Co-Sourcing vs. Outsourcing Internal Audit: Decision Framework and Real Costs

Co-source when you have an internal audit function and need to extend it without giving up control. Outsource when you have no function, need full independence, or audit is not a capability you intend to build. The distinction drives every downstream decision: cost, knowledge retention, and what you can actually ask for in the engagement.

Most explainers on this topic stop at definitions. They leave out the numbers because the firms writing them benefit from the opacity. Here is the framework and the real costs, side by side.

The decision framework in one table

Dimension	In-House	Co-Sourced	Fully Outsourced
Who does the work	Your employees	Your team plus an external partner	An external firm, start to finish
Who keeps control	You	You: CAE owns the plan and sign-off	Provider runs it; you receive reports
Independence	Lowest	High	Highest
Knowledge retention	Stays in-house	Transfers to your team during the engagement	Leaves with the provider
Specialist access	Limited to who you hired	On demand, per engagement	Broad, but generic
Cost structure	Fixed: salaries, benefits, tools, training year-round	Variable: pay for hours and skills you use	Variable, but priced at full-service premium
Speed to deploy	Slow (hire, onboard, train)	Fast (partner staffs in weeks)	Fast
Typical cost relative to in-house	Baseline	40-60% below Big 4 rates when using AI-delivered co-sourcing; comparable to mid-tier when using traditional staffing	Big 4 full-outsource is 2-3x in-house loaded cost; mid-tier 1.2-1.5x
Best fit	Mature function, predictable workload	Established function needing surge capacity or niche skills	No function, or deliberate choice to keep audit external
Main risk	Paying for 100% capacity used seasonally	Coordination overhead if roles are unclear	Loss of institutional knowledge and culture fit

What each model actually costs

This is the section incumbent advisory firms leave out of their explainers. Here are the real numbers.

In-house: The visible cost is salary. The loaded cost is 1.25-1.4x salary (benefits, employer tax, tooling, training, management overhead). A team of three mid-level auditors in a Western European market runs EUR 250,000-350,000 loaded annually before any technology spend. You pay for 100% capacity year-round and use it at 60-70% of that during off-peak periods.

Traditional co-sourcing (Big 4): Blended billing rates of EUR 180-280/hour. A typical co-sourced engagement (300-400 hours) runs EUR 60,000-100,000 before expenses. The structural problem: work delivered by staff two grades below the partner or director who signs the engagement letter. You pay senior rates for junior execution.

Traditional co-sourcing (mid-tier / boutique): EUR 90-160/hour blended. Meaningfully cheaper; trade-off is narrower specialist coverage and less brand authority with the board.

AI-delivered audit (AaaS): 40-60% below Big 4 co-sourcing rates because the work is performed by production AI systems with auditors in governance roles, not by junior staff billed at senior rates. The 50%+ audit cycle time reduction and 3-5x coverage increase come from applying AI to evidence collection, control testing, and workpaper production: the three tasks that consume the most hours in a traditional engagement. Pricing is typically subscription or per-audit-cycle, not hourly.

Full outsourcing (Big 4): The most expensive model. You are buying the firm's brand, liability acceptance, and regulatory familiarity, not just hours. For a $10B company, a fully outsourced Big 4 internal audit can run EUR 800,000-1,500,000 annually depending on scope and regulatory complexity.

When the IIA data says sourcing happens

Sourcing is now the norm, not the exception. Around 60% of internal audit functions use some form of outsourcing or co-sourcing, up from 54% in 2022, according to the IIA's 2024 North American Pulse of Internal Audit. The split by size is the part worth noticing: the largest functions source the most (around 74%), while the smallest source about 32%. Large, mature functions co-source surgically because they have the in-house team to maintain control and use partners for the work they cannot or should not staff full-time. The most commonly sourced areas are cybersecurity, IT, and regulatory compliance: specialized, fast-moving, and expensive to keep on the payroll.

The signal: co-sourcing is what experienced functions do once they stop trying to hire for every skill they need twice a year.

When to choose each model

Choose in-house when audit is a core, year-round capability, your workload is predictable, and independence is manageable through reporting lines. Keep it in-house, and make it efficient. That means tooling, not headcount.

Choose co-sourcing when you have a functioning team and need to: cover a specialist area (a cybersecurity audit, a regulatory review, a third-party risk engagement); absorb a busy-season spike without permanent headcount; or bring an independent perspective into an engagement while keeping the CAE in control. This is the right answer for most established functions.

Choose full outsourcing when you have no internal audit function and no plan to build one, when a regulator or the board requires maximum independence, or when audit is deliberately not a capability you want to own. The trade: you gain independence and lose institutional knowledge.

Three signals you have outgrown your current model: you are declining audits because you cannot staff them; you are paying premium rates for routine testing a system could perform; your coverage has not grown in three years while your risk universe has. Any one of those is a sourcing conversation.

The fourth column: audit performed, not staffed

Co-sourcing and outsourcing both answer the same question (who supplies the people) and both still bill by the hour. Audit as a service changes the question. Instead of renting auditors, you get the audit performed: evidence collected from source systems, controls tested across the full population rather than a sample, and findings produced on a subscription, with auditors governing the work rather than grinding through it.

That is the model behind assureIQ. It keeps the control advantage of co-sourcing (your function owns the plan and the sign-off) while removing the hourly-billing ceiling that makes both traditional models expensive. For functions weighing co-sourcing against outsourcing, price it as a third quote. It is usually the one the incumbents hoped you would not ask for.

For a full cost breakdown across all four models with sourced rates, see our Internal Audit Sourcing Cost Reference and Internal Audit Engagement Benchmarks.

Co-Sourcing vs. Outsourcing Internal Audit: Decision Framework and Real Costs

Written by:

Editorial Team

The decision framework in one table

What each model actually costs

When the IIA data says sourcing happens

When to choose each model

The fourth column: audit performed, not staffed

Related

Suggested Reading

A Practical Guide to Enterprise Fleet Maintenance Management

A Guide to the Dynamic Resource Scheduler for Unlocking Cloud Efficiency

What Is Third Party Risk Management and Why It Matters