The Benefits of Outsourcing the Internal Audit Function  
  When it comes to internal audit, the needs of each organization are unique. Some staff an internal audit department with several dozen professionals, or more, focused on auditing company operations and processes worldwide. Others maintain a small internal audit department with 10 or fewer full-time staff, while many organizations elect to maintain a continuous outsourcing arrangement.Depending on the specific make-up and needs of a company, outsourcing internal audit activities can result in many benefits, including cost savings, higher productivity and ability to access highly experienced internal audit professionals. In this podcast, Protiviti Managing Director Scott Graham talks about these benefits in detail. Scott, based in Dallas, is one of Protiviti’s U.S. Internal Audit leaders. ​  
  To listen now:  
  Launch Audio File
To Download the Audio file:
(Right-click the above link to save file.)
Podcast Transcript:
Kevin Donahue:        Hello. This is Kevin Donahue, senior director with Protiviti, welcoming you to a new installment of Powerful Insights. One of the most daunting challenges a company can face today is undertaking an initial public offering. Once it’s achieved, the event is often celebrated and the organization emits a collective sigh of relief, but then the next daunting question looms: “What’s next?”
                                    Organizations post-IPO can face just as many challenges as those preparing for one — perhaps even more. I’m joined today by Steve Hobbs and Andrea Spinelli from Protiviti, who are going to be talking with me a little bit about the challenges post-IPO organizations face. Steve is a managing director with Protiviti and leader of the firm’s Public Company Transformation practice. Andrea is a director with Protiviti’s Business Performance Improvement Solution. Andrea, thanks for joining me today.
Andrea Spinelli:   Thanks – happy to be here.
Kevin Donahue:        Steve, it’s great to speak with you as well. Let me ask you the first question. What’s it like, exactly, in an organization in the weeks and months following its IPO? In particular, what are some of the unexpected issues and challenges that management begins to recognize?
Steve Hobbs:             Kevin, it’s really an opportunity for many management teams. They need to take a deep breath because they’ve gone through a very extensive effort to get a registration statement, a road show, get everything complete, raise the money from the IPO, and one of the common mistakes is that they think, “Now, we’re public. We’ve accomplished it. The heavy lift is done, and there’s really not a lot more about this transformation that occurs from being a private company to becoming a public company.”

But there’s a realization that happens on Day Two, that they realize that getting public was a difficult task, but they’re going to find that there are a number of other initiatives that they need to increase the maturity of as an organization. For many companies, this could be a significant lift, so that deep breaths probably don’t do much good for them, because there’s an awful lot of work that’s ahead.
Kevin Donahue:        Andrea, you’re following up on Steve’s comments. For management in a newly public company, what should their priorities be in the first year?
Andrea Spinelli:        Kevin, as Steve mentioned, they’re taking these deep breaths now, and what I like to call it is, they’re transitioning from project mode to process mode. So, all those activities that were basically exhausting them — getting ready for the IPO and for the effective date — those are all behind them now. What they really need to think about is how they’re going to design and operate or maybe enhance some processes within the organization. This is going to have some added complexity now that they’re public because there’s an investor community that’s out there that’s going to have increased visibility to the business.
                                    With that visibility, there are going to be certain expectations that management may or may not be prepared to react to in a certain time frame. The key things that come to mind as they’re building, operating or enhancing these processes are, first of all, the financial close and reporting process, from the fact that now you have certain time periods in which you have to follow your financial information. There’s scrutiny on the accuracy of the information, and there’s of course the SEC, which is not flexible at all with either the timing or the accuracy of those items. Similarly, if you think about the compliance aspect of that, well, you don’t have to be Sarbanes-Oxley 404 compliant until much later in the process. You do have to be Sarbanes-Oxley 302 compliant, which means this is a brand-new concept and management has to be ready to certify its financial statements.
                                    So, all of that being said, those are processes that have to be built right away. Those don’t come overnight, but they need to be operating in very short order.
Steve Hobbs:             Kevin, another key thing for an organization would be its ability to forecast its business. That becomes very critical, and it may have spent a lot of effort focused around closing the books and the historical information, but as a public company, the ability to forecast and provide the strict guidance and meet that guidance can be a fairly complicated and difficult process, and often, it’s overlooked when a company is thinking about its IPO readiness.
Kevin Donahue:        Do these principles and guidelines you just described hold true when you’re talking about the next two or three years? For example, one thing that came to mind for me is over the next or within the next three years, SOX 404(b) would likely come into play.
Andrea Spinelli:        That’s correct. So, these processes don’t go away. As well as, some of them might get a little bit deeper, like the SOX 404(b). What becomes important over the next two to three years, though, is that through the first year or two, your organization may have muscled its way through the process. Spending a lot of money, a lot of manual effort, just getting it done because it had to get done, and in that process, you might not have thought about or didn’t have the time to think about how to make the investment for an automated process that is the most efficient.
                                   Where it gets especially tricky here is that people are going to be looking at your cost model now, and they’re going to be looking at things. When I say “people,” I mean your investor community. They will be looking at things like your SG&A as the percentage of your revenues. So, suddenly it becomes very transparent as to how your cost model looks and how your underlying processes may or may not be the most efficient.
Kevin Donahue:        Next, let’s look closer at technology. Steve, this question is for you. Do you find that many organizations post-IPO are still lacking the necessary technology infrastructure to position themselves for long-term growth?
Steve Hobbs:             Kevin, many companies, and rightfully so, they underinvest in their infrastructure, including technology. As a result, we see a lot of manual processes and not very high levels of maturity throughout the organization. As a public company, because of all the demanding compliance and other reporting requirements, you need to be able to use technology to your advantage to make sure that the data that you’re using to manage the business, to report the business and to forecast the business, that data is good. It has high integrity. It’s the opportunity to let technology eliminate a lot of the manual processes that are inefficient, that are unnecessary, in your organization.

There are certainly - when there’s a manual process being followed – risks for errors. So, in today’s technology-savvy world, there is just too much technology that’s out there to enable some of the key processes in the organization. So, certainly, for any company, regardless of the industry, using technology for the underinvestment that you might have made - it’s going to be very critical, and we see that a lot with companies that think about technology as it relates to an IPO in the following way: “Let’s get public, and then we’ll deal with some of these infrastructure and technology issues,” and there are certainly some risks related to that kind of decision.
Kevin Donahue:        Thanks, Steve. I want to point out for our audience that Protiviti has a wealth of information on the IPO process and preparing for becoming a public company, as well as issues to address post-IPO, at protiviti.com/IPO. Andrea, you mentioned a little bit before about finance processes. Let’s dive a little deeper into that. What are some of the typical challenges newly public companies face, and how do they address and overcome those challenges?
Andrea Spinelli:        So, one of the things might be not having a properly aligned operating model for your back office, or your back office service-delivery model – another way of saying it. As a newly public company, hopefully, you’re experiencing the growth that you had forecast, but with that, that growth might be faster or growing disproportionately to the maturity of your back office processes. So, things like not just your financial clause and reporting process, but things throughout your order-to-cash process.

Hopefully, you’ve got some increased customer demand out there, but you have the right process technology and people to be able to process customer orders on a timely basis and move them through the cycle so you’re not only delivering on customer orders but being able to report them. So your investor community sees that as revenue, and then further on through the cycle, being able to bill and collect for those revenues as well. Things like that and the back office become increasingly important as your volume really ramps up.
Kevin Donahue:        We’ve touched on some really interesting issues here, and clearly, there’s a lot for companies to think about. Let me ask one last question of each of you. Steve, I’ll have you respond first. At a high level, what are a few things management must undertake to begin establishing a sustainable business infrastructure?
Steve Hobbs:             I think, Kevin, it’s really the ability of knowing when to begin to think about infrastructure. Many fast-growth companies are certainly focused on customer-facing activities, product development, protecting their intellectual property, which are critical to the business, or you’re not going to have a business. At some point, the management needs to begin to ask the questions “What about the supporting infrastructure?” and “What do I need in order to scale the business?” and then “To what extent can these processes, the manual processes, the infrastructure, at some point impede my ability to grow?” So, really, having management think about as part of their strategy, “When do we make investments on infrastructure?” “What are the key areas that we need to make those investments?” and certainly, “When do we make those?” I think having those discussions earlier rather than later is helpful.

For a company that’s anticipating an IPO to become a public company, the management awareness and discussion and planning is actually going to be more crucial because, as a public company, you don’t want to find yourself on Day Two having ignored the infrastructure and what it means to support not only the ongoing business but the complexities associated with being a public company; you certainly wouldn’t want to wait until after you’ve gone public to begin thinking about infrastructure. So, we recommend that companies think as much as 12 to 18 months before they consider becoming public and prioritize and clearly identify “What are these top infrastructure issues?” and then make a meaningful decision collaborating with the board on “Where do we spend the money as it relates to infrastructure?”
Andrea Spinelli:        Following on what Steve mentioned is, as you’re thinking very early on about what that infrastructure needs to be, don’t underestimate the level of effort or resources or technology that are required, because odds are, once things actually – once you actually become effective – things might look a little bit different than they did in the beginning, than they did when you were first planning. So, don’t underestimate what it’s going to take. Also, specifically, when you’re thinking about the people side of the resources needed, really think about what is the right blend of legacy talent throughout your organizations as well as the new skills that are required – and I’m not just talking about the C-Suite positions. I’m thinking about the in-the-trenches positions, the very transaction-heavy positions, making sure you have that right blend of the old and the new, so you can keep things running smoothly while bringing it up to the next level.
Kevin Donahue:        Steve, Andrea, I want to thank you very much for joining me today to discuss some of the post-IPO challenges organizations face. Again, for those of our audience interested in additional information, you can visit protiviti.com/IPO, where we have a wealth of information available, including Protiviti’s resource guide, “Guide to Public Company Transformation.”