This practical guide reviews companies providing internal audit outsourcing services in London, with a focus on their areas of expertise, client profiles and relevant capabilities. It is designed as an overview rather than ranking companies against one another. The selection includes large companies with broad audit, risk and advisory capabilities as well as more focused specialists serving particular sectors or assurance needs. Looking at these differences gives businesses clearer context around which companies may suit their size, operating environment and internal audit requirements. The aim is to make comparison easier and support a more informed selection process.
Acumon
Acumon is a UK firm of chartered accountants, registered auditors, and advisors providing internal audit outsourcing services to companies, charities, public sector organisations, and regulated businesses.
The firm delivers internal audit through fully outsourced, co-sourced, and ad-hoc engagement models. A fully outsourced arrangement can cover the complete internal audit function, including annual risk-based planning, fieldwork, management action tracking, and reporting to the audit committee. Co-sourcing is designed for organisations that already have an internal audit team but need additional capacity or specialist expertise.
Internal audit engagements are led by a partner who is a Chartered Member of the Institute of Internal Auditors (CMIIA). The wider Risk & Tech Assurance practice allows individual reviews to draw on expertise covering financial controls, IT risk, cybersecurity, fraud, governance, and other areas that may sit within an organisation’s audit plan.
Acumon works with organisations across corporate, commercial, public sector, and not-for-profit environments. Its published sector coverage includes banking, financial services, insurance, retail, fintech, listed companies, utilities, energy, local and central government, academy trusts, further and higher education, charities, and NGOs.
For organisations using a fully outsourced model, Acumon can work with the audit committee to develop a risk-based annual plan and provide continuing reporting on the control environment. Findings can be graded by risk, linked to agreed management actions, and tracked through to closure rather than treated as isolated individual reviews.
The co-sourced model can be used when an existing internal audit function faces temporary capacity constraints or needs knowledge in areas such as IT audit, fraud, treasury, or regulation. Specialist reviews can be delivered independently or incorporated into the organisation’s existing internal audit methodology and programme.
Internal Audit Outsourcing Capabilities
Acumon provides internal audit support across different organisational structures, assurance requirements, and delivery models.
These include:
- Fully Outsourced Internal Audit Functions
- Co-Sourced Internal Audit Support
- Risk-Based Annual Audit Planning
- Audit Committee Reporting
- Management Action Tracking
- IT And Technology Audit
- Fraud And Financial Control Reviews
- Governance And Regulatory Reviews
- Ad-Hoc Internal Audit Assignments
Internal audit programmes can therefore range from a continuing outsourced function to individual specialist reviews addressing particular risks or control areas.
Regulatory Licences and Registrations
Acumon operates as a regulated UK accountancy and audit practice, with professional registrations that support its wider audit and assurance work.
These include:
- UK Statutory Audit Registration
- ICAEW Registered Audit Firm Status
- FRC Authorisation For Relevant Audit Work
- Public Interest Entity Audit Capability
- CMIIA-Qualified Internal Audit Leadership
The firm’s UK audit registration provides a broader regulated assurance framework around its internal audit and risk services, although internal audit outsourcing itself is distinct from statutory external audit.
Core Services
In addition to internal audit outsourcing, Acumon provides risk and assurance services that can support governance, controls, and organisational oversight.
These include:
- Internal Audit
- Risk Management Reviews
- Governance Reviews
- IT Audit
- Cybersecurity Assurance
- Anti-Fraud Services
- Financial Controls Reviews
- Benchmarking And Thematic Reviews
- Business Health Checks
These capabilities can be incorporated into an internal audit programme when the audit plan requires specialist knowledge outside conventional financial control testing.
Organisations may consider outsourced or co-sourced internal audit when their existing assurance resources no longer match the scale or complexity of their operations.
Acumon works with organisations that are:
- Establishing An Internal Audit Function
- Expanding An Existing Audit Programme
- Experiencing Internal Audit Capacity Gaps
- Preparing For Increased Regulatory Scrutiny
- Reviewing Governance And Internal Controls
- Requiring Specialist IT Or Cyber Assurance
- Responding To Control Failures Or Emerging Risks
- Strengthening Audit Committee Oversight
The delivery model can be adjusted as requirements change, allowing an organisation to retain external responsibility for the whole function or use Acumon for selected areas within an internally managed programme.
Contact Information
- Website: acumon.com
- Phone: 020 8567 3451
- Email: [email protected]
- Address: 1-2 Craven Road, Ealing, London, W5 2UA, UK
Grant Thornton UK
Grant Thornton provides internal audit through its business risk services practice. Organisations can use the team through full outsourcing, co-sourcing or temporary resource arrangements, allowing the structure to change depending on whether internal audit is being created externally or supplemented.
Its internal audit work combines core audit professionals with subject matter specialists when reviews involve areas such as technology, regulation or other emerging risks. The firm also provides external quality assessments and can supply internal audit professionals at different levels when an existing function has resource gaps.
Key Facts
- Ideal for: Organisations needing flexible internal audit capacity and specialist input
- Core services: Outsourced internal audit, co-sourcing, resource support, EQAs
- Specialization: Risk-based assurance and multidisciplinary internal audit
- Coverage: UK and international organisations
- Location: London presence
Contact Information
- Website: www.grantthornton.co.uk
- Phone: +44 (0)20 7383 5100
- Address: 8 Finsbury Circus, London, EC2M 7EA
- LinkedIn: www.linkedin.com/company/grant-thornton-uk
- Instagram: www.instagram.com/gt_trainees
PKF Littlejohn
PKF Littlejohn provides outsourced and co-sourced internal audit from its governance, risk and control assurance practice. The London-headquartered firm works particularly with complex and regulated private and listed businesses, including organisations in financial services.
A complete outsourced engagement can include establishing the function, risk-based planning, individual audits, audit committee reporting and follow-up of agreed actions. For organisations retaining an internal team, PKF can add resource or specialist expertise in areas including technology, regulatory compliance, financial reporting and sustainability. Its advisory work extends to External Quality Assessments, QAIPs, audit committee effectiveness reviews and internal audit training.
Key Facts
- Ideal for: Listed, regulated and complex private organisations
- Core services: Full outsourcing, co-sourcing, EQA, QAIP and advisory support
- Specialization: Governance, risk and control assurance
- Relevant sectors: Includes financial services and regulated businesses
- Location: London
Contact Information
- Website: www.pkf-l.com
- Phone: +44 (0)20 7516 2200
- Email: [email protected]
- Address: 30 Churchill Place, London, E14 5RE
- LinkedIn: www.linkedin.com/company/littlejohn
- Twitter: x.com/PKF_Littlejohn
- Instagram: www.instagram.com/pkf.littlejohn
Protiviti
Protiviti focuses heavily on internal audit, controls and risk consulting. Its strategic sourcing model ranges from fully outsourced internal audit functions to subject matter support and staff augmentation, which makes the company relevant both to businesses replacing an internal function and larger organisations supplementing established teams.
Beyond conventional operational and financial reviews, its internal audit practice includes technology audit, controls advisory, fraud risk management, SOX work, audit transformation and data-driven audit methods. The UK internal audit practice has leadership based in London and works with regulated and multinational organisations.
Key Facts
- Ideal for: Complex, regulated and multinational organisations
- Core services: Outsourcing, co-sourcing, staff augmentation and internal audit advisory
- Specialization: Technology-enabled internal audit and controls
- Additional capabilities: SOX, fraud risk, technology audit and audit transformation
- Location: London
Contact Information
- Website: www.protiviti.com
- Phone: +44.20.7930.8808
- Address: The Shard, 32 London Bridge Street, London, SE1 9SG, United Kingdom
- LinkedIn: www.linkedin.com/company/protiviti-uk-
- Facebook: www.facebook.com/Protiviti
- Twitter: x.com/ProtivitiUK
- Instagram: www.instagram.com/protiviti.uk
BDO
BDO provides internal audit outsourcing across several sectors, with dedicated teams serving financial services and public sector organisations. Its financial services practice supports both fully outsourced arrangements and co-sourced relationships where experienced auditors supplement an existing team.
The firm’s London internal audit specialists cover areas including banking, asset management and insurance. BDO also provides fully outsourced and co-sourced internal audit to NHS, central government and local government organisations, giving it a distinct public sector capability alongside its commercial and regulated-sector work.
Key Facts
- Ideal for: Financial services and public sector organisations
- Core services: Fully outsourced and co-sourced internal audit
- Specialization: Banking, asset management, insurance and public sector assurance
- Additional capabilities: Governance, control assurance and internal audit transformation
- Location: London
Contact Information
- Website: www.bdo.co.uk
- Phone: 020 7486 5888
- Address: 55 Baker Street London, W1U 7EU, United Kingdom
- LinkedIn: www.linkedin.com/company/bdo-llp
- Instagram: www.instagram.com/bdo_uk
Kreston Reeves
Kreston Reeves offers complete internal audit outsourcing as well as co-sourced arrangements for organisations that want to retain their own audit team. Its internal audit specialists work with corporate, public sector and not-for-profit organisations.
Reviews can extend beyond finance into supplier and operational audits, technology and cyber risk, fraud, governance and due diligence. Kreston Reeves can also provide technical advice, External Quality Assessments and temporary support during periods of resource shortage. The firm has an office in London alongside its wider South East presence.
Key Facts
- Ideal for: Corporates, public sector organisations and not-for-profits
- Core services: Full outsourcing, co-sourcing and advisory
- Specialization: Operational, governance and risk-based internal audit
- Additional capabilities: Technology, cyber, fraud and EQA work
- Location: London and South East England
Contact Information
- Website: www.krestonreeves.com
- Phone: +44 (0)330 124 1399
- Address: 2nd Floor, 168 Shoreditch High Street, London, E1 6RA
- LinkedIn: www.linkedin.com/company/kreston-reeves
- Twitter: x.com/KrestonReeves
RSM UK
RSM provides co-sourced and outsourced internal audit as part of its internal audit, controls and risk assurance offering. The work is designed around an organisation’s strategic, financial and operational risk profile rather than being limited to financial control testing.
Its specialists support commercial businesses, financial services organisations, healthcare, charities and public sector bodies. Depending on the engagement, RSM can operate an outsourced function, provide additional audit resources, undertake individual assurance assignments or review the effectiveness of an existing internal audit function.
Key Facts
- Ideal for: Organisations needing broad risk assurance across multiple functions
- Core services: Outsourced internal audit, co-sourcing and controls assurance
- Specialization: Risk-based audit planning and governance
- Relevant sectors: Corporate, financial services, charities, healthcare and public sector
- Location: London and UK-wide
Contact Information
- Website: www.rsmuk.com
- Phone: +44 (0)20 3201 8000
- Address: 25 Farringdon Street, London, EC4A 4AB
- LinkedIn: www.linkedin.com/company/rsm-uk
- Instagram: www.instagram.com/rsm.uk
Crowe UK
Crowe provides both fully outsourced and co-sourced internal audit. Under a complete outsourcing arrangement, the firm can provide the internal audit function itself, including Head of Internal Audit capability. Co-sourcing allows Crowe to undertake complete reviews or supply specialist resources within an organisation’s existing programme.
The practice connects internal audit with areas including technology risk, cybersecurity, data analytics, fraud investigations, project assurance, risk management and governance. Crowe has particular internal audit capabilities for financial services, pensions, social purpose and not-for-profit organisations.
Key Facts
- Ideal for: Organisations needing multidisciplinary assurance
- Core services: Full outsourcing, co-sourcing and specialist assurance
- Specialization: Governance, risk and internal audit
- Additional capabilities: Cybersecurity, data, fraud, SOX and EQA
- Location: London and wider UK network
Contact Information
- Website: www.crowe.com
- Phone: +44 (0)20 7842 7100
- Address: 55 Ludgate Hill, London, EC4M 7JW
- LinkedIn: www.linkedin.com/company/crowe-uk
- Twitter: x.com/CroweUK
- Instagram: www.instagram.com/crowe_uk
Forvis Mazars
Forvis Mazars provides internal audit through its UK risk consulting and governance, risk and internal control practices. Organisations establishing a new internal audit function or expanding an existing one can draw on specialists covering governance, regulation, technology, compliance and risk management.
The broader assurance practice includes internal audit, IT audit, governance reviews, compliance reviews and risk management assessments. Its technology assurance specialists specifically provide co-sourced and outsourced IT internal audit arrangements. The firm has a London office at Old Bailey.
Key Facts
- Ideal for: Organisations with multidisciplinary risk and regulatory requirements
- Core services: Internal audit, governance and risk assurance
- Specialization: Governance, Risk & Internal Control
- Additional capabilities: IT audit, compliance, SOX and technology assurance
- Location: London
Contact Information
- Website: www.forvismazars.com
- Phone: +44 (0) 20 7063 4000
- Address: 30 Old Bailey, London, EC4M 7AU, United Kingdom
- LinkedIn: www.linkedin.com/company/forvis-mazars-in-the-uk
- Twitter: x.com/ForvisMazarsUK
- Instagram: www.instagram.com/forvismazarsuk
Deloitte UK
Deloitte offers a fully managed outsourced internal audit model in which its team operates the organisation’s internal audit function. Its co-source model works differently, embedding audit professionals and subject matter experts alongside an existing in-house team.
The scope can extend into cyber risk, technology, data protection, third-party risk, financial crime, regulatory matters and major transformation programmes. Deloitte also helps organisations establish new internal audit functions, review audit methodologies and develop technology-enabled approaches to planning, testing and reporting.
Key Facts
- Ideal for: Large and complex organisations
- Core services: Full outsourcing, co-sourcing and internal audit advisory
- Specialization: Enterprise-scale internal audit and transformation
- Additional capabilities: Cyber, technology, regulation and digital audit
- Coverage: UK and international operations
- Location: London presence
Contact Information
- Website: www.deloitte.com
- Phone: +44 (0)20 7936 3000
- Address: 1 New Street Square, London, EC4A 3HQ, United Kingdom
- LinkedIn: www.linkedin.com/company/deloitte
- Facebook: www.facebook.com/deloitteuk
- Twitter: x.com/deloitteuk
- Instagram: www.instagram.com/deloitte_uk
KPMG UK
KPMG provides internal audit outsourcing and co-sourcing as part of its Governance, Risk and Compliance services. Its end-to-end internal audit capability can cover strategy, risk assessment, planning, execution, control testing and continuous assurance.
Outsourcing is available to organisations seeking external delivery of the function, while co-sourcing gives existing internal audit departments access to additional specialists and international resources. Relevant adjacent services include enterprise risk management, regulatory compliance, major-project assurance, technology-related reviews and External Quality Assessments.
Key Facts
- Ideal for: Large, regulated and internationally active organisations
- Core services: Internal audit outsourcing, co-sourcing and managed delivery
- Specialization: Governance, risk and compliance
- Additional capabilities: ERM, technology, regulatory assurance and EQA
- Location: London and UK-wide
Contact Information
- Website: kpmg.com
- Phone: +44 (0)20 7311 1000
- Address: 15 Canada Square, Canary Wharf, London, E14 5GL
- Facebook: www.facebook.com/KPMG
- LinkedIn: www.linkedin.com/company/kpmg-uk
- Twitter: x.com/kpmguk
PwC UK
PwC structures its internal audit offering around outsource, co-source, managed service and advisory models. It can help establish an internal audit function, execute part or all of an audit plan, or supplement an existing team with subject matter expertise.
Audit programmes can incorporate financial and operational risk alongside cybersecurity, ESG, M&A, HR, culture, third-party risk, strategy and forensic work. PwC also provides internal audit technology, benchmarking, External Quality Assessments and support with audit operating models. This breadth makes the offering particularly relevant to organisations whose audit universe crosses multiple specialist disciplines.
Key Facts
- Ideal for: Larger businesses and organisations with complex audit universes
- Core services: Outsourcing, co-sourcing, managed services and advisory
- Specialization: Technology-enabled internal audit
- Additional capabilities: Cyber, ESG, forensic, third-party and transformation audits
- Location: London and UK-wide
Contact Information
- Website: www.pwc.co.uk
- Phone: +44 (0)20 7583 5000
- Address: 1 Embankment Place, London, WC2N 6RH, United Kingdom
- LinkedIn: www.linkedin.com/company/pwc-uk
- Facebook: www.facebook.com/PwCUK
- Instagram: www.instagram.com/pwc_uk
EY
EY’s UK internal audit work focuses on transforming and delivering internal audit functions using a combination of specialist teams, technology and managed services. Its service models include industry and risk-focused co-sourcing as well as managed internal audit provision.
The practice works across the internal audit lifecycle, including diagnostics, function transformation, controls testing and risk-focused assurance. This model can suit organisations that need specialist audit capability across multiple jurisdictions or want external support to modernise an existing function rather than simply transfer individual reviews to another provider.
Key Facts
- Ideal for: Large organisations undergoing internal audit transformation
- Core services: Co-sourcing, managed services and audit transformation
- Specialization: Technology-enabled internal audit
- Additional capabilities: Analytics-based controls testing and risk-domain expertise
- Coverage: UK and international organisations
Contact Information
- Website: www.ey.com
- Phone: +44 20 7951 2000
- Address: 1 More London Place, London SE1 2AF
- LinkedIn: www.linkedin.com/company/ernstandyoung
- Facebook: www.facebook.com/EY
- Twitter: x.com/EYnews
McMillan Woods Audits
McMillan Woods Audits provides both fully outsourced and co-sourced internal audit. Under the outsourced model, the firm can oversee the internal audit function and its requirements, while co-sourcing is intended to add experienced auditors where an existing team has resource or knowledge gaps.
Its approach starts with the organisation’s own risk management framework and considers financial, operational and governance risks when shaping the audit. Compared with multinational consulting groups, this is a more focused audit-led proposition that may suit businesses wanting a London provider without the scale of a major professional services network.
Key Facts
- Ideal for: Organisations looking for a focused outsourced audit provider
- Core services: Fully outsourced and co-sourced internal audit
- Specialization: Financial, operational and governance risk
- Delivery model: Risk-based audit programmes
- Location: London
Contact Information
- Website: www.mcmillanwoodsaudits.co.uk
- Phone: 020 3835 4488
- Email: [email protected]
- Address: 42-44 Bishopsgate, London EC2N 4AH, United Kingdom
TIAA
TIAA is a specialist business assurance provider offering outsourced internal audit across the UK. Engagements range from complete outsourcing and co-sourcing to individual ad-hoc assignments, allowing organisations to use the provider either as their internal audit function or for specific gaps in an existing assurance programme.
Its work covers governance, risk management, ICT and cybersecurity, financial and operational performance, capital projects, sustainability and value-for-money reviews. TIAA has particularly visible sector experience in healthcare, housing, education, charities and government, making it relevant where internal audit needs to reflect public or not-for-profit governance requirements.
Key Facts
- Ideal for: Public sector, healthcare, housing, education and charities
- Core services: Full outsourcing, co-sourcing and ad-hoc internal audit
- Specialization: Business assurance and sector-focused internal audit
- Additional capabilities: Cyber, governance, projects and risk management
- Coverage: Organisations throughout the UK
Contact Information
- Website: www.tiaa.co.uk
- Phone: 0845 300 3333
- Email: [email protected]
- Address: 13 Hanover Square Mayfair London W1S 1HT
- LinkedIn: www.linkedin.com/company/tiaa-ltd
- Twitter: x.com/TIAA_Ltd
Conclusion
The right choice among internal audit outsourcing companies in London depends on business size, sector, process maturity and the regulatory environment in which the organisation operates. Some companies combine internal audit with wider risk, technology, governance and compliance expertise, while others concentrate on a narrower set of assurance services or specific industries. Neither model is automatically more suitable, as the appropriate scope depends on the organisation’s existing resources and assurance priorities. This guide provides neutral context for comparing different approaches, capabilities and areas of specialization. A suitable partner should provide independent assurance while translating audit findings into practical actions that reduce risk and strengthen long-term resilience.