Appointing an internal audit partner: capability, independence and deliverables

An internal audit partner is an external provider engaged for specified assurance or advisory work, with clear supervision and independence safeguards.

Selecting a partner requires evidence about the proposed team, conflicts, methodology, information handling and deliverables. Outsourced delivery does not remove the institution's oversight responsibilities. Appointment procedures must follow the institution's applicable procurement framework.

Commissioning due diligence and evaluating independence conflicts

The operation of internal control systems is the responsibility of the relevant line managers.

— National Treasury Internal Audit Framework2009, section1.3.2.5, page8

Appointing an external service provider requires rigorous commissioning due diligence before contractual engagement. Global standards mandate that the chief audit executive confirm the organisational independence of the internal audit function and identify any potential impairments to objectivity. When evaluating prospective partners, audit committees and internal audit leaders must assess potential or actual conflicts of interest, including existing advisory, commercial, or external audit relationships with the organisation.

Historical public sector guidance similarly highlights that while operational delivery may be outsourced, statutory supply chain management processes must be followed and structural independence preserved. As a recommended commissioning control, request formal disclosures from prospective providers regarding past or current engagements across the organisation to ensure unbiased professional judgment.

Internal audit leadership should establish a documented methodology to evaluate whether an external provider's reporting lines or auxiliary services create self-review threats. Where an external partner provides advisory services on control design, the chief audit executive must assess whether the previous advice impairs objectivity and allocate resources to manage individual objectivity before assurance work begins.

Establishing clear conflict-resolution procedures during initial due diligence enables the chief audit executive to manage potential perception risks before engagements commence. This proactive evaluation safeguards the overall integrity of the internal audit mandate.

Assessing competency evidence and managing skills transfer

Selecting a qualified internal audit partner requires verifying that the external team collectively possesses the knowledge, skills, and technical abilities needed to achieve the audit plan. Assess the professional qualifications, sector experience and relevant certifications of the proposed team members rather than relying solely on firm-level credentials.

Under current standards, the chief audit executive is responsible for ensuring that human resources are appropriate, sufficient, and effectively deployed. National Treasury guidance notes that co-sourcing arrangements are particularly valuable for obtaining specialised technical capabilities, such as information technology or forensic auditing, while developing internal capacity.

To ensure lasting organisational value, engagement contracts should incorporate a structured skills transfer plan. Recommended practices include pairing external specialists with in-house staff during field engagements, conducting joint risk assessments, and delivering technical briefing sessions to embed specialised knowledge within the internal team.

Defining supervision boundaries and retaining executive responsibility

A fundamental principle across global standards and local frameworks is that outsourcing delivery does not remove the institution's oversight responsibilities. Standard 12.3 explicitly mandates that the chief audit executive remains responsible for supervising engagements and approving final results, regardless of whether the work is performed by internal staff or external service providers.

Supervision requires active oversight throughout the engagement lifecycle rather than passive review of final deliverables. The chief audit executive or a designated supervisor must approve engagement work programmes, monitor field progress, and verify that audit workpapers adequately support reported findings and conclusions.

Recommended implementation practices suggest establishing formal check-in milestones, supervisory sign-off protocols, and clear escalation paths for handling professional judgment disagreements. Maintaining effective supervision ensures that engagement execution remains fully aligned with the approved internal audit charter and strategic plan.

Evaluating supervisor review notes and conducting post-engagement debriefs further reinforces quality assurance across co-sourced deliverables.

Protecting information security, managing workpapers, and governing reporting

Contracting an external partner introduces operational risks regarding data privacy, information security, and record custody. Standard 5.2 requires internal audit functions to protect confidential information and manage risks related to inadvertent disclosure. Chief audit executives must collaborate with organisational information security teams to ensure external partners adhere to mandatory data protection requirements and secure transfer protocols.

Treasury's historical public-service framework treats working papers as organisational property under the internal audit activity's control. Set explicit custody, access, retention and handover terms consistent with the actual mandate and applicable obligations. National Treasury guidance dictates that access to workpapers by external parties requires formal authorisation, ensuring that proprietary data and sensitive findings are safeguarded.

Reporting protocols must ensure that final engagement communications are issued under the authority of the chief audit executive. Key practical measures for governing partner deliverables include:

• Establishing contractual data security requirements governing physical and digital record handling.
• Defining explicit workpaper retention, custody, and return protocols upon engagement completion.
• Mandating that all final reports be reviewed, approved, and issued by the chief audit executive.
• Establishing structured handover procedures to ensure seamless transition and archival of engagement records.

Recommended bid-evaluation matrix for internal audit partner selection

To assist audit committees and chief audit executives in assessing prospective service providers, the following non-mandatory bid-evaluation matrix provides a qualitative crosswalk aligning evaluation criteria with relevant source topics; this is not a standards conformance certificate.

For wider context, read the internal audit delivery models overview.