SOX Offshoring: Benefits and Key Considerations From the Service Provider and Client Perspectives

HOST: NEAL BEGGAN: Hello and welcome to the Risk and Accounting Advisory Podcast. I'm Neal Beggan, Risk Advisory Leader here at Cherry Bekaert.

HOST: NEAL BEGGAN: Today on our podcast we will talk about the concept of offshoring and considerations for companies deciding whether to use the offshore capability of their service providers.

HOST: NEAL BEGGAN: While most of the discussion will inform the chief audit executive about how a service provider approaches offshoring, much of this discussion also applies if an internal audit department wants to stand up its own offshoring model.

HOST: NEAL BEGGAN: With me today are two practitioners in the Cherry Bekaert Risk Advisory Practice, Gareth Montague-Smith and Peyton Black, both of whom have extensive experience with offshoring from both sides of the table, having been in the CAE role or acting in that role previously.

HOST: NEAL BEGGAN: I am particularly excited because Gareth, in a former life, provided Peyton, who was a former internal audit director, assistance regarding various staffing models, including offshoring. This episode is field tested, not just conceptual.

HOST: NEAL BEGGAN: Many of the concepts we discuss also apply to onshoring and co-sourcing or outsourcing, which we will cover in a future podcast.

HOST: NEAL BEGGAN: Thank you both for joining me today.


GARETH MONTAGUE-SMITH: Thanks, Neal.


PEYTON BLACK: Thank you.


HOST: NEAL BEGGAN: Gareth, let's start with you. Very simply, why should companies consider offshoring and what are the real benefits from a service provider's perspective?


GARETH MONTAGUE-SMITH: As companies and internal departments are increasingly asked to do more with less, a common solution is to offshore work. There are pros and cons and best practices that can be implemented.

GARETH MONTAGUE-SMITH: The two main benefits are cost and timeliness. From a cost perspective, we can deliver work at a much lower rate, which can translate to client savings and, for the service provider, increased internal profitability.

GARETH MONTAGUE-SMITH: In terms of timeliness, depending on the geographic location of the offshore team, you can have teams working on the project around the clock and multiple people working on tasks simultaneously.

GARETH MONTAGUE-SMITH: If you take a step back and think about a co-source model in general, it gives flexibility to manage resources like a tap: turn it on, off, or increase resources quickly. It can be very creative for your business if done correctly.


HOST: NEAL BEGGAN: Peyton, from a service provider's perspective or an internal audit shop, what are important considerations when thinking about offshoring internal audit functionality?


PEYTON BLACK: First, decide the ultimate objective. If the objective is cost, an obvious place to start is shifting SOX testing, focusing on larger populations of testing, such as 25-sample tests. Those are low-hanging fruit, typically high-volume, low-risk control testing.

PEYTON BLACK: These tasks often don't train your internal team and may not appeal to them, so they are good candidates to outsource. Another consideration is how the service provider sets up the review of deliverables.

PEYTON BLACK: In some instances, offshore staff perform the work, an offshore manager reviews it, and then an onshore manager reviews it again. That can increase cost and add days to the review process due to back-and-forth and time-zone differences.


GARETH MONTAGUE-SMITH: I agree with the comment about high-volume tasks being low-lying fruit. Service providers are investing in the quality and education of offshore teams, and their capabilities to understand and test more complex areas continue to evolve.

GARETH MONTAGUE-SMITH: A good example is using offshore resources to conduct walkthroughs or tests of design, a concept once considered nearly impossible. With increased use of Teams and Zoom and the necessity of remote work, that has become more feasible.

GARETH MONTAGUE-SMITH: A best practice we use is recording sessions, with participant consent, so you can play back the conversation and take screenshots of information shared when documenting the walkthrough. That enables offshore resources to document effectively.

GARETH MONTAGUE-SMITH: Beyond SOX, we've seen increases in offshoring capabilities for presentations, RFP responses, status updates, data analytics, and company research and analysis. Many offshore teams can now assist with operational audits, including data analytics tools.

GARETH MONTAGUE-SMITH: Regarding levels of review, it's a deliberate decision between the client and service provider on what review levels the client wants and how that affects cost. It depends on onshore resources, skills, project tasks, and availability.


PEYTON BLACK: Let me add an example from when I was a CAE. We used Gareth's team to assist when the COSO 2013 framework was updated. His offshore team had experience mapping the new principles to existing control frameworks, more so than the local team we were using.

PEYTON BLACK: That made sense from both a capabilities and cost perspective. The local onshore manager on Gareth's team, who I regularly worked with, performed a review and knew my style, so by the time it got to me it was turnkey.

PEYTON BLACK: From my perspective as a former CAE, offshoring is about delivery. Cost matters, particularly for heavy testing areas like SOX, but quality matters most. I want to know who is responsible for the quality of work.

PEYTON BLACK: Who will I hold accountable if things are not going well, the offshore manager or the onshore manager? That needs to be discussed before starting any project. We had a good outcome on the COSO mapping project because we discussed logistics upfront.


GARETH MONTAGUE-SMITH: You have to manage your offshore model like an onshore team: regular check-ins, review of work before it goes to the client, and possibly a mix of onshore and offshore review. Remember, many offshore team members are highly educated, often with master's degrees.

GARETH MONTAGUE-SMITH: Real issues arise when instructions from the onshore team to the offshore team are not clear and work is simply thrown over the wall. The offshore team needs a clear understanding of expectations, including format.

GARETH MONTAGUE-SMITH: I like to call this "inspect what you expect." Don't wait until the end of the project to check format, progress, or results. The offshore team wants to feel part of the team; they want to understand the client, risks, and objectives, not just be a body for testing.


HOST: NEAL BEGGAN: Great discussion. We typically keep this to five questions, but I'll add a bonus question. Peyton, anything else you think is relevant from a pros and cons perspective? Gareth, feel free to jump in.


PEYTON BLACK: One thing I enjoyed about working with offshore teams is the ability to get to know and experience their culture. I had an outsourced offshore team in Hong Kong and China and enjoyed seeing the differences and commonalities we shared. It made the work more interesting.

PEYTON BLACK: Another point often overlooked when focusing on cost is that offshoring can take away work and learning opportunities from internal teams. That is important to consider when developing your own team.


GARETH MONTAGUE-SMITH: Peyton and I are passionate about helping brand and coach internal audit departments. Having both sat in the CAE seat, we enjoy helping internal audit departments think through plans and execution.

GARETH MONTAGUE-SMITH: For instance, at Cherry Bekaert we have an over-100-person team based in Chennai, India, that we use to facilitate and support our work. Offshoring works for some organizations and not for others, and we'd be happy to discuss what works for you.


HOST: NEAL BEGGAN: Thanks, Peyton and Gareth, for your insight. You have unique perspectives from working together on both sides of the table.

HOST: NEAL BEGGAN: There are many considerations when deciding to use offshore resources. Offshoring can be an opportunity if handled correctly, and it is worth thoughtful planning before deciding on a staffing model.

HOST: NEAL BEGGAN: For more information on offshoring, SOX compliance, or internal controls, visit cbh.com/risk. Please like, share, and subscribe to the Risk and Accounting Advisory Podcast.

HOST: NEAL BEGGAN: Thanks again for listening.