The Co-Sourced Team's Quality Gap
A hospital group's internal audit function of 6 staff co-sources all cybersecurity and clinical-systems audits to a specialist firm. The co-sourced work represents 45% of the annual audit plan by hours and covers the highest-risk areas. The internal QAIP reviews only in-house engagements; the co-sourced firm applies its own methodology and quality process. During an internal assessment, you find that the co-sourced firm's workpapers use a different risk-rating scale, its findings are not consistently mapped to the group's risk taxonomy, and two of its three reports last year were issued without the CAE's review. The CAE says, 'They're the experts - we rely on their quality process.'
1. Who is accountable for the quality of co-sourced audit work, and what does that imply for the QAIP?
Read the worked answer
The internal audit function and its CAE remain accountable for all work performed on its behalf, including co-sourced work. Delegating execution does not delegate accountability.
Implications for the QAIP:
- Co-sourced engagements must be within the QAIP's scope - engagement-level review, ongoing monitoring, and internal/external assessment coverage.
- The firm's own quality process is complementary, not a substitute. The function must satisfy itself that the work meets its standards and the group's methodology.
- The CAE must review and approve reports before issuance.
- The QAIP should include criteria for selecting and overseeing co-sourced providers, and evidence of that oversight.
'We rely on their quality process' is an abrogation of the CAE's responsibility, especially for the highest-risk areas covering 45% of plan hours.
2. Identify the specific control failures revealed and rank them by risk.
Read the worked answer
Failures revealed:
- Reports issued without CAE review (2 of 3) - highest risk. Unreviewed conclusions reached the audit committee on the highest-risk topics; no assurance the findings are accurate, appropriately rated, or consistent with the group's standards.
- Inconsistent risk-rating scale - findings cannot be compared or aggregated across the audit universe; the committee may misjudge severity.
- Findings not mapped to the group's risk taxonomy - breaks linkage between audit results and enterprise risk management; undermines the audit plan's risk basis.
- Co-sourced work excluded from QAIP - a structural gap meaning 45% of the highest-risk work received no internal quality assurance.
Ranking rationale: the unreviewed reports are the most acute because they represent assurance already delivered to the board without the CAE's sign-off. The taxonomy and rating issues are systemic and affect every co-sourced engagement. The QAIP exclusion is the root cause enabling the others.
3. Recommend a remediation approach that preserves the value of co-sourcing.
Read the worked answer
Co-sourcing is legitimate; the fix is oversight, not insourcing.
- Bring co-sourced work into the QAIP scope immediately: add engagement-level review criteria and include a sample of co-sourced engagements in ongoing monitoring.
- Mandate CAE review and approval of all reports before issuance; document the review.
- Align methodology up front: require the firm to map its risk ratings to the group's scale and taxonomy in the engagement plan, and validate this at planning.
- Contract and onboarding: add quality expectations, methodology alignment, and QAIP participation to the engagement terms; brief the firm on the group's standards.
- Oversight role: assign an in-house audit lead as relationship and quality owner for each co-sourced engagement.
- Assess provider quality periodically and feed results into the QAIP.
This retains specialist expertise while restoring the CAE's accountability and closing the 45% assurance gap.