Choice, not chance
How to select the right Internal Audit model for your organization
Internal Audit (IA) should be a central component to an organization’s overall business model. Internal audit not only provides assurance to senior leadership that their organization’s governance, internal control processes and risk management practices are operating effectively, but can also be leveraged to seek efficiencies within the business (i.e. a proactive management tool).
Now we are not here to discuss the role of IA or what its mandate should be, but rather we’re discussing the various structural operating models available for organizations to utilize. Let’s look at the three models used most by organizations:
- In-house:the IA group consists entirely of employees within the organization; this includes ownership of all methodologies, technology, and knowledge.
- Co-sourced:the IA group consists of a combination of an organization’s employees and personnel (as-needed) from a third party provider; this may also include access to other benefits such as the third party’s methodologies, technology, and knowledge.
- Out-sourced:the IA group consists only of personnel from a third party provider, including access to all methodologies, technology, and knowledge.
So how is an organization supposed to choose? Having worked with a wide array of gaming organizations globally, we know that there are a number of qualitative and quantitative factors which need to be considered, and there is definitely no one-size-fits all solution. Regardless of the size, whether a multinational operating in multiple jurisdictions or a single-product gaming entity supplying only one region, organizations should evaluate each to decide which model is best for their needs.
Quantitative advantages or disadvantages are usually the easiest to comprehend. Any CFO should be able to list out the specific cost impact of each option. Qualitative factors are often tougher to assess. Qualitative factors can include, among others: the number of geographic locations; level of M&A activity; complexity of business processes and the supporting IT systems; and the magnitude of regulatory oversight (which is obviously high within the gaming industry).
To summarize each model and determine which type is best for implementing within your organization, we’ve created a quick snapshot of characteristics of each for you to consider:
| Characteristics | In-house | Co-sourced | Out-sourced |
| Institutional knowledge retained | High | High | Low |
| Ability to leverage existing internal relationships | High | Medium | Low |
| Flexibility of staffing model | Low | Medium | High |
| Cost efficiency (e.g. creation of variable cost centre) | N/A | Medium | High |
| Access to subject matter experts | Low | High | High |
| Knowledge transfer to existing staff | High | High | Low |
| Access to emerging best practices and knowledge | Low | Medium | High |
One thing to keep in mind is that an internal audit model needs to fit the organization, rather than the other way around. An IA model should be regularly assessed as your organization grows, matures, and/or changes. Too often organizations become ‘comfortable’ with how things have always been done and we find this can often lead to an ineffective IA function. We suggest that our clients consider adding the topic to their Board of Directors or Audit Committee meetings annually, in order to assess the effectiveness of their current approach.
Now we know that choosing the right internal audit model may not be as easy as purchasing a lottery ticket, but the odds that it pays out are likely much higher.
About Richter : Founded in Montreal in 1926, Richter is a licensed public accounting firm that provides assurance, tax and wealth management services, as well as financial advisory services in the areas of organizational restructuring and insolvency, business valuation, corporate finance, litigation support, and forensic accounting. Our commitment to excellence, our in-depth understanding of financial issues and our practical problem-solving methods have positioned us as one of the most important independent accounting, organizational advisory and consulting firms in the country. Richter has offices in both Toronto and Montreal. Follow us on LinkedIn, Facebook, and Twitter.