The IIA Reiterates Position on Outsourcing Internal Auditing to the External Auditor

The global headquarters of The IIA recently issued a statement re-emphasizing its long-held views on internal audit outsourcing and independence. The statement comes in response to recent suggestions that it may be time to revisit existing prohibitions on provision of internal audit services by the same firm responsible for the external audit in the United States, as well as a recent high-profile instance of the practice in Europe.

“Internal audit services should not be provided by the same accounting firm that audits the organization’s financial statements, as it would impair the independence of the external auditor,” stated IIA President and CEO Richard Chambers, CIA, CGAP, CCSA. “We have expressed this numerous times over the past two decades and we feel it’s important to re-emphasize this at a time in which the practice is potentially being reconsidered. The Securities and Exchange Commission [SEC] prohibits this practice by public companies listed in the United States, but The IIA believes that even if allowed by law or statute, this practice — at a minimum — creates a perceived impairment of independence and erodes public trust.”

The IIA first expressed its position on this issue during the mid-1990s in its research paper, Outsourcing Dilemma: What’s Best for Internal Auditing, as well as in a letter to the SEC’s chief accountant. The IIA also affirmed its position in a letter to the American Institute of Certified Public Accountants’ Professional Ethics Executive Committee when it was considering a revision to Ethics Ruling 97-101 regarding extended auditing services and the impairment of the auditor’s independence. In 2003, The IIA reiterated its position in a response to the SEC’s proposal to strengthen requirements regarding external auditor independence, and then again reiterated the position in 2005 in its IIA Position Paper, Resourcing Alternatives for the Internal Audit Function.

The IIA’s stance on outsourcing the internal audit function to the organization’s external auditor, however, does not pertain to situations where the third-party provider is not the external auditor. In fact, IIA Standards mandate that the chief audit executive “obtain competent advice and assistance” when additional staffing or expertise are needed to execute the responsibilities of the function.