ full time. Co-sourcing fills that gap without you giving up the plan or the accountability that comes with it. The catch is that not everything can be handed off, and two limits decide which partner is safe to bring in.
Key takeaways
- Internal audit co-sourcing supplements an in-house function with outside people and skills; the function keeps the plan, the conclusions, and the accountability.
- Co-sourcing differs from outsourcing, where an external firm runs the whole function; and from in-house, where you carry every skill yourself.
- Functions co-source for four reasons: capacity, specialist skills they do not employ full time, agility when risks shift, and budget flexibility.
- Common co-sourced work includes SOX control testing, IT and cybersecurity audits, data analytics, specialized technical audits, remote-location coverage, and peak-season fieldwork.
- Two things co-sourcing never moves: your ownership and accountability for the function, and, for a public company, the independence rule that bars your external auditor from doing it.
- Choose a partner on skills, integration, security, and a test on your own work before a live engagement.
What is internal audit co-sourcing?
Internal audit co-sourcing pairs your in-house team with an external provider who works inside your structure, on your plan, under your direction. The provider adds people and skills; your function keeps the audit plan, the judgment, and the conclusions. Industry practice describes it as the middle option between two extremes: doing everything with your own staff, and outsourcing the entire function to a firm that runs it for you.
The three models are easiest to separate by one question: who owns the plan and the conclusions?
| Model | Who owns the plan and conclusions | The external provider's role | Best fit |
|---|---|---|---|
| In-house internal audit | Your function, fully | None | Steady, predictable work you can staff and skill in-house all year |
| Co-sourced internal audit | Your function keeps ownership | Supplies people and specialist skills, works on your plan under your direction | Capacity gaps, specialist risks, and workloads that spike and subside |
| Fully outsourced internal audit | The outside firm runs the function; you set scope and receive reporting | Executes the function | Small organizations with no internal team, or a deliberate hand-off |
The middle model works because it matches how audit work actually behaves. Risk is not evenly spread across the year, and no function can employ every specialist it occasionally needs. Co-sourcing lets you keep a lean core team and reach for depth when a specific engagement calls for it.
Why do internal audit functions co-source?
Internal audit functions co-source when the work outgrows the team, either in hours or in skills. The pull comes from four recurring drivers, and most co-sourcing decisions are some mix of them rather than a single cause.
The capacity driver is not a one-off. Accountants and auditors are hard to hire and slow to replace: the median annual wage for accountants and auditors was $81,680 in May 2024, and the U.S. Bureau of Labor Statistics projects about 124,200 openings a year over the decade against 5 percent employment growth from 2024 to 2034. A skilled auditor is expensive and scarce, so covering a seasonal spike or a niche skill with a permanent hire is often the wrong tool. Co-sourcing turns a fixed cost into one you can size to the work.
What internal audit work gets co-sourced?
The work that gets co-sourced is usually the specialized or the seasonal: the audits that demand a skill you do not keep on staff, or the volume that arrives all at once. Routine, recurring reviews that your team knows well tend to stay in-house, because there is no gap to fill.
A good scoping conversation names the deliverable. You are buying testing, documentation, or a specialist opinion on a defined piece of work, with your reviewers checking the output. The provider fills a role you defined, and you keep the risk assessment and the conclusions that make it an audit.
Who stays responsible when you co-source internal audit?
Co-sourcing moves the work; it does not move the responsibility. Two limits decide that, and most of the advisory-firm guides that sell co-sourcing skip both. Read them together and the shortlist gets shorter and clearer.
Does co-sourcing move accountability to the provider?
No. Professional guidance from the Institute of Internal Auditors is explicit that the organization keeps ownership and accountability for its internal audit function even when it brings in an external provider, and that the chief audit executive supervises engagements whether the work is done by in-house staff or an outside team. That is the difference between renting hands and giving up the function. The provider can prepare, test, and document; your function directs the work, reviews the evidence, and stands behind the conclusions.
Can your external auditor do your internal audit?
For a public company, no. Under the Securities and Exchange Commission's auditor-independence rules that carried out the Sarbanes-Oxley Act, "internal audit outsourcing services" are a prohibited non-audit service for an audit client whose results would feed the financial-statement audit (17 CFR 210.2-01(c)(4)). The logic is simple: a firm should not audit its own work. The same independence principle guides other attest relationships, so a practical rule holds across the board. Co-source your internal audit with a partner that is not the firm signing your external audit.
How to choose an internal audit co-sourcing partner
Choose a co-sourcing partner on the axes that protect your function, not on how much work it promises to take off your plate. Five checks separate a partner you can defend from one you will spend the year managing. Run them on anyone you shortlist.
The fifth check is where the decision is actually made. A capable-sounding provider and a capable provider look identical on a call, and the only way to tell them apart is to watch one do a small block of your real work and grade it. That is why the strongest thing you can ask a partner for is not a reference. It is a trial on your own files.
If you run a US CPA or accounting firm, co-sourcing works the same way one level down, at the staffing layer. Accountably places trained offshore accountants and audit-support staff inside US CPA, EA, and accounting firms, working in your own systems and your own review chain rather than a black box. Built by a CPA, every file moves through multi-layer review before it reaches you, and the judgment and the sign-off stay with your firm. Controls are SOC 2-aligned, with zero local storage of client files. Since 2022 we have made 30+ placements across 20+ US firms.
The proof step is the point. Before any live, signature-bearing work moves offshore, run a Free 40-Hour Proof Pilot: a fixed 40-hour block of your own representative work, prepared in your systems and put through full multi-layer review, so your reviewer grades real output before a single client file is committed.
If a placement is not the right fit in the first 30 days, we replace them free under our 30-Day Fit Guarantee. Don't trust us. Test us. Run a Free 40-Hour Proof Pilot on your own work and let your reviewer grade the result.
Frequently asked questions
What is the difference between co-sourcing and outsourcing internal audit?
Co-sourcing keeps your internal audit function in place and adds an external provider who works on your plan, under your direction, while you keep the conclusions. Outsourcing hands the whole function to an outside firm that runs it and reports back to you. The line between them is who owns the plan and the judgment: co-sourcing keeps that inside your organization, outsourcing moves it to the provider.
Is co-sourcing internal audit a good idea?
Co-sourcing is a good fit when your plan needs more hours than your team has, or a skill you do not employ full time, and you want to keep control of the function. It is a weaker fit when the work is steady, routine, and something your own staff already handle well, because there is no gap to fill. The test is whether you are buying capacity or capability you genuinely lack while the judgment you should keep stays with your function.
What does SOX co-sourcing cover?
SOX co-sourcing usually brings outside testers into your controls work during compliance season: walkthroughs, control testing, and the documentation that supports them, on the schedule your plan sets. Your function still decides which controls are in scope, how risk is rated, and what the results mean. It is a common place to co-source because the volume is seasonal and the testing is well defined, so extra hands scale cleanly without reaching the judgment that stays in-house.
How long does it take to onboard a co-sourcing partner?
Most of the onboarding work is access and alignment: giving the provider your audit methodology, your systems, and your review workflow, then agreeing how each piece of work is scoped, reviewed, and signed off. Because you keep the plan and the conclusions, the partner ramps into your process rather than standing up a new one. The clearer your templates, documentation, and review chain, the shorter the ramp, so the functions that onboard fastest are usually the ones whose own process is already well documented.
How much does internal audit co-sourcing cost?
Pricing usually follows one of three shapes: a rate per specialist for defined project work, a monthly rate for a dedicated full-time person, or a fixed fee for a scoped engagement. Which one fits depends on whether your need is a one-time specialist audit, seasonal capacity, or steady overflow. Compare the structure and the supervision it leaves you, because a cheaper rate that adds review time is not actually cheaper.
What internal audit work should stay in-house?
Keep the work that defines your function's judgment: the risk assessment, the audit plan, the review of evidence, and the conclusions. Recurring reviews your team knows well usually stay in-house too, since there is no capacity or skill gap to fill. Co-source the specialized and the seasonal, and keep the parts that make the work an audit rather than a task.