Co-sourcing (internal audit)
A model in which internal audit is performed by a combination of internal staff and external audit partners, focused on knowledge transfer. This differs from full outsourcing and from fully in-house delivery.
Source: IIA GIAS 2024, IIA Practice Advisories
Co-sourcing (internal audit) is a model in which the internal audit function is delivered by a combination of in-house staff and external audit partners, with knowledge transfer as the guiding principle. The function's own team performs the work and keeps control, while external specialists step in selectively where specific expertise or capacity is lacking. This distinguishes co-sourcing from outsourcing, where the work is placed fully with an external party, and from fully in-house delivery, where no external support is used.
For the board, the supervisory board and the audit committee, co-sourcing is a way to add depth and flexibility without handing over the function. The organisation retains ultimate responsibility and the Chief Audit Executive (CAE) stays at the helm, while peak workloads, scarce expertise or specialist topics are absorbed. The audit committee thereby gains access to broader knowledge than a small function could keep in-house, without losing the continuity and learning capacity of its own team.
In practice, co-sourcing is arranged per topic or engagement. External specialists are deployed for areas such as IT audit, fraud, data-driven work or sector-specific regulation, working side by side with the internal team. The knowledge transfer is explicit: the internal team demonstrably builds expertise, so that reliance on external support decreases over time. The arrangement is shaped as an assignment relationship within the frameworks of the Dutch DBA Act (Wet DBA) 2026, with clear agreements on role, direction and responsibility.
ONE Risk Advisory provides senior auditors on assignment, within the frameworks of the Dutch DBA Act (Wet DBA) 2026, without taking over the function. We strengthen the organisation's own internal audit function in a targeted way, transfer knowledge and keep direction firmly with the organisation. In this way the function gains capability while building durable in-house expertise.
Last updated:
Related service Internal Audit Support
Frequently asked questions
What is the difference between co-sourcing and outsourcing?
In co-sourcing the organisation's own internal audit function performs the work with targeted external support and keeps control. In outsourcing the audit work is placed fully with an external party. Co-sourcing is about strengthening and knowledge transfer, not taking over.
Does the organisation keep control under co-sourcing?
Yes. The Chief Audit Executive (CAE) remains responsible and directs the work; external specialists support within that framework. Ultimate responsibility stays firmly with the organisation and its audit committee.
How does co-sourcing relate to the Dutch DBA Act 2026?
The arrangement is shaped as an assignment relationship with clear agreements on role, direction and responsibility, within the frameworks of the Dutch DBA Act (Wet DBA) 2026. ONE Risk Advisory provides senior auditors on assignment and deliberately avoids the term secondment.
When is co-sourcing a sensible choice?
During peak workloads, for scarce or specialist expertise such as IT audit or fraud, or when a small function wants to add depth without permanent expansion. Co-sourcing offers flexibility while building in-house knowledge at the same time.