Internal audit insight
In-house, outsourced or co-sourced: choosing your internal audit model
A practical guide for business owners, CFOs and audit committees in Thailand
The question behind the question
Should the company build its own internal audit team, engage an outside provider, or combine the two? It is tempting to start with cost. A more useful first question is what the board needs to see.
The Institute of Internal Auditors (IIA) describes internal auditing, in its Global Internal Audit Standards, as providing “the board and management with independent, risk-based, and objective assurance, advice, insight, and foresight”. The right model is the one that delivers this for your risks, at your stage of growth. Decide on risk, skills and independence first, and on cost second.
Why the choice matters
When the model does not fit the company’s risks, the board receives reports but not a reliable, independent view of what matters most. The audit plan can end up following the skills that are available rather than the risks that are significant.
In my experience, companies that treat internal audit as governance act on findings immediately. Companies that treat it as compliance leave the same risks unaddressed across several audit cycles. Choosing the model on risk, skills and independence is part of treating internal audit as governance.
Three models in plain terms
In-house: the company employs its own internal audit team, led by a head of internal audit. This gives continuity and knowledge of the business, but the cost is largely fixed and specialist skills can be hard to recruit and keep.
Outsourced: an external provider carries out the internal audit function under a contract and reports to the audit committee. This gives access to specialist skills and a cost that can flex with the plan, but it needs a named internal owner for follow-up and deliberate steps to build knowledge of the business.
Co-sourced: an in-house lead brings in outside specialists for particular reviews. The company keeps ownership and continuity and adds skills when needed, provided roles and reporting are clearly divided.
Continuity and knowledge of the business.
Cost is largely fixed; specialist skills can be hard to recruit and keep.
Access to specialist skills and a cost that can flex with the plan.
Needs a named internal owner and deliberate steps to build business knowledge.
Keeps ownership and continuity while adding skills when needed.
Roles and reporting must be clearly divided.
What the rules say
The SET Notification on the Qualifications and Scope of Work of the Audit Committee B.E. 2558 (2015) applies to listed companies and to companies applying to list. Among its duties, the audit committee must review the company’s internal control and internal audit systems, consider the independence of the internal audit unit, and approve the appointment, transfer and dismissal of the head of that unit or of any other unit in charge of internal audit (clauses 3 and 7(2)). SET’s mai listing regulation applies the same rules to mai (clauses 4(8)(a) and 40(1)). The notification does not say whether internal audit must be carried out by employees or by an outside provider.
The Global Internal Audit Standards, effective from 9 January 2025, are professional standards for internal auditors, not company law. They apply “whether an organization employs internal auditors directly, contracts them through an external service provider, or both”.
Auditor independence rules matter if the company is considering its external auditor. Under the International Code of Ethics for Professional Accountants issued by the International Ethics Standards Board for Accountants (IESBA), on which Thailand’s Code of Ethics for Professional Accountants is based, an audit firm, or a firm in its network, must not provide internal audit services to an audit client that is a public interest entity, such as a listed company, if the service might create a self-review threat, meaning the risk that auditors rely on their own firm’s work without evaluating it objectively (paragraph R605.6).
Companies in regulated sectors, such as banking and insurance, should also check their regulator’s requirements.
Five factors to weigh before cost
Risk profile and complexity
Start with the risks that could most affect the company’s objectives. If they are ongoing and operational, such as inventory, procurement or credit control, and you can keep a stable team, an in-house team that sees the business every day is often the better choice. If they call for specialised or periodic work, such as IT system reviews, fraud risk reviews or data analytics, outside specialists may fit better.
Specialist skills
List the skills needed to audit each key risk. Skills the plan needs every year are worth building in-house; skills needed only for particular reviews can be brought in when required. The Standards expect the head of internal audit to strive to ensure that people are appropriate, sufficient and effectively deployed to achieve the approved plan (Standard 10.2).
Continuity and knowledge of the business
In-house teams build knowledge of people, systems and culture over time. Outsourced arrangements need deliberate steps to build and keep that knowledge, such as a stable engagement team, regular meetings with process owners and clear handover files.
Independence and the reporting line
Independence depends on the reporting line in every model. The head of internal audit, whether an employee or a provider, should report directly to the audit committee and have the opportunity to meet it without senior management present (Standard 7.1). Also check for roles that could conflict with internal audit, such as reviewing a process the same person designed or runs.
Stage of growth and listing plans
A growing company may not yet need a full in-house team. A company preparing to list will need an audit committee that can carry out its internal audit duties from the application stage. Co-sourcing can be a practical middle path while the in-house function grows.
Then compare cost
In-house cost is largely fixed: salaries, training and replacing people who leave. Outsourced and co-sourced cost can flex with the audit plan. Compare each option on how well it covers the key risks, not only on price.
Making any model work
Whatever the model, the Standards describe the same governance essentials:
With an outsourced or co-sourced arrangement, also name one person inside the company who owns the relationship and tracks agreed actions to completion.
In summary
There is no single answer for every company. An in-house team suits ongoing operational risks when the company can keep a stable team; outside providers suit specialised or periodic needs; co-sourcing combines the two. Choose the model that gives your board a reliable, independent view of its key risks.
As a next step, map your key risks to the skills needed to audit them, and confirm that internal audit reports directly to the audit committee.
How Kreston Thailand, Risk Advisory Practice can help
Kreston Thailand, Risk Advisory Practice provides partner-led internal audit and risk advisory to listed, pre-IPO and multinational companies in Thailand, whichever internal audit model they choose:
To discuss your internal audit model, contact Dollawat Promchinavongs, Risk Advisory Partner, at dollawat.p@kreston-thailand.com or visit kreston-thailand.com.
Disclaimer
Sources: SET Notification Re: Qualifications and Scope of Work of the Audit Committee B.E. 2558 (2015); SET Regulation on listing in mai B.E. 2563 (2020); IIA Global Internal Audit Standards (2024); IESBA International Code of Ethics for Professional Accountants; Federation of Accounting Professions Code of Ethics handbook B.E. 2566. This article is general information, not professional advice.