Co-sourced internal audit in a first SOX year: who owns what

Co-sourcing is the middle option in a first SOX year, and what it actually covers usually gets settled late — in a statement of work, by people who will not be the ones answering the auditor's questions.

One extreme is building an internal audit department sized for the heaviest year the company will ever have. The other is handing the program to a firm and hoping the deliverables line up with what the auditor asks for. Co-sourcing sits in between: a provider brings method, templates and testing capacity, and the company keeps the program, the control owners and the conclusions.

In our view the model is sound, and the way it fails is predictable: the division of labour was never written down in terms of who drafts, who concludes, and who the auditor will ask.

Start with the boundary that is not yours to draw

Before comparing proposals, rule out one category of provider.

The federal statute on audit requirements, 15 U.S.C. 78j-1, lists non-audit services a registered public accounting firm generally may not provide to the issuer whose audit it performs. The provision opens: "Except as provided in subsection (h), it shall be unlawful for a registered public accounting firm" that performs the audit "to provide to that issuer, contemporaneously with the audit, any non-audit service, including—". Fifth in the list that follows: "internal audit outsourcing services".

So the firm signing your audit report is generally not available to staff this work. In our view that is the first filter to apply to a shortlist — before methodology, before price — and the application to your own facts is a question for counsel and the audit committee.

Management's assessment stays with management

An SEC frequently asked questions document on management's report on internal control over financial reporting, revised in October 2004, takes a related question. Question 17 asks: "To what extent may management rely on the registrant's auditor to assist in its development of an assessment process and documentation process in preparation of issuing management's report on internal control over financial reporting?"

The answer: "The auditor is allowed to provide limited assistance to management in documenting internal controls and making recommendations for changes to internal controls. However, management has the ultimate responsibility for the assessment, documentation and testing of the registrant's internal controls over financial reporting."

The question that draws that answer is put in terms of the registrant's auditor. In our view the second sentence is the one to read twice whoever the provider is, because it says where responsibility sits regardless of who holds the pen: the assessment, the documentation and the testing are management's.

The practical form of that is simple. A provider can draft a narrative, build a matrix, run a test and write the workpaper. Someone employed by you has to be able to defend each of those in their own words, with the provider out of the room. In our view that is the best single test of whether a split is real: pick a control at random and ask who inside the company can explain its evidence.

A line worth borrowing from the same document

Question 14 of the same document takes up outsourced functions. It sets the scene broadly — "a registrant relies on a third party service provider to perform certain functions where the outsourced activity affects the initiation, authorization, recording, processing or reporting of transactions in the registrant's financial statements, such as payroll" — and then asks whether management may rely on that provider's Type 2 SAS 70 report, the report name in use when the answer was written, where the provider's auditors are also the registrant's.

The answer is that management "would be able to rely on the Type 2 SAS 70 report even if the auditors for both companies were the same." Then it separates a different case: "On the other hand, if management were to engage the registrant's audit firm to also prepare the Type 2 SAS 70 report on the service organization, management would not be able to rely on that report for purposes of assessing internal control over financial reporting." The same answer opens by saying that where functions are outsourced, "management maintains a responsibility to assess the controls over the outsourced operations."

In our view a co-source arrangement is worth reading against that shape: it too puts an outside party on work you still have to stand behind, and moving an activity outside the company does not move the responsibility for assessing the controls over it.

What your auditor may do with the provider's work

If your first year carries an auditor attestation under Section 404(b) — see 404(a) versus 404(b) for which companies that reaches — then how much of the provider's testing the auditor can lean on becomes a live budget question.

The SEC's 2007 order approving PCAOB Auditing Standard No. 5 addresses it while responding to comments. The order states: "The Commission agrees that Auditing Standard No. 5 is sufficiently clear about the extent to which the auditor can use the work of others." And on whether auditors should be obliged to use work they consider reliable: "The Commission does not believe it is necessary or appropriate to preclude the auditor from utilizing his or her judgment in determining whether or not to use the work of others based on the particular facts and circumstances of the engagement."

Read that as a planning instruction rather than a reassurance. Whether the provider's workpapers reduce the auditor's own testing is a judgment the auditor makes on the facts of the engagement. In our view, have that conversation before the provider's scope is fixed: ask your audit partner, in writing, which areas they expect to test themselves and what the provider's documentation has to look like for them to consider using it.

What the 2003 order says about an internal audit function

Co-sourcing is sometimes pitched as a way to avoid standing up an internal audit function at all. The SEC's 2003 order approving the NYSE and NASD proposed rule changes describes the NYSE proposal in a line: "NYSE section 303A(7)(d) would require each listed company to have an internal audit function."

Note the tense: the order describes what the proposal would require. In our view, read the current listing standard and its commentary directly, and ask counsel whether a co-sourced arrangement satisfies what it requires of you — before a provider's scope is written.

A split that holds

This is our working division of labour, not a published allocation:

Provider	Company
Method, templates, workpaper format	Scoping decisions, in writing
Walkthroughs and documentation drafts	Control owner sign-off on each narrative
Testing capacity in the heavy months	Conclusions, and the assessment itself
Issue write-ups and recommendations	Remediation decisions, with named owners
Knowledge transfer and training	The evidence repository, held by you

One rule makes the table work: everything in the provider column lands in a system you control.

Where co-sourced first years go wrong

• The evidence lives with the provider. Workpapers sit in the provider's platform with exports promised at the end. In our view insist that evidence arrives in your repository as it is produced, and that the contract says what happens to it if the engagement stops early.
• Testing starts after remediation should have. A provider mobilised late tests controls that have not operated long enough to test — the same failure mode described in the first-year timeline, with an invoice attached.
• Nobody inside the company owns the explanation. Every account of a control routes back to the provider, and no employee can walk through its evidence unaided. In our view this is a staffing problem rather than a documentation problem.
• Systems get left out of the provider's scope. A finance-led engagement can scope the transaction cycles and leave the systems underneath to IT. In our view that gap is where first-year exceptions come from; ITGC scoping covers the ground.
• Year two becomes a renegotiation. In our view write the taper into the first contract: what moves in-house, when, and who gets trained to take it.

What to do first

1. Apply the independence boundary before reading any methodology. Your audit firm is generally not an option for this work under 15 U.S.C. 78j-1; confirm how that lands on your own facts with counsel.
2. Write the split control by control, not phase by phase. "Provider does testing" is not a split. Who drafts, who reviews, who signs, and where the evidence lands.
3. Get your auditor's expectations in writing before scope is fixed. Which areas they intend to test themselves, and what the provider's documentation has to look like.
4. Name one employee accountable for the program. Not the provider's engagement manager.

Working back from a year-end, the SOX 404 deadline calculator lays the milestones out against it, and the readiness scorecard ranks which gaps are still fixable in the time you have.

This is general information, not audit or legal advice. Confirm what applies to you with your auditor or counsel.

Common questions

Can the firm that audits us also run our co-sourced internal audit work?

Generally no. The federal statute on audit requirements, 15 U.S.C. 78j-1, makes it unlawful, except as provided in subsection (h), for the registered public accounting firm performing the audit to provide the issuer non-audit services contemporaneously with the audit, and the list of those services includes internal audit outsourcing services. Confirm the application to your own facts with counsel.

Does a co-source provider take on responsibility for management's assessment?

No. An SEC frequently asked questions document on management's report on internal control says management has the ultimate responsibility for the assessment, documentation and testing of the registrant's internal controls over financial reporting. A provider can draft and test; someone you employ has to be able to defend the result.

Will our auditor reduce their own testing because the provider tested first?

That is the auditor's judgment rather than your planning assumption. The SEC's 2007 order approving Auditing Standard No. 5 says the Commission does not believe it is necessary or appropriate to preclude the auditor from using judgment on whether to use the work of others, based on the facts and circumstances of the engagement.

Do we still need an internal audit function if we co-source the work?

That turns on the exchange rules that apply to you, so take it to counsel rather than assuming co-sourcing settles the question. The SEC's 2003 order approving the NYSE and NASD proposed rule changes describes the NYSE proposal in a line: NYSE section 303A(7)(d) would require each listed company to have an internal audit function. Note the tense: the order describes what the proposal would require, so read the current listing standard and its commentary before you rely on that line.

What should a co-source contract say about evidence and workpapers?

In our view, evidence and workpapers should land in a repository you control as they are produced rather than at the end of the engagement, and the contract should say what happens to them if the engagement stops early.

Sources

1. 15 U.S.C. 78j-1 — Audit requirements, including subsection (g) on prohibited activities and subsection (i) on preapproval requirements · United States Code, via the U.S. Government Publishing Office
2. Management's Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports — Frequently Asked Questions · U.S. Securities and Exchange Commission
3. Public Company Accounting Oversight Board; Order Approving Proposed Auditing Standard No. 5, An Audit of Internal Control Over Financial Reporting That Is Integrated With an Audit of Financial Statements, a Related Independence Rule, and Conforming Amendments (Release No. 34-56152) · U.S. Securities and Exchange Commission, via the U.S. Government Publishing Office
4. Self-Regulatory Organizations; New York Stock Exchange, Inc. and National Association of Securities Dealers, Inc.; Order Approving Proposed Rule Changes · U.S. Securities and Exchange Commission, via the U.S. Government Publishing Office