Stay connected: follow us on LinkedIn and explore more at
www.CherryHillAdvisory.com.
.svg)
Subscribe now to join the Risk Register community:
Most internal audit co-sourcing conversations start in the wrong place. They start as a headcount request, and they end with a number that was never going to clear the budget committee in a year like this one.
The better version of the conversation isn't about how many people you have. It's about what your function can credibly cover, and that's a capability question, not a capacity one.
The profession is being asked to cover more ground with fewer resources. That isn't a headline. It's an operating reality, and it changes what the honest answer to a coverage gap looks like.
The data comes first, because it explains why the old answer stopped working.
The numbers in the 2026 North American Pulse of Internal Audit are hard to argue with. The share of functions reporting budget cuts nearly doubled between 2024 and 2025, rising from 11% to 19%.
Those aren't marginal shifts. That's a reversal, and the share reporting budget increases fell over the same period, from 34% to 23%.
Staffing followed the same line. Functions reporting staff reductions rose from 11% to 18%, and among privately held organizations that figure reached 28%. Financial services was the only sector holding steady.
Privately held organizations took the worst of it on both measures, which matters if that describes you, because it means the peer comparisons you're working from may be more optimistic than your own situation.
Set that against a risk mandate that keeps expanding into AI governance, third-party risk, and cyber, and you get a compounding problem with no obvious release valve. The gap between what internal audit needs to cover and what it can cover isn't going to close through hiring alone. The math doesn't support it.
Which brings us to the decision most CAEs are actually facing, which isn't whether to add resources but what kind of capability to add.
Nothing here argues against hiring. A permanent seat is the correct call when the work is continuous, when it sits at the center of the audit plan every single year, and when the skill involved is one the function should own outright.
Core financial and operational auditing fits that description. So does the day-to-day running of the plan. If a body of work will exist at roughly the same volume in three years, and you'd rather the knowledge lived in-house, hire for it. A permanent hire compounds: they learn the business, build relationships with process owners, and get faster every cycle. Hiring is also the right answer when the function needs a small, talented core whose job is to build those relationships inside the business over years. A good co-sourced provider can do that well too, but the durable version is a hybrid: a permanent core that owns the relationships, with rented depth around it.
The trouble starts when a specialist need gets treated the same way. The question then becomes whether the work is genuinely recurring, or whether it just feels urgent right now.
Think of specialist expertise as something you rent rather than buy. Renting it for a specific engagement keeps the function flexible as the risk areas shift, and they will shift. Buying it, in the form of a full-time hire, locks you into a fixed skill set and a salary you carry whether the need comes back next year or not.
Selective co-sourcing is the renting model: outside specialists for technical areas like cybersecurity, SOX testing, or data analytics, brought in for specific engagements rather than as a larger permanent function. It also sidesteps a trap. A single hire can't cover AI governance, cyber, third-party risk, and fraud analytics at any real depth. Hiring one generalist for four specialist domains produces exactly the failure mode worth avoiding: coverage a mile wide and an inch deep, spread across many areas without the rigor to add meaningful assurance in any of them.
Skill gaps are a solvable problem. An internal audit function shouldn't avoid a key organizational risk just because the team doesn't feel it has the right skill sets, because there are multiple levers available: training, specialists, co-sourcing. Ignoring the risk isn't acceptable.
That decision about which lever to pull determines what you should be buying, so it's worth being precise about what co-sourcing actually is.
These three get blended constantly, and the blending is why some engagements disappoint.
Staff augmentation sends bodies in to clear a backlog. Handing the function off entirely means the work and the judgment both leave the building. Co-sourcing does neither. It scales up when the audit plan is heavy and scales back down when it isn't, while the internal team stays in the center of every engagement and retains ownership of the findings and the relationship with the business.
Full stop: if the internal team isn't still holding the pen on the findings, it isn't co-sourcing.
That distinction has a practical test attached to it, which is the next question worth asking of any partner.
Done right, co-sourcing feels like an extension of your team that flexes with the plan. Done wrong, it's an expensive contract that produces a deliverable and changes nothing.
The phrase worth holding onto is capability building, not gap filling. Effective co-sourcing leaves the internal team able to run a similar audit more independently next time. Staff augmentation dressed up as co-sourcing fills a backlog and leaves nothing behind except the report.
That's a question you can ask directly during selection. What will my team be able to do at the end of this engagement that they couldn't do at the start? A partner who can't answer it concretely is selling you the other thing. And once you know what to ask, the remaining question is where the model actually fits.
Most co-sourcing conversations fail because the engagement was never matched to a specific type of work before scoping began. There are four categories where it consistently pays off.
The first is co-sourced internal audits, where the internal team leads but lacks the depth to deliver alone. The second is SOX compliance, particularly where generative AI in the close or model-based estimates are creating exposure the existing control set wasn't built for. The third is fraud risk assessments and investigations, where AI-assisted impersonation and synthetic identity threats call for updated testing. The fourth is audit management office and quality management office services, covering the program management layer that strained teams can't run while also delivering the audits.
If a coverage gap doesn't map to one of those four, that's useful information. It may be a prioritization problem rather than a resourcing one, which brings us to the budget conversation itself.
The reframe that makes the next budget conversation easier is this. The question isn't whether you have enough money. The question is whether you're directing what you have toward the work that matters most to the organization.
That means sharpening the risk assessment to focus on the highest-priority areas, and rethinking methodology to get more out of what already exists. If you can't answer the prioritization question with precision, your next budget conversation will be harder than this one.
Co-sourcing fits inside that answer rather than replacing it. It's the mechanism that lets a smaller function put senior judgment on the hardest parts of the plan, rented for the engagement rather than carried on payroll all year.
The decision comes down to three things: whether the work recurs, how deep the specialty runs, and whether you want the capability to live in-house afterwards. Recurring plus general plus yes points to a hire. Episodic plus specialist points to a partner. Most functions need both, in a deliberate mix rather than by accident.
The pressure in the Pulse data isn't going to reverse next year, and the risk mandate isn't going to shrink. Functions that come through this well are the ones making the choice on purpose, with the most flexible model and the most senior judgment aimed at the hardest parts of the plan.
If you're working through where that line sits for your function, our internal audit co-sourcing engagements are built around exactly that question, and we've written before about making the case to your audit committee once you've landed on the answer.
Reach out and we'll work through the mix with you.
Until next time.
Subscribe now to join the Risk Register community:
.jpeg)