Your mother told you not to wear that shirt inside-out, but now that you’re a banker, it may be a good fit. Everyone calls it “Internal” Audit, but sometimes it makes sense to leverage time and resources by outsourcing. We’ve taken the time to outline some things to consider.
The role of Internal Audit has sky-rocketed in importance as community banks grapple with strategies to ensure “independent” review and compliance. The principles of risk management and internal controls remain just as important as ever, but with growing complexity, economic stress, burgeoning regulation, and labor shortages, community bankers are increasingly turning to their Internal Audit function to provide expert, independent assurance that operations are functioning as they should.
Why Banks are Outsourcing Internal Audits
Our research shows community bankers are looking for a more robust Internal Audit role for several reasons, including:
- Staff attrition or pressure for better efficiency ratios has decreased the number of operations staff available for optimal rotation, separation of duties or independent review
- Regulators are looking for more “independent review” – even for smaller banks
- The risks and potential costs associated with mistakes or non-compliance may be higher
- Experience or expertise levels in certain areas of the bank warrant independent review
- The bank has grown in size or become more geographically spread out, such that consistency in operations is more challenging
- The bank has grown in size or is expected to grow, where regulatory expectations warrant a more robust Internal Audit program
- Regulations have grown and become more complex, making it harder to comply or for front-line staff to keep up with requirements
- Directors, especially outside directors, are increasingly asking for “objective” assurances
- Relying more on the Internal Audit program for risk management strategies than just performing minimum reviews
- Difficult economic times put pressure on banking staff and customers, where the assurance of independent reviews may help deter fraud and misappropriation
An Examiner’s Viewpoint on Outsourcing
For an examiner’s view, we spoke to an FDIC Supervisory Examiner. Regarding outsourcing, the examiner acknowledged there is sometimes not enough Internal Audit work to employ a full-time person or, more commonly, there are issues with lack of independence or expertise for all items reviewed.
There was also mention of how important the risk assessment is in setting the scope and procedures and measuring the results. Whether internal audits are performed by bank staff or outsourced, the examiner emphasized the test was the ability to “show sufficient expertise, experience, and independence.”
How Non-financial Factors Impact the Outsourced Audit
In speaking with community bankers, we have found 16 non-financial factors being considered when evaluating in-house versus outsourced Internal Audit services:
- Workload and “capacity” of existing staff
- Scope or “range” of bank activities to be reviewed by Internal Audit (vs. other sources)
- An honest assessment of how highly management values the Internal Audit role
- The pool of talent available for hire in the bank’s area(s)
- Development or training needs for bank staff
- Expectations of directors, shareholders, or regulators
- Recent or expected growth for the bank or holding company
- How quickly the bank wants Internal Audit to be fully operational and/or what transitions in staff or program are targeted
- Any gaps in expertise and experience levels for different Internal Audit staff positions
- Degree of need for professionalism, sophistication, audit discipline or objectivity
- “Canned” policies and program versus a tailored process that fits the bank
- Evaluation of the “professional standards” and degree of accountability needed
- The need to “stay current” on audit standards and practices and required CPE
- Assessment of the different skill sets needed to effectively perform Internal audit activities.
- Management’s threshold or “outlook” toward risk (financial, reputation, compliance, etc.), “peace of mind,” and the various alternate strategies available for mitigating these risks
- How much of a resource Internal Audit staff is for other bank staff (or desired to be)
Would Outsourcing Benefit Your Operation?
If this is something your bank would like to consider, we suggest evaluating the above items, where applicable, and assess the current or expected situation. Assigning a rating to each item is often helpful and surveying key stakeholders in the organization is vital to providing a balanced assessment. Only after doing this do we recommend analyzing the cost factors. In this manner, the banker has assessed how important the Internal Audit role and results are – before assigning dollars.
Evaluate Both Cost Factors and Resources
As with any outsourcing decision, cost factors are an important part of the equation, including: Efficiency and time management, build vs. buy, full-time vs. part-time, and absolute dollar costs. Although dollar cost may be one of the most important influencers, comparing salary and benefit costs directly against outsourcing fees should not be used as the only analysis.
For example, outsourcing fees may compare favorably to personnel costs, but “supplementing” the talent-set of existing bank staff may be a higher priority. Or conversely, the fees may be higher, but a better fit to the bank in the long run. Fortunately, performing an effective assessment of the bank’s resources relative to the risks involved is inherent in what we do as bankers. The current and projected cost of hiring, training, and retaining capable bank staff is always a challenge.
So, when is “inside-out” ok? It depends, of course. We don’t advocate ignoring your mother’s good advice, but when considering outsourcing Internal Audit, or any other function, we encourage bankers to evaluate the criteria above, weigh the options, and make sure there’s a good fit with the bank’s over-all culture and mission.
Contact a K·Coe banking advisor with questions regarding the Internal Audit for your community bank.
