Outsourced vs co-sourced internal audit, and the third option

The difference between outsourced vs co-sourced internal audit is who does the work and who stays in charge. With outsourced internal audit, an outside firm does most of the internal audit work, and a small internal team, sometimes one manager, still oversees it; with co-sourced internal audit, your own head of internal audit stays in charge and brings in outside specialists for particular areas or busy seasons. A third option suits many companies better: a fractional SOX lead. That is an outside person who runs the SOX compliance program on a set number of days each month, for a company that has the controls but not the person to run them.

The right model depends on who owns the risk assessment, who your external auditor will look to, and what you need in the next twelve months. This guide compares the three on those points, plus fees, staffing and the exit. It is general information. Confirm anything regulatory with your auditor and counsel.

The three models, defined

Fully outsourced

Federal banking regulators, in their interagency policy statement on internal audit outsourcing, describe outsourcing as hiring an independent public accounting firm or other outside professionals to do work internal auditors would traditionally do. In the fuller version, the institution keeps a manager of internal audit and a very small staff. The vendor helps identify risks, recommends and performs procedures the internal audit manager approves, and reports significant findings jointly with that manager. The company still needs an insider who owns the function. The vendor supplies the hands.

Co-sourced

Here your internal audit leader stays in control and the outside firm reports to that person. Co-sourcing is typically used for technical areas such as IT, where specialists are hard to hire, and in practice also to cover peak periods. Federal banking regulators note these arrangements go by several names, including internal audit assistance, audit co-sourcing and extended audit services.

Fractional SOX lead

This is not an internal audit function. A fractional SOX lead runs the SOX program from management's side. That covers the compliance calendar, control owners across finance and IT, evidence requests, the auditor relationship, support for management's assessment and the status report the audit committee sees. It fits a company where SOX is most of what internal audit would otherwise be doing. In a 2025 KPMG study cited by the IIA, most respondents spent more than 60% of internal audit hours on SOX compliance, and SOX itself does not explicitly mention internal audit.

Which fits, by size and stage

Pre IPO and newly listed companies. NYSE companies must have an internal audit function. It may be outsourced, though not to the company's independent auditor, and under the current rule it must be in place within one year of listing. A July 2026 NYSE filing proposed extending that to five years and notes that Nasdaq has no such requirement. Check whether the SEC has approved it before relying on the longer period. Before the offering, the pressing work is usually SOX readiness, not a full internal audit plan. That points to a fractional lead or targeted readiness work, with co-sourcing added later.

Public companies with a small team. If you have a head of internal audit but no IT audit depth, co-sourcing fills the gap without giving up control. If you have the controls but nobody running the program, a fractional lead fills that seat.

PE backed companies. Sponsors and lenders usually want a credible controls answer before anyone wants a standing audit department. Most of these companies start with a fractional lead or fixed scope testing.

Banks and savings associations: federal safety and soundness guidelines expect an internal audit function suited to the institution's size and the nature and scope of its activities. Credit unions follow separate NCUA requirements. Outsourcing is common, and the FDIC has acknowledged that many banks find a full time internal auditor costs more than it is worth. Examiners check that the board still oversees the outsourced function.

Insurers. The NAIC Model Audit Rule requires an internal audit function for individual insurers writing more than $500 million in annual premium, or groups writing more than $1 billion. That function must be organizationally independent of management, though dual reporting lines are allowed, and its head must report to the audit committee at least annually. These rules apply through each state's adoption of the NAIC model.

Independence: who may not do the work

Three rules of thumb cover most of the risk.

1. Your external auditor is generally out. SEC independence rules bar a public company's external auditor from providing internal audit outsourcing to that audit client, apart from a very narrow exception. SEC staff have said a prohibited service cannot be cured once it has been performed in a period. Check before you sign. Do not try to fix it afterward.
2. Watch for overlapping roles. The FFIEC flags a possible conflict when the firm doing outsourced IT audit also does the financial statement audit or consulting for the same institution.
3. Someone inside must own the oversight. Federal banking regulators, including the FDIC, expect outsourced internal audit work to be overseen by a competent employee, ideally one with no management responsibility for the areas audited, who reports to the audit committee.

Testing your auditor can rely on

Whether your external auditor relies on your testing is the auditor's decision, never yours or a provider's. Under PCAOB AS 2201, the more competent and objective the testers, the more of their work an auditor may use. Work from people with low competence should not be used, however objective they are, and the same goes for work from people with low objectivity, however competent. As a control's risk rises, the auditor needs to do more of its own testing, so reliance on others' work tends to be thinnest for the highest-risk controls.

Under AS 2605, auditors judging objectivity look at things such as whether testers are kept away from areas they were recently assigned to or are scheduled to join.

In practice, testing an auditor can use usually has these features:

• The testers are not the control owners. Someone who performs or reviews a control should not test it.
• Sample sizes and methods are agreed in advance. Settle them with your auditor at planning, not after testing.
• Evidence shows what the reviewer looked at. Workpapers must show the review actually happened. A signature alone does not.
• The reports behind each control are tested. Each report a control relies on should be checked for completeness and accuracy.

One trade-off is worth knowing. SEC guidance from 2007 lets management's evaluation follow its own approach rather than auditing standards. The SEC's 2007 guidance was meant to make management's evaluations more efficient, after early SOX work, often modeled on the auditing standard, proved more extensive and costly than needed. Build to the auditor's standard where you want reliance, and keep it lighter where you do not.

How each fee structure behaves

Fixed fee. This model suits defined work such as a readiness review, a testing cycle or remediation. The fee is set before work starts, so scope creep becomes a scope conversation rather than a surprise invoice. Ask what triggers a change order, and whether retesting remediated controls is included.

Hourly. This model suits advice and open questions. It flexes with year end peaks, but so does the bill. Ask for a cap or a monthly estimate.

Retainer. This model suits ongoing roles such as a fractional lead. You buy a set number of days each month, which smooths the calendar. Ask how days are handled in heavy months and what happens to unused ones.

Whatever the model, the contract should name the deliverables and the dates as well as the price.

Seniority and continuity

The biggest variable in any of these models is who actually shows up. The proposal often features a partner, and fieldwork is often staffed by whoever is free. Turnover then means re-explaining your systems every year. Continuity protections worth writing into the contract:

• Named key staff, with your approval required to replace them
• A limit on rotation during an audit cycle
• Your written consent before subcontractors are added
• Knowledge transfer and workpaper delivery at exit, at no extra charge

Questions to ask a provider

• Who will do the fieldwork, and who reviews it? Are they the people in the proposal?
• Have you checked for conflicts with our external auditor and with any work you do for us?
• Do we own the workpapers, scripts and evidence index when the contract ends?
• How will you agree on sample sizes and documentation with our auditor before testing?
• What is in the fixed fee? Is retesting after remediation included?
• What happens to your fee if a control you tested fails the auditor's testing?
• Do you use AI tools on our data? Where does it run, and who reviews the output?
• If you act in the head of internal audit role, how do you apply the IIA's standards, and who arranges any external quality assessment?

Transition and handoff

Most companies move through these models: fractional lead or targeted testing before an offering, then co-sourced support once a head of internal audit is hired, then mostly in house. Each move goes better if you plan for these steps:

1. Fix the deadline first. Work backward from your listing date, exam date or audit planning meeting.
2. Screen the next provider for conflicts before the request for proposal, not after.
3. Take the full file. Get narratives, control matrices, test workpapers, the evidence index and the open gap list, with an owner and a date on every line.
4. Overlap the outgoing and incoming people for at least one testing cycle where you can.
5. Tell your auditor early who will test and how, since that shapes reliance.

Where we fit

We are an advisory firm, not a CPA firm. We perform no audit or attest work, and we are not affiliated with any audit firm. Two of our services map directly to this decision:

• Fractional SOX compliance lead: a set number of days each month on retainer, the same lead every time.
• PCAOB grade testing for management: documentation and testing built to the standard an external auditor applies to its own work. How much your auditor relies on it remains its call.

Work is senior from the first call to the retest. Hands are added only with your written consent, and work product belongs to you. We offer fixed fees for defined work, hourly rates for advice and retainers for the fractional role.

If your auditor, an examiner or a regulator writes up a deficiency on a control we documented and tested, we remediate it at no charge. Twenty percent of each fixed fee is held back until testing of the controls in scope passes with no deficiency attributable to our work.

The services page has the details. The procurement page covers conflicts, contracts and billing.

Book a free two hour scoping call. Send the date that matters and a line on what is coming up, and you will hear which model we would recommend, including when it is not ours.

Frequently asked questions

Is co-sourcing cheaper than outsourcing?

Not necessarily. Co-sourcing assumes you already pay for an internal audit leader and buy outside hours on top. Outsourcing replaces most internal headcount. The cheaper option is the one that matches the work you actually have.

Can a fractional SOX lead replace internal audit?

For SOX program management, often yes. As a formal internal audit function under an exchange or regulatory requirement, generally no, since those carry independence and reporting expectations a management-side role does not meet. Ask your counsel and auditor which applies to you.

Can the same outside person run the program and test the controls?

They can, but your auditor will weigh that person's objectivity when deciding how much to rely on the testing. Raise it at audit planning. Keep testers separate from the people who perform and review controls.

Will our auditor rely on testing you perform?

That decision is your auditor's. We build workpapers to the standard auditors apply to their own work so reliance is possible. How much they use depends on their own risk assessment.

Do you perform internal audit for banks or insurers?

Our regulated work covers ICFR testing under FDICIA and the Model Audit Rule, and cybersecurity baselines examiners read. Whether that fits your internal audit structure is a question for the scoping call.