Business is booming for providers of internal audit services. Last year, 63 percent of companies co-sourced at least part of their internal audit work, according to the Institute of Internal Auditors. That's up from about 50 percent in 2005.

The drive to increase efficiency in challenging economic times is just part of the explanation for the increase, according to Mike Nolan, global head of internal audit services with KPMG. He reels off a bunch of other drivers: "the complex business environment, the emerging and complex risk environment, regulation, globalization, and the demands of stakeholders ... and there always seems to be more and more stakeholders."

But perhaps the crucial factor is that as internal audit emerges from the onslaught of Sarbanes-Oxley work, IA directors are wondering whether their team has the right mix of core and specialized skills to take on new challenges. "There's been a lot of dollars put into different budgets, whether it be the internal audit budget or maybe an internal control group combined with internal audit that's addressing SOX," says Nolan. "And now management, CFOs, and others are looking at the size of those budgets -- appropriately so -- and questioning whether they're getting the right level of return." Junior talent that might have been helpful back in the days of Sarbanes box-checking exercises may not be up to the new emphasis on confronting operational, strategic, and business risks.

Paying a third-party provider for this kind of expertise might seem expensive, but companies often dismiss the option without taking into account the full costs of housing the function internally -- including recruitment, retention, training, and termination of internal audit personnel -- according to a new white paper from KPMG. What's more, Nolan points out, a company that decides to maintain the full gamut of IA skills in-house may have difficulty keeping all of its staffers busy throughout the year.

Internal audit may not be a core function, but it's certainly a sensitive one for many companies, given its importance for the audit committee, senior management, regulators, and rating agencies. That may be part of the reason why full outsourcing of the function -- as opposed to selective co-sourcing of specific projects -- is not common in very large organizations, but typically occurs in businesses with 15 or fewer internal audit FTEs, according to KPMG.

The white paper recommends a four-phase approach to implementing a sourcing arrangement for internal audit:

1. Plan and assess. Take stock of your current situation, develop your vision for the sourcing arrangement, and identify potential providers. The CFO and the audit committee have a crucial role here, says Nolan. "They have to be involved in assessing the current internal audit function, agreeing to the internal audit vision and making a true assessment of the skills the company has in-house and the amounts it's spending, and then working with the IA director to come up with a shared vision and path forward."

2. Select the provider. Check potential providers' experience with like-sized companies in your industry. Look for the ability to provide specialized skills and a global reach. Is the provider a good cultural fit with your organization? Can it bring additional strategic value in terms of enhancing the risk and control environment?

3. Implement. The provider should establish a time line and project plan and spell out IA's role in enterprise risk management (ERM), its relationship with general counsel, as well as its contributions to talent management and automation of IA procedures, such as continuous auditing and continuous monitoring.

4. Monitor and report. "Periodic ongoing communication is critical," notes Nolan, "and where there are pitfalls it's often in that space. There has to be regular contact with the audit committee, the internal audit director and the CFO and synergies between the in-house team and the service provider."

Access [1] the full white paper from KPMG.