Topic 4: Develop /Procure necessary Knowledge, Skill and Competencies required by Internal Audit Activity

Co-sourcing and out-sourcing are necessary when unique competencies and specialty skills are not available to fulfill an internal audit activity. It is incumbent upon the CAE to obtain assistance from experts outside the internal audit activity to support or complement areas where the activity is not fully proficient.

Advantages of co-sourcing and outsourcing:

• Frees internal resources for other activities
• Provides flexibility (by allowing internal resources to complete other projects).
• Can improve efficiency and effectiveness
• Can reduce expenses
• Can provide coverage of remote locations
• May improve the quality and timeliness of internal audit activity
• Can provide additional skill sets not currently within the department

Disadvantages of co-sourcing and outsourcing:

• Can cost more to go outside for specific expertise
• Results in a loss of in-house capabilities and process control
• Has potential for poor staff morale
• Requires a learning curve and continual oversight and coordination to manage the relationship
• Has potential for privacy and confidentiality issues.
• Can create a loss of internal auditing activities as a training ground for internal promotions

The CAE must ensure that the external service provider that he appointed possess the necessary knowledge, skills and other competencies to perform the engagement. 

The CAE need to assess the relationship of the external service provider to the organization and to the internal audit activity to ensure that independence and objectivity are maintained throughout the engagement. 

Fraud is "any illegal acts characterized by deceit, concealment or violation of trust".

The internal auditor's responsibilities for detecting fraud during engagement includes:

• Consider fraud risks in the assessment of control design and determination of audit steps to perform
• Have sufficient knowledge of fraud to identify red flags indicating fraud may have been committed. 
• Be alert to opportunities that could allow fraud, such as control weaknesses
• Evaluate the indicators of fraud and decide whether any further action is necessary or whether an investigation should be recommended.
• Notify the appropriate authorities within the organization if a determination is made that fraud has occurred to recommend an investigation.