Internal Audit Co-Sourcing Companies in London: Firms and Services Guide (2026)
AC
Acumon Chartered Accountants·12 min read
This practical guide presents companies offering internal audit co-sourcing services in London, with a focus on the types of support, expertise and client needs they cover. It is designed as an overview rather than ranking companies against one another. The selection includes large companies with broad risk, governance and technology capabilities alongside narrower specialists focused on specific sectors or areas of internal assurance. Each profile gives context on the company, the organisations it typically supports and the strengths most relevant to internal audit co-sourcing. The aim is to make comparison easier and help readers identify companies that fit their own audit structure, risk profile and business requirements.
Acumon
Acumon is a UK firm of chartered accountants and registered auditors providing internal audit, risk, and technology assurance services to companies, charities, public sector bodies, and regulated organisations.
The firm provides internal audit through fully outsourced, co-sourced, and focused review arrangements. For organisations with an existing internal audit function, co-sourcing allows Acumon to work alongside the in-house team, adding capacity during periods of higher workload or providing specialist expertise for audits that require skills not maintained internally.
Co-sourced engagements can be delivered under the organisation’s existing internal audit methodology and under the direction of its Head of Internal Audit. Acumon can take responsibility for complete individual reviews or provide specialists within audits led by the internal team. This allows organisations to retain ownership of stakeholder relationships, institutional knowledge, and the wider audit plan while filling specific capability gaps.
The Risk & Tech Assurance practice extends beyond traditional financial controls. Specialist support is available for IT audit, cyber security, fraud risk, governance, regulatory matters, and other areas that may sit within a modern internal audit universe. This can be particularly relevant where an audit committee expects coverage of risks that require technical or sector-specific knowledge.
Acumon works across corporate and commercial organisations, financial services, public sector bodies, education, charities, and not-for-profit organisations. Internal audit work is structured around risk-based planning, clear reporting of findings, agreed management actions, and follow-up through to closure.
For organisations in London, co-sourcing can be used where an established internal audit team needs additional resource without permanently expanding headcount. It can also support businesses preparing for regulatory scrutiny, strengthening governance arrangements, reviewing control weaknesses, or broadening the scope of an existing assurance programme.
Internal Audit Co-Sourcing Capabilities
Acumon provides co-sourced internal audit support across a range of risk and assurance requirements.
These include:
Risk-Based Internal Audit Reviews
Additional Capacity for Internal Audit Plans
Specialist IT and Technology Audits
Fraud and Financial Controls Reviews
Governance and Regulatory Assurance
Ad-Hoc Reviews Following Control or Risk Events
Co-sourced work can be delivered as complete audits or through specialists embedded within engagements managed by the organisation’s own internal audit team.
Regulatory Licences and Registrations
Acumon operates as a regulated UK accountancy and audit practice, with professional registrations supporting its wider audit and assurance work.
These include:
ICAEW Chartered Accountancy Registration
UK Statutory Audit Registration
Public Interest Entity Audit Capability
Chartered Internal Audit Expertise Within the Risk & Tech Assurance Practice
The internal audit practice is led by a Chartered Member of the Institute of Internal Auditors, while Acumon is registered to carry out audit work in the UK by ICAEW.
Core Services
In addition to internal audit co-sourcing, Acumon provides services covering internal assurance, risk, governance, and technology.
These include:
Internal Audit Outsourcing
Internal Audit Advisory and Ad-Hoc Reviews
Risk Management Audit and Advisory
Corporate Governance Reviews
IT Risk Audit and Assurance
Cyber Security Audit
Anti-Fraud Services
Financial Controls Reviews
The broader model allows internal audit teams to draw on different specialists without sourcing a separate company for each technical review. Acumon’s Risk & Tech Assurance practice covers areas including internal controls, cyber risk, data protection, business continuity, fraud, and governance.
Organisations may use co-sourcing when they are:
Expanding the Scope of an Existing Internal Audit Plan
Requiring Specialist Expertise for Individual Audits
The arrangement allows the existing internal audit function to remain in control of its programme while external specialists provide additional assurance where required.
Address: 1-2 Craven Road, Ealing, London, W5 2UA, UK
Grant Thornton UK
Grant Thornton provides internal audit services through co-source, outsource and temporary resource models. Its co-sourcing work is designed for organisations that already operate an internal audit function but need additional auditors, specialist knowledge or support completing parts of the annual plan.
The firm can provide individual audit professionals through to complete teams responsible for particular reviews. Specialist input covers areas including technology, financial services regulation, cyber risk and other emerging risks, while its internal audit practice also carries out external quality assessments.
Key Facts
Ideal for: Established internal audit teams needing scalable resource or specialist support
BDO provides co-sourced and outsourced internal audit services through its risk and advisory teams. The model is relevant to organisations that want to keep internal leadership of the function while obtaining external auditors for specific business units, technical subjects or periods of higher workload.
Its London-based specialists work across financial and operational risk, governance, technology, regulatory matters and internal controls. BDO’s financial services practice has particular experience with internal audit arrangements for banks, insurers, investment businesses and other regulated organisations, while its wider risk teams work with corporate groups across several sectors.
Key Facts
Ideal for: In-house teams requiring specialist or additional audit resources
Specialization: Financial services, operational risk and digital risk
Capabilities: Technology risk, governance, regulatory assurance and internal controls
Location: London, UK
Contact Information
Website: www.bdo.co.uk
Phone: 020 7486 5888
Address: 55 Baker Street London, W1U 7EU, United Kingdom
LinkedIn: www.linkedin.com/company/bdo-llp
Instagram: www.instagram.com/bdo_uk
PKF Littlejohn
PKF Littlejohn’s Governance, Risk & Control Assurance team delivers second-line and third-line assurance work, with internal audit offered through both fully outsourced and co-sourced models. The co-source model brings the firm’s market and subject matter specialists into existing internal audit teams without transferring overall ownership of the function.
The practice has a strong focus on financial services, including insurance businesses and other regulated organisations. Its specialists can support complete internal audits or contribute technical expertise to planning, fieldwork and reporting for particular regulatory or operational topics.
Key Facts
Ideal for: Regulated businesses with an established internal audit function
Core services: Internal audit co-sourcing, outsourcing, governance and controls assurance
Specialization: Financial services risk and regulation
Forvis Mazars provides internal audit through risk consulting and specialist assurance teams. Co-sourcing can range from additional professionals working alongside an established internal audit department to external teams taking responsibility for selected audits within the client’s wider programme.
The UK practice has dedicated capability in areas such as technology, cyber security, financial crime, regulatory compliance, prudential risk and operational resilience. Sector-specific internal audit teams cover financial services as well as corporate, public and not-for-profit organisations. The firm can therefore be relevant where the main purpose of co-sourcing is access to specialist knowledge rather than simply increasing audit headcount.
Key Facts
Ideal for: Complex organisations requiring multidisciplinary audit support
Deloitte offers specific co-source internal audit support alongside full internal audit outsourcing and advisory services. Under a co-sourced arrangement, its professionals can augment an existing project team, take end-to-end responsibility for individual audits or provide specialists for longer assignments within the internal function.
Its subject matter coverage includes technology and cyber risk, digital systems, data protection, third-party risk, organisational culture and other operational and strategic areas. This model is particularly suited to large internal audit functions that need access to specialists without maintaining every technical discipline internally.
Key Facts
Ideal for: Large or complex internal audit functions requiring specialist capability
Specialization: Multidisciplinary risk and controls assurance
Capabilities: Technology, cyber, digital risk, third-party risk and governance
Location: London, UK
Contact Information
Website: www.deloitte.com
Phone: +44 (0)20 7936 3000
Address: 1 New Street Square, London, EC4A 3HQ, United Kingdom
LinkedIn: www.linkedin.com/company/deloitte
Facebook: www.facebook.com/deloitteuk
Twitter: x.com/deloitteuk
Instagram: www.instagram.com/deloitte_uk
KPMG UK
KPMG provides internal audit co-sourcing as part of its wider risk and regulatory consulting practice. Organisations can use external resources to supplement their internal function while retaining responsibility for audit leadership, planning and governance.
Its services span internal audit strategy, operating model design, risk assessment, audit execution, continuous assurance and quality reviews. Specialist teams can contribute to financial, operational, regulatory, technology and conduct risk audits, making the model applicable where internal teams need either extra delivery capacity or expertise in a defined risk area.
Key Facts
Ideal for: Organisations needing broad specialist access alongside an internal audit team
EY provides internal audit co-source and managed service arrangements for organisations seeking to expand or change their existing assurance capabilities. Its teams can assist with the execution of audit plans while the organisation retains an internal audit function and overall responsibility for its mandate.
Support includes risk assessment, scoping, audit programme design, technology-enabled testing and specialist audits covering areas such as cyber security, ESG, transactions, culture and strategy. EY also works on internal audit transformation, technology strategy and maturity assessments, so co-sourcing can be combined with broader changes to how an internal audit function operates.
Key Facts
Ideal for: Large internal audit functions undergoing expansion or transformation
Core services: IA co-source, managed services, outsourcing, advisory
Specialization: Internal audit transformation and technology-enabled assurance
Capabilities: Specialist audits, analytics, controls testing and EQA work
Location: London, UK
Contact Information
Website: www.ey.com
Phone: +44 20 7951 2000
Address: 1 More London Place, London SE1 2AF
LinkedIn: www.linkedin.com/company/ernstandyoung
Facebook: www.facebook.com/EY
Twitter: x.com/EYnews
Protiviti
Protiviti is a risk consulting company with a dedicated Internal Audit and Financial Advisory practice in London. Its strategic sourcing services cover internal audit co-sourcing, staff augmentation, full outsourcing and alternative delivery models.
Co-sourcing can be used to increase audit capacity or bring operational, technology, compliance and sector expertise into an established team. Protiviti also works on internal audit transformation, methodology and technology, which may be relevant to organisations looking to change the function while continuing delivery of the existing audit plan.
Core services: Internal audit co-sourcing, staff augmentation, full outsourcing
Specialization: Internal audit and financial advisory
Capabilities: Technology, compliance, controls and operational risk
Location: London, UK
Contact Information
Website: www.protiviti.com
Phone: +44.20.7930.8808
Address: The Shard, 32 London Bridge Street, London, SE1 9SG, United Kingdom
LinkedIn: www.linkedin.com/company/protiviti-uk-
Facebook: www.facebook.com/Protiviti
Twitter: x.com/ProtivitiUK
Instagram: www.instagram.com/protiviti.uk
Crowe UK
Crowe UK provides internal audit and specialist assurance through outsourced and co-sourced delivery models. In co-sourced arrangements, its teams generally work alongside an internal Head of Risk or Head of Internal Audit, taking responsibility for complete reviews or providing subject matter specialists for selected stages of an audit.
The practice covers governance, technology risk, financial services and other areas requiring specialist assurance. Crowe also provides external quality assessments and support for organisations establishing or restructuring internal audit functions.
Key Facts
Ideal for: Organisations retaining an internal Head of Audit or Risk
Specialization: Risk, governance and internal assurance
Industries: Financial services, pensions and other corporate sectors
Location: London, UK
Contact Information
Website: www.crowe.com
Phone: +44 (0)20 7842 7100
Address: 55 Ludgate Hill, London, EC4M 7JW
LinkedIn: www.linkedin.com/company/crowe-uk
Twitter: x.com/CroweUK
Instagram: www.instagram.com/crowe_uk
RSM UK
RSM provides internal audit and risk assurance support to organisations across regulated and commercial sectors. Its co-sourcing capability is particularly visible in financial services, where specialist internal auditors can contribute technical reviews while the client’s internal audit function maintains responsibility for the broader audit programme.
Support can cover regulatory requirements, prudential risk, governance and controls alongside other assurance topics. This makes the company relevant where internal audit teams need technical expertise for a particular part of their risk universe rather than a replacement for the complete function.
Key Facts
Ideal for: Financial services and regulated organisations
Specialization: Financial services risk and regulation
Capabilities: Prudential assurance, governance and technical reviews
Location: London and UK-wide
Contact Information
Website: www.rsmuk.com
Phone: +44 (0)20 3201 8000
Address: 25 Farringdon Street, London, EC4A 4AB
LinkedIn: www.linkedin.com/company/rsm-uk
Instagram: www.instagram.com/rsm.uk
PwC UK
PwC’s UK internal audit practice offers outsource, co-source, managed service and advisory delivery models. Its co-sourcing services can assist organisations with planning and executing elements of their internal audit programme while maintaining an existing internal function.
The scope ranges from risk assessment and individual audit execution to specialist work in cyber security, ESG, transactions, HR, culture and strategy. PwC also provides internal audit technology, analytics, maturity evaluations and transformation support, which allows organisations to combine additional delivery capacity with changes to methodology or operating models.
Key Facts
Ideal for: Large or international internal audit functions
Specialization: Technology-enabled and multidisciplinary internal audit
Capabilities: Specialist audits, analytics, transformation and maturity reviews
Location: London, UK
Contact Information
Website: www.pwc.co.uk
Phone: +44 (0)20 7583 5000
Address: 1 Embankment Place, London, WC2N 6RH, United Kingdom
LinkedIn: www.linkedin.com/company/pwc-uk
Facebook: www.facebook.com/PwCUK
Instagram: www.instagram.com/pwc_uk
McMillan Woods Audits
McMillan Woods Audits provides both fully outsourced and co-sourced internal audit arrangements. Its co-sourced service is positioned as additional support for organisations that already maintain an internal audit function but have gaps in capacity or technical knowledge.
The firm uses a risk-based approach covering financial, operational and governance risks. Compared with the large multidisciplinary consultancies in this guide, its proposition is more closely centred on core internal audit and controls assurance, which may suit organisations seeking a conventional accountancy-led co-sourcing arrangement.
Address: 42-44 Bishopsgate, London EC2N 4AH, United Kingdom
Conclusion
Choosing among internal audit co-sourcing companies in London depends on business size, sector, process maturity and the regulatory environment in which the organisation operates. Some companies combine internal audit with wider risk, technology, governance and compliance expertise, while others concentrate on a narrower range of assurance work or particular industries. The right fit also depends on whether the need is additional audit capacity, access to specialist skills or ongoing support for an established internal audit function. This guide is intended to provide neutral context for comparing those differences rather than presenting one company as the default choice. A suitable partner should provide independent assurance together with practical recommendations that reduce risk exposure and strengthen organisational resilience.
AC
Written by the Acumon team
Acumon is an ICAEW-registered firm of chartered accountants and registered auditors
based in London, with offices in Pitstone, Aylesbury and Bournemouth. Need advice on
anything covered here? Talk to us.
This practical guide provides an overview of internal audit co-sourcing services companies in Birmingham, covering their expertise, service areas, and the types of organisations they support. The…
Internal audit co-sourcing gives organisations a way to retain control of their internal audit function while bringing in external capacity or specialist knowledge when needed. The UK providers…
Statutory Sick Pay (SSP) is the minimum an employer must pay an employee who is too ill to work. For 2026/27 it is £123.25 a week or 80% of the employee's average weekly earnings, whichever is…
Read article
Get in Touch
Ready for Accountants Who Move Your Business Forward?
Tell us what you need. Within one business day, a qualified accountant will be in touch to talk it through and give you a clear, fixed-fee quote — no obligation.
We use essential cookies to run this site, plus Google Analytics and Google Ads to
understand how visitors use it and measure our advertising — only with your consent. See our
Privacy Policy.
