This practical guide presents companies offering internal audit co-sourcing services in London, with a focus on the types of support, expertise and client needs they cover. It is designed as an overview rather than ranking companies against one another. The selection includes large companies with broad risk, governance and technology capabilities alongside narrower specialists focused on specific sectors or areas of internal assurance. Each profile gives context on the company, the organisations it typically supports and the strengths most relevant to internal audit co-sourcing. The aim is to make comparison easier and help readers identify companies that fit their own audit structure, risk profile and business requirements.
Acumon
Acumon is a UK firm of chartered accountants and registered auditors providing internal audit, risk, and technology assurance services to companies, charities, public sector bodies, and regulated organisations.
The firm provides internal audit through fully outsourced, co-sourced, and focused review arrangements. For organisations with an existing internal audit function, co-sourcing allows Acumon to work alongside the in-house team, adding capacity during periods of higher workload or providing specialist expertise for audits that require skills not maintained internally.
Co-sourced engagements can be delivered under the organisation’s existing internal audit methodology and under the direction of its Head of Internal Audit. Acumon can take responsibility for complete individual reviews or provide specialists within audits led by the internal team. This allows organisations to retain ownership of stakeholder relationships, institutional knowledge, and the wider audit plan while filling specific capability gaps.
The Risk & Tech Assurance practice extends beyond traditional financial controls. Specialist support is available for IT audit, cyber security, fraud risk, governance, regulatory matters, and other areas that may sit within a modern internal audit universe. This can be particularly relevant where an audit committee expects coverage of risks that require technical or sector-specific knowledge.
Acumon works across corporate and commercial organisations, financial services, public sector bodies, education, charities, and not-for-profit organisations. Internal audit work is structured around risk-based planning, clear reporting of findings, agreed management actions, and follow-up through to closure.
For organisations in London, co-sourcing can be used where an established internal audit team needs additional resource without permanently expanding headcount. It can also support businesses preparing for regulatory scrutiny, strengthening governance arrangements, reviewing control weaknesses, or broadening the scope of an existing assurance programme.
Internal Audit Co-Sourcing Capabilities
Acumon provides co-sourced internal audit support across a range of risk and assurance requirements.
These include:
- Risk-Based Internal Audit Reviews
- Additional Capacity for Internal Audit Plans
- Specialist IT and Technology Audits
- Fraud and Financial Controls Reviews
- Governance and Regulatory Assurance
- Ad-Hoc Reviews Following Control or Risk Events
Co-sourced work can be delivered as complete audits or through specialists embedded within engagements managed by the organisation’s own internal audit team.
Regulatory Licences and Registrations
Acumon operates as a regulated UK accountancy and audit practice, with professional registrations supporting its wider audit and assurance work.
These include:
- ICAEW Chartered Accountancy Registration
- UK Statutory Audit Registration
- Public Interest Entity Audit Capability
- Chartered Internal Audit Expertise Within the Risk & Tech Assurance Practice
The internal audit practice is led by a Chartered Member of the Institute of Internal Auditors, while Acumon is registered to carry out audit work in the UK by ICAEW.
Core Services
In addition to internal audit co-sourcing, Acumon provides services covering internal assurance, risk, governance, and technology.
These include:
- Internal Audit Outsourcing
- Internal Audit Advisory and Ad-Hoc Reviews
- Risk Management Audit and Advisory
- Corporate Governance Reviews
- IT Risk Audit and Assurance
- Cyber Security Audit
- Anti-Fraud Services
- Financial Controls Reviews
The broader model allows internal audit teams to draw on different specialists without sourcing a separate company for each technical review. Acumon’s Risk & Tech Assurance practice covers areas including internal controls, cyber risk, data protection, business continuity, fraud, and governance.
Organisations may use co-sourcing when they are:
- Expanding the Scope of an Existing Internal Audit Plan
- Experiencing Temporary Internal Audit Capacity Constraints
- Reviewing Technology or Cyber Risks
- Preparing for Increased Regulatory Scrutiny
- Strengthening Governance and Internal Controls
- Requiring Specialist Expertise for Individual Audits
The arrangement allows the existing internal audit function to remain in control of its programme while external specialists provide additional assurance where required.
Contact Information
- Website: acumon.com
- Phone: 020 8567 3451
- Email: [email protected]
- Address: 1-2 Craven Road, Ealing, London, W5 2UA, UK
Grant Thornton UK
Grant Thornton provides internal audit services through co-source, outsource and temporary resource models. Its co-sourcing work is designed for organisations that already operate an internal audit function but need additional auditors, specialist knowledge or support completing parts of the annual plan.
The firm can provide individual audit professionals through to complete teams responsible for particular reviews. Specialist input covers areas including technology, financial services regulation, cyber risk and other emerging risks, while its internal audit practice also carries out external quality assessments.
Key Facts
- Ideal for: Established internal audit teams needing scalable resource or specialist support
- Core services: Internal audit co-sourcing, outsourcing, loan staff, EQAs
- Specialization: Risk-based internal audit and specialist assurance
- Client types: Corporate, financial services and public sector organisations
- Location: London, UK
Contact Information
- Website: www.grantthornton.co.uk
- Phone: +44 (0)20 7383 5100
- Address: 8 Finsbury Circus, London, EC2M 7EA
- LinkedIn: www.linkedin.com/company/grant-thornton-uk
- Instagram: www.instagram.com/gt_trainees
BDO UK
BDO provides co-sourced and outsourced internal audit services through its risk and advisory teams. The model is relevant to organisations that want to keep internal leadership of the function while obtaining external auditors for specific business units, technical subjects or periods of higher workload.
Its London-based specialists work across financial and operational risk, governance, technology, regulatory matters and internal controls. BDO’s financial services practice has particular experience with internal audit arrangements for banks, insurers, investment businesses and other regulated organisations, while its wider risk teams work with corporate groups across several sectors.
Key Facts
- Ideal for: In-house teams requiring specialist or additional audit resources
- Core services: Internal audit co-source, outsource, quality assurance, controls reviews
- Specialization: Financial services, operational risk and digital risk
- Capabilities: Technology risk, governance, regulatory assurance and internal controls
- Location: London, UK
Contact Information
- Website: www.bdo.co.uk
- Phone: 020 7486 5888
- Address: 55 Baker Street London, W1U 7EU, United Kingdom
- LinkedIn: www.linkedin.com/company/bdo-llp
- Instagram: www.instagram.com/bdo_uk
PKF Littlejohn
PKF Littlejohn’s Governance, Risk & Control Assurance team delivers second-line and third-line assurance work, with internal audit offered through both fully outsourced and co-sourced models. The co-source model brings the firm’s market and subject matter specialists into existing internal audit teams without transferring overall ownership of the function.
The practice has a strong focus on financial services, including insurance businesses and other regulated organisations. Its specialists can support complete internal audits or contribute technical expertise to planning, fieldwork and reporting for particular regulatory or operational topics.
Key Facts
- Ideal for: Regulated businesses with an established internal audit function
- Core services: Internal audit co-sourcing, outsourcing, governance and controls assurance
- Specialization: Financial services risk and regulation
- Capabilities: Specialist audit reviews, governance, regulatory assurance
- Location: London, UK
Contact Information
- Website: www.pkf-l.com
- Phone: +44 (0)20 7516 2200
- Email: [email protected]
- Address: 30 Churchill Place, London, E14 5RE
- LinkedIn: www.linkedin.com/company/littlejohn
- Twitter: x.com/PKF_Littlejohn
- Instagram: www.instagram.com/pkf.littlejohn
Forvis Mazars
Forvis Mazars provides internal audit through risk consulting and specialist assurance teams. Co-sourcing can range from additional professionals working alongside an established internal audit department to external teams taking responsibility for selected audits within the client’s wider programme.
The UK practice has dedicated capability in areas such as technology, cyber security, financial crime, regulatory compliance, prudential risk and operational resilience. Sector-specific internal audit teams cover financial services as well as corporate, public and not-for-profit organisations. The firm can therefore be relevant where the main purpose of co-sourcing is access to specialist knowledge rather than simply increasing audit headcount.
Key Facts
- Ideal for: Complex organisations requiring multidisciplinary audit support
- Core services: Internal audit co-source, outsource, specialist reviews, EQAs
- Specialization: Governance, technology and regulated-sector assurance
- Industries: Financial services, corporate, public and social sectors
- Location: London, UK
Contact Information
- Website: www.forvismazars.com
- Phone: +44 (0) 20 7063 4000
- Address: 30 Old Bailey, London, EC4M 7AU, United Kingdom
- LinkedIn: www.linkedin.com/company/forvis-mazars-in-the-uk
- Twitter: x.com/ForvisMazarsUK
- Instagram: www.instagram.com/forvismazarsuk
Deloitte UK
Deloitte offers specific co-source internal audit support alongside full internal audit outsourcing and advisory services. Under a co-sourced arrangement, its professionals can augment an existing project team, take end-to-end responsibility for individual audits or provide specialists for longer assignments within the internal function.
Its subject matter coverage includes technology and cyber risk, digital systems, data protection, third-party risk, organisational culture and other operational and strategic areas. This model is particularly suited to large internal audit functions that need access to specialists without maintaining every technical discipline internally.
Key Facts
- Ideal for: Large or complex internal audit functions requiring specialist capability
- Core services: Internal audit co-sourcing, outsourcing, staff augmentation, advisory
- Specialization: Multidisciplinary risk and controls assurance
- Capabilities: Technology, cyber, digital risk, third-party risk and governance
- Location: London, UK
Contact Information
- Website: www.deloitte.com
- Phone: +44 (0)20 7936 3000
- Address: 1 New Street Square, London, EC4A 3HQ, United Kingdom
- LinkedIn: www.linkedin.com/company/deloitte
- Facebook: www.facebook.com/deloitteuk
- Twitter: x.com/deloitteuk
- Instagram: www.instagram.com/deloitte_uk
KPMG UK
KPMG provides internal audit co-sourcing as part of its wider risk and regulatory consulting practice. Organisations can use external resources to supplement their internal function while retaining responsibility for audit leadership, planning and governance.
Its services span internal audit strategy, operating model design, risk assessment, audit execution, continuous assurance and quality reviews. Specialist teams can contribute to financial, operational, regulatory, technology and conduct risk audits, making the model applicable where internal teams need either extra delivery capacity or expertise in a defined risk area.
Key Facts
- Ideal for: Organisations needing broad specialist access alongside an internal audit team
- Core services: Internal audit co-sourcing, outsourcing, risk-based audits, EQAs
- Specialization: Risk, regulation and internal controls
- Capabilities: Audit planning, execution, transformation and continuous assurance
- Location: London, UK
Contact Information
- Website: kpmg.com
- Phone: +44 (0)20 7311 1000
- Address: 15 Canada Square, Canary Wharf, London, E14 5GL
- Facebook: www.facebook.com/KPMG
- LinkedIn: www.linkedin.com/company/kpmg-uk
- Twitter: x.com/kpmguk
EY
EY provides internal audit co-source and managed service arrangements for organisations seeking to expand or change their existing assurance capabilities. Its teams can assist with the execution of audit plans while the organisation retains an internal audit function and overall responsibility for its mandate.
Support includes risk assessment, scoping, audit programme design, technology-enabled testing and specialist audits covering areas such as cyber security, ESG, transactions, culture and strategy. EY also works on internal audit transformation, technology strategy and maturity assessments, so co-sourcing can be combined with broader changes to how an internal audit function operates.
Key Facts
- Ideal for: Large internal audit functions undergoing expansion or transformation
- Core services: IA co-source, managed services, outsourcing, advisory
- Specialization: Internal audit transformation and technology-enabled assurance
- Capabilities: Specialist audits, analytics, controls testing and EQA work
- Location: London, UK
Contact Information
- Website: www.ey.com
- Phone: +44 20 7951 2000
- Address: 1 More London Place, London SE1 2AF
- LinkedIn: www.linkedin.com/company/ernstandyoung
- Facebook: www.facebook.com/EY
- Twitter: x.com/EYnews
Protiviti
Protiviti is a risk consulting company with a dedicated Internal Audit and Financial Advisory practice in London. Its strategic sourcing services cover internal audit co-sourcing, staff augmentation, full outsourcing and alternative delivery models.
Co-sourcing can be used to increase audit capacity or bring operational, technology, compliance and sector expertise into an established team. Protiviti also works on internal audit transformation, methodology and technology, which may be relevant to organisations looking to change the function while continuing delivery of the existing audit plan.
Key Facts
- Ideal for: Internal audit functions needing flexible specialist resources
- Core services: Internal audit co-sourcing, staff augmentation, full outsourcing
- Specialization: Internal audit and financial advisory
- Capabilities: Technology, compliance, controls and operational risk
- Location: London, UK
Contact Information
- Website: www.protiviti.com
- Phone: +44.20.7930.8808
- Address: The Shard, 32 London Bridge Street, London, SE1 9SG, United Kingdom
- LinkedIn: www.linkedin.com/company/protiviti-uk-
- Facebook: www.facebook.com/Protiviti
- Twitter: x.com/ProtivitiUK
- Instagram: www.instagram.com/protiviti.uk
Crowe UK
Crowe UK provides internal audit and specialist assurance through outsourced and co-sourced delivery models. In co-sourced arrangements, its teams generally work alongside an internal Head of Risk or Head of Internal Audit, taking responsibility for complete reviews or providing subject matter specialists for selected stages of an audit.
The practice covers governance, technology risk, financial services and other areas requiring specialist assurance. Crowe also provides external quality assessments and support for organisations establishing or restructuring internal audit functions.
Key Facts
- Ideal for: Organisations retaining an internal Head of Audit or Risk
- Core services: Co-sourced internal audit, outsourcing, specialist assurance, EQAs
- Specialization: Risk, governance and internal assurance
- Industries: Financial services, pensions and other corporate sectors
- Location: London, UK
Contact Information
- Website: www.crowe.com
- Phone: +44 (0)20 7842 7100
- Address: 55 Ludgate Hill, London, EC4M 7JW
- LinkedIn: www.linkedin.com/company/crowe-uk
- Twitter: x.com/CroweUK
- Instagram: www.instagram.com/crowe_uk
RSM UK
RSM provides internal audit and risk assurance support to organisations across regulated and commercial sectors. Its co-sourcing capability is particularly visible in financial services, where specialist internal auditors can contribute technical reviews while the client’s internal audit function maintains responsibility for the broader audit programme.
Support can cover regulatory requirements, prudential risk, governance and controls alongside other assurance topics. This makes the company relevant where internal audit teams need technical expertise for a particular part of their risk universe rather than a replacement for the complete function.
Key Facts
- Ideal for: Financial services and regulated organisations
- Core services: Internal audit support, co-sourced reviews, risk assurance
- Specialization: Financial services risk and regulation
- Capabilities: Prudential assurance, governance and technical reviews
- Location: London and UK-wide
Contact Information
- Website: www.rsmuk.com
- Phone: +44 (0)20 3201 8000
- Address: 25 Farringdon Street, London, EC4A 4AB
- LinkedIn: www.linkedin.com/company/rsm-uk
- Instagram: www.instagram.com/rsm.uk
PwC UK
PwC’s UK internal audit practice offers outsource, co-source, managed service and advisory delivery models. Its co-sourcing services can assist organisations with planning and executing elements of their internal audit programme while maintaining an existing internal function.
The scope ranges from risk assessment and individual audit execution to specialist work in cyber security, ESG, transactions, HR, culture and strategy. PwC also provides internal audit technology, analytics, maturity evaluations and transformation support, which allows organisations to combine additional delivery capacity with changes to methodology or operating models.
Key Facts
- Ideal for: Large or international internal audit functions
- Core services: Internal audit co-source, outsource, managed services, advisory
- Specialization: Technology-enabled and multidisciplinary internal audit
- Capabilities: Specialist audits, analytics, transformation and maturity reviews
- Location: London, UK
Contact Information
- Website: www.pwc.co.uk
- Phone: +44 (0)20 7583 5000
- Address: 1 Embankment Place, London, WC2N 6RH, United Kingdom
- LinkedIn: www.linkedin.com/company/pwc-uk
- Facebook: www.facebook.com/PwCUK
- Instagram: www.instagram.com/pwc_uk
McMillan Woods Audits
McMillan Woods Audits provides both fully outsourced and co-sourced internal audit arrangements. Its co-sourced service is positioned as additional support for organisations that already maintain an internal audit function but have gaps in capacity or technical knowledge.
The firm uses a risk-based approach covering financial, operational and governance risks. Compared with the large multidisciplinary consultancies in this guide, its proposition is more closely centred on core internal audit and controls assurance, which may suit organisations seeking a conventional accountancy-led co-sourcing arrangement.
Key Facts
- Ideal for: Organisations seeking additional internal audit resource
- Core services: Co-sourced and outsourced internal audit
- Specialization: Risk-based internal audit
- Capabilities: Financial, operational and governance risk reviews
- Location: London, UK
Contact Information
- Website: www.mcmillanwoodsaudits.co.uk
- Phone: 020 3835 4488
- Email: [email protected]
- Address: 42-44 Bishopsgate, London EC2N 4AH, United Kingdom
Conclusion
Choosing among internal audit co-sourcing companies in London depends on business size, sector, process maturity and the regulatory environment in which the organisation operates. Some companies combine internal audit with wider risk, technology, governance and compliance expertise, while others concentrate on a narrower range of assurance work or particular industries. The right fit also depends on whether the need is additional audit capacity, access to specialist skills or ongoing support for an established internal audit function. This guide is intended to provide neutral context for comparing those differences rather than presenting one company as the default choice. A suitable partner should provide independent assurance together with practical recommendations that reduce risk exposure and strengthen organisational resilience.