Choice, not chance

How to select the right Internal Audit model for your organization

Internal Audit (IA) should be a central component to an organization’s overall business model. Internal audit not only provides assurance to senior leadership that their organization’s governance, internal control processes and risk management practices are operating effectively, but can also be leveraged to seek efficiencies within the business (i.e. a proactive management tool).

Now we are not here to discuss the role of IA or what its mandate should be, but rather we’re discussing the various structural operating models available for organizations to utilize. Let’s look at the three models used most by organizations:

  • In-house:the IA group consists entirely of employees within the organization; this includes ownership of all methodologies, technology, and knowledge.
  • Co-sourced:the IA group consists of a combination of an organization’s employees and personnel (as-needed) from a third party provider; this may also include access to other benefits such as the third party’s methodologies, technology, and knowledge.
  • Out-sourced:the IA group consists only of personnel from a third party provider, including access to all methodologies, technology, and knowledge.

So how is an organization supposed to choose? Having worked with a wide array of gaming organizations globally, we know that there are a number of qualitative and quantitative factors which need to be considered, and there is definitely no one-size-fits all solution. Regardless of the size, whether a multinational operating in multiple jurisdictions or a single-product gaming entity supplying only one region, organizations should evaluate each to decide which model is best for their needs.

Quantitative advantages or disadvantages are usually the easiest to comprehend. Any CFO should be able to list out the specific cost impact of each option. Qualitative factors are often tougher to assess. Qualitative factors can include, among others: the number of geographic locations; level of M&A activity; complexity of business processes and the supporting IT systems; and the magnitude of regulatory oversight (which is obviously high within the gaming industry).

To summarize each model and determine which type is best for implementing within your organization, we’ve created a quick snapshot of characteristics of each for you to consider:

Characteristics In-house Co-sourced Out-sourced
Institutional knowledge retained High High Low
Ability to leverage existing internal relationships High Medium Low
Flexibility of staffing model Low Medium High
Cost efficiency (e.g. creation of variable cost centre) N/A Medium High
Access to subject matter experts Low High High
Knowledge transfer to existing staff High High Low
Access to emerging best practices and knowledge Low Medium High

One thing to keep in mind is that an internal audit model needs to fit the organization, rather than the other way around. An IA model should be regularly assessed as your organization grows, matures, and/or changes. Too often organizations become ‘comfortable’ with how things have always been done and we find this can often lead to an ineffective IA function. We suggest that our clients consider adding the topic to their Board of Directors or Audit Committee meetings annually, in order to assess the effectiveness of their current approach.

Now we know that choosing the right internal audit model may not be as easy as purchasing a lottery ticket, but the odds that it pays out are likely much higher.

About Richter : Founded in Montreal in 1926, Richter is a licensed public accounting firm that provides assurance, tax and wealth management services, as well as financial advisory services in the areas of organizational restructuring and insolvency, business valuation, corporate finance, litigation support, and forensic accounting. Our commitment to excellence, our in-depth understanding of financial issues and our practical problem-solving methods have positioned us as one of the most important independent accounting, organizational advisory and consulting firms in the country. Richter has offices in both Toronto and Montreal. Follow us on LinkedInFacebook, and Twitter.