On the Frontlines: Choosing the Best Staffing Model

The reality is that hiring for every necessary skill would likely result in a function larger than all other departments combined. Different types of staffing models can fill the gap when there aren’t enough people or skills to go around. These can include co-sourcing, outsourcing, or hybrid models.

For example, a catering company with operations across the U.S. and Latin America could decide they want a corporate in-house function staffed with local resources in certain operations and countries, or they could be looking at a co-sourcing model with an external provider. Or they might even consider a full outsourcing model.

Here are some examples of how these models might work:

• Full outsourcing. This means hiring an external provider to fully perform internal audit services for an organization. The IIA has stated in its position paper, Staffing Considerations for Internal Audit Activity, that “oversight and responsibility for the internal audit activity cannot be outsourced” in these cases. Instead, organizations should designate an in-house liaison, preferably a CAE or an executive or senior management-level employee, who has responsibility for managing the internal audit activity.
• An in-house function fully located in the corporate office versus local teams working in the specific operations or countries. Today it is nearly impossible for internal audit to meet expectations and deliver the plan without using some external resources. When deciding to work with external resources, some considerations include:
  • The size of the corporate team, the diversity of skills required, and the impact on costs.
  • Availability of skilled, bilingual personnel in local markets. Remember that communication is not only about speaking the language but also understanding the culture.
• Co-sourcing. In some cases, a co-sourcing model — where in-house staff coordinate and lead and external resources execute the engagements — can enhance effectiveness. Here are some considerations:
  • Local resources. When operating in different countries, using local internal auditors offers cost savings and strategic advantages, such as cheaper travel expenses and a better understanding of the language and culture.
  • Use of service providers: Determine whether to rely on a single service provider or multiple providers to avoid over-reliance. This decision could be impacted by the provider’s presence in other countries, local costs, and specific engagements. For instance, when assessing cybersecurity programs in different countries, using the same service provider could ensure consistency and the ability to assess the general strategy.
  • Budget for experts who typically are more expensive due to the high level of expertise. If expert reviews are requested by the executive team or the board of directors, the CAE may ask for a special allocation of resources to cover the costs.

Here are some key factors that can impact the CAE’s decision to adopt a staffing model or a combination of models:

• Executive leadership and audit committee expectations. Reconciling expectations with risk appetite and budget constraints, especially in smaller functions, can be very challenging. The CAE should maintain regular discussions about staffing performance and needs.
• Budget. Given the importance of budget constraints, the CAE must set priorities and choose a staffing model that accounts for significant cost variations across countries, while remaining adaptable to changing conditions.
• Geographic distribution. Different challenges arise, depending on whether the organization operates domestically and/or internationally. Some of these include language, culture, and location. For instance, a Canadian company with operations in the U.S. (which shares a similar culture and at least one common language) faces different challenges than a Canadian company operating in Argentina or Senegal. Additionally, if the CAE lacks proficiency in the local language and culture, hiring bilingual staff becomes essential to ensure proper communication and the ability to build meaningful relationships. Remote locations, frequently found in the extractive industry, also require different considerations than urban offices settings.
• Pool of resources available. Finding skilled personnel tends to be harder in smaller towns than in metropolitan areas, even when flexible working conditions are offered.
• Industry regulations. Highly regulated industries require more compliance reviews and more resources of all kinds — money, people, and time.

These considerations are not prescriptive and there is no “right” or “wrong” approach. However, the decision-making process should align with the organization's characteristics and internal audit strategy.

The CAE should perform ongoing assessments of their team’s skills, the function’s strategic goals, and availability of resources to decide the most suitable staffing model. Regular discussions with the audit committee are necessary in reconciling their expectations with the organizational risk appetite, specific characteristics, and budget constraints.