Internal Audit Co-Sourcing Firms in the UK: Guide to Specialist Companies (2026)
AC
Acumon Chartered Accountants·12 min read
Internal audit co-sourcing gives organisations a way to retain control of their internal audit function while bringing in external capacity or specialist knowledge when needed. The UK providers below support different combinations of co-sourcing, outsourcing, specialist reviews, technology assurance, risk management and audit transformation. This is a practical selection of providers rather than a ranking.
Acumon
Acumon is a UK firm of chartered accountants and registered auditors providing internal audit co-sourcing services to companies, charities, regulated entities, and organisations across corporate, public sector, and not-for-profit sectors.
The firm works with organisations ranging from growing businesses and charities through to larger corporate groups, listed companies, and regulated entities. Internal audit co-sourcing engagements are delivered in accordance with the Global Internal Audit Standards and supported by a structured risk-based methodology.
Acumon’s Risk & Tech Assurance practice is led by partners who hold the Chartered Member of the Institute of Internal Auditors (CMIIA) qualification and bring more than 20 years of internal audit, governance, and risk experience across corporate, public sector, and not-for-profit organisations. Co-sourced arrangements allow the firm to work alongside in-house internal audit teams, adding capacity, specialist skills (such as IT, cyber, fraud, or contract audit), or independence where needed, while the client retains ownership of the audit plan and relationships.
In addition to co-sourcing, Acumon offers fully outsourced internal audit functions and focused ad-hoc reviews. Engagements are time-bound with budget certainty and senior-led throughout. The firm supports risk-based audit planning, control effectiveness assessment, governance framework evaluation, compliance testing, process improvement recommendations, audit committee reporting, tracking of management actions, and annual internal audit opinions. It also assists with External Quality Assessment (EQA) preparation and independent reviews in line with the Global Internal Audit Standards.
Acumon works with finance teams, boards, and audit committees to strengthen risk management, internal controls, and governance arrangements. Sector experience spans banking, financial services, insurance, retail, fintech, listed companies, utilities and energy, local and central government, emergency services, academy trusts, further and higher education, charities, and NGOs.
Internal Audit Co-Sourcing Capabilities:
Acumon provides co-sourced (and related) internal audit services across a wide range of organisational structures and sectors.
These include:
Organisations with existing in-house internal audit teams needing additional capacity or specialist skills
Growing businesses and owner-managed companies building or enhancing assurance frameworks
Public Interest Entities, regulated organisations, and listed companies
Charities and not-for-profit organisations
Public sector bodies, academy trusts, and educational institutions
Multi-entity and international group structures
These capabilities enable the firm to support organisations that require flexible, independent, risk-based internal audit support while preserving institutional knowledge and control within the client’s own team.
Regulatory Licences and Registrations:
Acumon holds several audit registrations that enable it to support organisations operating across multiple jurisdictions.
These include:
UK statutory audit registration
Public Interest Entity (PIE) audit licence
Jersey audit licence
Isle of Man audit licence
Cayman Islands audit licence
British Virgin Islands audit licence
These registrations allow the firm to provide audit services to groups that include entities in both the UK and key international financial centres.
Core Services:
In addition to statutory external audit, Acumon provides a range of services that support financial reporting and governance.
These include:
Statutory external audit
Group and subsidiary audits
Public Interest Entity (PIE) audits
Charity and not-for-profit audit
Audit of international group structures
Internal audit and governance reviews
Risk management and compliance support
Audit work is often delivered alongside discussions with management and boards regarding financial reporting processes and governance frameworks.
Many organisations initially encounter statutory audit requirements as they grow and exceed the audit exemption thresholds set out in the Companies Act.
Acumon works with businesses that are:
Approaching their first statutory audit
Preparing for external investment
Expanding into international markets
Operating within corporate group structures
Early engagement with an audit firm can help ensure that financial reporting systems and documentation are aligned with statutory audit requirements.
Address: 1-2 Craven Road, Ealing, London, W5 2UA, UK
Bishop Fleming
Bishop Fleming’s Internal Audit and Risk Advisory team supports organisations through one-off reviews, fully outsourced arrangements and co-sourced internal audit. The latter model allows its auditors to work alongside an organisation’s own team rather than replacing the internal function.
Its work covers controls, risk assurance and governance, with support extending to boards and audit committees. Bishop Fleming also has experience delivering internal audit within education, charities, housing associations and government organisations, making it particularly relevant where assurance requirements extend beyond purely financial controls.
Key Facts:
Delivery model: Co-sourced, outsourced and one-off internal audit reviews
Core focus: Internal controls, risk assurance and governance
Governance support: Board and audit committee reporting and challenge
Sector experience: Education, charities, housing associations and government
Approach: Risk-based internal audit planning tailored to organisational priorities
Kreston Reeves offers internal audit co-sourcing specifically for organisations that want external auditors to work with their own internal team. Its other delivery options include complete outsourcing, advisory support and secondments during periods when additional resource is required.
The firm uses recognised internal audit techniques and states that its key internal audit staff are members of the Institute of Internal Auditors. Its wider work includes external quality assessments, audit committee support and audit transformation, which gives organisations options beyond simply adding temporary audit capacity.
Key Facts:
Delivery model: Internal audit co-sourcing, complete outsourcing, advisory and secondments
Co-sourcing approach: External auditors work alongside the client’s existing team
Additional support: External quality assessments and technical advice
Governance capability: Audit committee advisory
Professional focus: Key internal audit staff are members of the Institute of Internal Auditors
Contact Information:
Website: www.krestonreeves.com
Twitter: x.com/KrestonReeves
LinkedIn: www.linkedin.com/company/kreston-reeves
Address: 2nd Floor, 168 Shoreditch High Street, London
Phone: +44 (0)330 124 1399
Grant Thornton UK
Grant Thornton works with internal audit teams on a co-source, outsource or loan-staff basis. This gives organisations several ways to handle resource pressure, from bringing in extra auditors temporarily to handing over defined parts of the internal audit programme.
Its model also makes use of subject matter specialists where an audit requires knowledge beyond standard control testing. Grant Thornton provides external quality assessments and can supply professionals at different levels, including senior auditors, managers and interim heads of audit. Its financial services work also covers co-sourcing for specialist areas such as financial crime.
Key Facts:
Delivery model: Co-sourcing, outsourcing and loan staff
Resource support: Audit professionals from senior auditor through to interim Head of Audit level
Specialist capability: Subject matter experts can be added to internal audit work
Additional service: External Quality Assessments
Financial services capability: Specialist co-sourced reviews, including financial crime assurance
BDO provides internal audit partnering through both outsourcing and co-sourcing. Its teams can work with organisations that already maintain an internal audit department or help establish an appropriate internal audit framework where one does not yet exist.
The firm’s internal audit offering combines risk assessment, strategic audit planning and reporting with services such as continuous auditing, data analytics and External Quality Assurance reviews. Technology risk also forms part of the offering, including areas such as cyber security, data privacy and technology resilience.
Key Facts:
Delivery model: Internal audit outsourcing and co-sourcing
Core services: Risk assessment, audit programme design and internal control reviews
Technology capability: Cyber security, data privacy and technology risk
Audit development: Establishment and improvement of internal audit functions
Additional services: External Quality Assurance, continuous monitoring and data analytics
Contact Information:
Website: www.bdo.co.uk
LinkedIn: www.linkedin.com/company/bdo-llp
Instagram: www.instagram.com/bdo_uk
Address: 55 Baker Street London, W1U 7EU, United Kingdom
Phone: 020 7486 5888
Henderson Loggie
Henderson Loggie provides co-sourced, outsourced and consultancy-based internal audit support. In a co-sourced engagement, the firm can add resources and expertise to an existing internal audit team while reporting through the organisation’s Head of Internal Audit.
Its work extends into internal controls, compliance, governance and risk management. Henderson Loggie operates from offices in Aberdeen, Dundee, Edinburgh and Glasgow, giving it a particularly established presence in Scotland while supporting organisations across different sectors.
Key Facts:
Delivery model: Co-sourced, outsourced and consultancy support
Co-sourcing use: Additional capability for existing in-house internal audit teams
Core areas: Internal controls, compliance, governance and risk management
Development support: Professional development for internal teams
UK presence: Offices across Aberdeen, Dundee, Edinburgh and Glasgow
Albion Audit provides fully outsourced and co-sourced internal audit for UK organisations. Its co-sourcing service is intended for businesses with an existing internal audit capability that need specialist expertise or additional capacity for particular projects or periods of heavier workload.
Alongside risk-based internal audit, the firm works on internal control reviews, audit committee support, governance and compliance. Its delivery model can therefore be used either for ongoing co-sourcing or for more targeted assurance work where the internal team retains responsibility for the wider audit function.
Key Facts:
Delivery model: Co-sourced, outsourced and one-off internal audit
Co-sourcing purpose: Capacity increases and specialist skills for existing teams
Core areas: Risk-based audit, internal controls and governance
Reporting: Audit committee and board reporting support
Additional services: Compliance reviews and risk management support
Address: 279 Chanterlands Avenue, Hull, HU5 4DS, United Kingdom
Forvis Mazars
Forvis Mazars provides internal audit support through outsourcing, co-sourcing, secondments and specialist assurance work. Its UK services include arrangements where the firm delivers part of an annual internal audit plan or supplies specialist resources for areas that an existing function does not cover internally.
Its capabilities span conventional governance and control reviews as well as IT audit, risk management, regulatory assurance and specialist technical assignments. For public sector organisations, its Apex Framework also includes co-sourcing arrangements and secondments alongside fully outsourced internal audit.
Key Facts:
Delivery model: Co-sourcing, outsourcing and secondments
Co-sourcing use: Delivery of part of an annual internal audit plan
Specialist resources: IT audit, procurement, tax and other technical skills
Risk work: Governance, risk management and control assurance
Sector capability: Public sector and regulated financial services organisations
Crowe UK provides internal audit through co-sourcing, outsourcing or a combination of the two. Its UK pensions practice, for example, uses these models to support trustees and audit and risk committees with assurance programmes focused on key pension scheme risks.
The wider Crowe internal audit offering also covers specialist and staff augmentation models. Organisations can bring in external expertise for defined areas while retaining their own methodology and governance structure. Available expertise across the broader practice includes IT audit, forensic work, fraud resilience, cyber security and other specialist risk areas.
Key Facts:
Delivery model: Co-sourcing, outsourcing and staff augmentation
UK specialist area: Pension scheme internal audit
Governance support: Work with audit and risk committees
Specialist capabilities: IT audit, cyber security, forensic services and fraud resilience
Flexible model: Support can be integrated with the organisation’s existing internal audit processes
Contact Information:
Website: www.crowe.com
Twitter: x.com/CroweUK
LinkedIn: www.linkedin.com/company/crowe-uk
Instagram: www.instagram.com/crowe_uk
Address: 55 Ludgate Hill, London, EC4M 7JW
Phone: +44 (0)20 7842 7100
RSM UK
RSM offers both co-sourced and outsourced internal audit services across corporate, public sector, charity and financial services organisations. Its co-sourcing model can supplement existing teams with additional audit resource or specialist knowledge while leaving ownership of the overall function inside the organisation.
The firm also supports secondments, internal audit effectiveness reviews and controls assurance. RSM’s UK team has experience managing co-sourced internal audit relationships in areas including healthcare, charities, consumer credit, financial services and larger corporate organisations.
Key Facts:
Delivery model: Co-sourced and outsourced internal audit
Additional options: Secondments and internal audit effectiveness reviews
Sectors: Corporate, public sector, charities and financial services
Risk coverage: Strategic, financial and operational risks
Specialist capability: Controls assurance and regulatory risk reviews
Contact Information:
Website: www.rsmuk.com
LinkedIn: www.linkedin.com/company/rsm-uk
Instagram: www.instagram.com/rsm.uk
Address: Landmark, St Peter’s Square, 1 Oxford Street, Manchester M1 4PB
Phone: +44 (0)151 600 2600
Deloitte UK
Deloitte supports organisations through internal audit outsourcing, co-sourcing and advisory arrangements. A business can use Deloitte for the complete internal audit function or work with its professionals alongside an established in-house team to execute parts of the audit programme.
Its services also cover internal audit strategy, effectiveness reviews, transformation and specialist technology assurance. Information technology auditors can participate in co-sourced engagements to review applications, networks, infrastructure and other technology risks, giving existing audit teams access to specialist capability without maintaining every discipline permanently.
Key Facts:
Delivery model: Co-sourcing, outsourcing and staff augmentation
Advisory work: Internal audit strategy, design and effectiveness reviews
Technology capability: IT internal audit and specialised assurance
Transformation support: Modernisation of internal audit functions
Controls work: Internal controls testing and assurance
Contact Information:
Website: www.deloitte.com
Facebook: www.facebook.com/deloitteuk
Twitter: x.com/deloitteuk
LinkedIn: www.linkedin.com/company/deloitte
Address: 1 City Square Leeds, LS1 2AL United Kingdom
Phone: +44 (0)113 243 9021
Protiviti UK
Protiviti’s UK internal audit practice offers multiple sourcing options, including fully outsourced functions, co-sourcing and strategic staffing. Co-sourcing allows an organisation’s Head of Internal Audit or Chief Audit Executive to retain responsibility while using Protiviti resources for additional capacity or specialist work.
The firm’s internal audit capabilities extend into technology audit, controls advisory, fraud risk, SOX work, data-driven auditing and audit transformation. This makes its sourcing model particularly suited to internal audit teams dealing with technical subjects that may not justify permanent specialist hires.
Key Facts:
Delivery model: Co-sourcing, full outsourcing and strategic staffing
Technology capability: IT risk, governance and technology audit
Audit improvement: Transformation and audit innovation
Controls support: Controls advisory and SOX programmes
Specialist areas: Fraud risk, regulatory compliance and data-driven auditing
Contact Information:
Website: protiviti.com
Facebook: www.facebook.com/Protiviti
Twitter: x.com/ProtivitiUK
LinkedIn: www.linkedin.com/company/protiviti-uk-
Instagram: www.instagram.com/protiviti.uk
Address: The Shard, 32 London Bridge Street, London, SE1 9SG, United Kingdom
Phone: +44.20.7930.8808
KPMG UK
KPMG provides internal audit co-sourcing and outsourcing as part of its UK governance, risk and compliance services. Its co-sourcing model gives in-house functions access to additional skills and wider resources while the organisation retains its internal audit capability.
The service covers the internal audit lifecycle from strategy and planning through execution, testing and continuous assurance. KPMG also works across financial, operational, regulatory and technology risks, alongside external quality assessments and internal audit operating model design.
Key Facts:
Delivery model: Co-sourced, outsourced and managed internal audit
Coverage: Strategy, planning, execution and follow-up
Audit areas: Financial, operational, regulatory and technology risk
Additional service: External Quality Assessments
Function development: Internal audit strategy and operating model design
PwC offers internal audit through co-source, outsource, managed service and advisory models. Its co-sourcing work can support the execution of an existing internal audit plan while bringing in PwC technology, industry knowledge and subject matter expertise where needed.
The firm’s services span risk assessment, planning, audit programme design, technology-enabled execution and stakeholder reporting. PwC can also support organisations establishing or restructuring an internal audit function, including situations connected with an IPO, merger or wider organisational change.
Key Facts:
Delivery model: Co-source, outsource, managed service and advisory
Audit execution: Planning, scoping, testing and reporting
Technology: Data-driven and technology-enabled audit work
Global support: Project management across multiple locations
Function development: Internal audit strategy, policies, structure and operating models
Contact Information:
Website: www.pwc.com
Facebook: www.facebook.com/PwCUK
LinkedIn: www.linkedin.com/company/pwc-uk
Instagram: www.instagram.com/pwc_uk
Address: 120 Bothwell Street, Glasgow G2 7JS , United Kingdom
Phone: +44 (0)141 355 4000
Conclusion
Internal audit co-sourcing in the UK covers more than simply supplying additional auditors. Some providers focus on embedding extra capacity into an established team, while others combine co-sourcing with specialist technology, regulatory, fraud, governance or controls expertise.
The right provider depends on the existing internal audit structure and the gaps that need to be filled. An organisation with a mature audit team may mainly need technical specialists or temporary capacity, while another may need a provider to deliver a larger share of the annual plan. Sector knowledge, independence, available expertise and the way responsibilities are divided between internal and external teams are therefore useful points to compare before selecting a co-sourcing arrangement.
AC
Written by the Acumon team
Acumon is an ICAEW-registered firm of chartered accountants and registered auditors
based in London, with offices in Pitstone, Aylesbury and Bournemouth. Need advice on
anything covered here? Talk to us.
This practical guide provides an overview of internal audit co-sourcing services companies in Birmingham, covering their expertise, service areas, and the types of organisations they support. The…
This practical guide presents companies offering internal audit co-sourcing services in London, with a focus on the types of support, expertise and client needs they cover. It is designed as an…
Statutory Sick Pay (SSP) is the minimum an employer must pay an employee who is too ill to work. For 2026/27 it is £123.25 a week or 80% of the employee's average weekly earnings, whichever is…
Read article
Get in Touch
Ready for Accountants Who Move Your Business Forward?
Tell us what you need. Within one business day, a qualified accountant will be in touch to talk it through and give you a clear, fixed-fee quote — no obligation.
We use essential cookies to run this site, plus Google Analytics and Google Ads to
understand how visitors use it and measure our advertising — only with your consent. See our
Privacy Policy.
