Prepare internal audit to review a proposed critical-operation outsourcing

The outsourcing proposal is approaching a decision. Due diligence has produced a large document folder, commercial negotiations are advanced and the implementation team wants to commit resources. Internal audit receives the pack late and is asked whether anything prevents signing.

That sequence compresses the opportunity for independent challenge. Preparing the review earlier gives the decision-makers time to understand findings while meaningful options remain available.

Establish the review trigger and timing

CPS 230 requires internal audit to review proposed material arrangements involving outsourcing of a critical operation. CPG 230 describes review before the final decision when a critical operation, or part of one, currently performed in-house is proposed for outsourcing.

Have the relevant owners confirm how those requirements apply to the proposal. The preparation steps here are a suggested project discipline, not a substitute for internal audit's scope, methodology or judgment.

Map the actual decision points: selecting the provider, committing contractually, transferring data, changing operations and going live. Some may occur before the headline “approval meeting”. Tell internal audit when commitments could narrow the choices available.

Give audit the proposal, including its boundaries

Begin with a short explanation of the operation, the activities being outsourced and the capabilities the entity will retain. Include the legal entities, proposed service scope, key dependencies and intended implementation sequence.

Explain why management proposes the arrangement and what alternatives it considered. The review should not have to infer the business case from a supplier presentation.

Identify assumptions that materially affect the proposal. For example, a transition plan may assume that knowledgeable internal staff remain available until reconciliation is complete. If their planned departure dates conflict with that assumption, make the conflict visible.

For a wider audit perspective, The IIA's practical guidance on third-party risks highlights supplier-selection documentation, relationship ownership, contract access rights and the information reaching the board. These are useful lines of inquiry when checking whether the proposal pack explains how the relationship will be governed.

Organise the evidence around review questions

A folder can contain every document and still be difficult to review. Provide an index that connects the main questions with the relevant evidence and limitations.

A practical index might cover:

• The proposed service and its connection to the critical operation.
• Provider selection, due diligence and unresolved findings.
• Contractual obligations and matters still under negotiation.
• Control responsibilities retained internally and transferred operationally.
• Continuity, recovery and exit assumptions.
• Transition design, testing, data handling and acceptance criteria.
• Management's proposed monitoring and escalation arrangements.

Mark draft documents clearly and identify the version used for each management conclusion. Where an answer is missing, state who is obtaining it and when it is expected. An empty folder should not look like a completed assessment.

Work a proposal with an unresolved handoff

Consider a fictional insurer proposing to move part of claims processing to a provider. The supplier's testing shows that its application accepts the insurer's sample files. The implementation plan does not demonstrate how rejected records will be investigated or how the insurer will reconcile completed work.

Management has described the file-interface test as successful. That may be accurate within its scope, while the end-to-end handoff remains unresolved.

An audit-ready pack separates those two points. It includes the test result, the untested activity, the proposed owner and management's plan to establish a dependable reconciliation process. Internal audit can then challenge the significance, sufficiency of evidence and decision implications.

The preparation team should not predetermine audit's conclusion or present a management response as if it has closed the finding. Independent review retains its own judgment about whether the response is adequate.

Preserve independence when the team is small

Small organisations may rely on external specialists or a compact internal-audit function. Establish capability, capacity, reporting lines and potential conflicts early through the appropriate governance process.

If people helped design the proposed controls, consider how independent assurance over those controls will be obtained. Familiarity with the project is useful, but it does not remove the need to address independence.

Do not use internal audit as the owner of provider selection, operational risk acceptance or implementation delivery. Management remains responsible for the proposal and its controls. Audit provides challenge and assurance within its mandate.

Bring findings into the actual decision

The final decision pack should distinguish the finding, management's response, evidence of remediation and any remaining disagreement. Give decision-makers the relevant audit conclusion and limitations, not only a project team's summary that the review “has been completed”.

Where a proposed condition must be satisfied before commitment or go-live, state that explicitly. Identify who verifies completion and what happens if the condition is not met. Avoid wording that allows a document upload to be mistaken for evidence that a capability works.

Internal audit's review is not itself approval of the outsourcing arrangement. The authorised decision-maker must consider the proposal under the entity's governance arrangements and applicable obligations.

Keep the evidence current through implementation

A material change after review can undermine earlier assumptions. If the provider, scope, hosting model or transition approach changes, route that change to the appropriate owners and determine whether further review is required.

Preserve the reviewed version and record what changed. This allows later assurance to understand which proposal was challenged and which arrangement was actually implemented.

The decision-record guide helps keep management's response, conditions and authorised decision distinguishable from internal audit's findings.

Use the CPS 230 evidence checklist for the supporting record structure. For the next outsourcing proposal, identify the earliest commitment date and work backwards with internal audit to allow enough time for evidence, challenge and resolution.