Internal Audit costs: how to compare quotes and scope

Define processes covered, sampling, site visits and follow-up testing rather than promising every risk is eliminated.

Describe the expected outcome of internal audit and ask the provider to identify the work needed to reach it. A narrow filing quote and a wider advisory engagement cannot be compared on headline price alone.

Complexity can increase when records are incomplete, prior periods need correction, there are several locations or entities, or a matter requires representation rather than routine preparation. Ask whether software, travel, government payments, certification and applicable taxes are included.

Put deliverables, dependencies, exclusions and approval responsibilities next to each other. Request a written definition of completion: an application submitted, an acknowledgement received, a report issued or a continuing monthly service. These are different outcomes.

How are findings prioritised and how will remediation be retested?

Ask for advance approval before work outside the scope is billed. Specify how portal queries, corrections, historical cleanup or follow-up meetings will be handled. A fixed fee for a defined task does not remove the uncertainty of third-party processing or a contested matter.

Assess risk, agree tests, validate findings and assign corrective actions with owners.

Maintain the risk assessment, findings register, management responses and follow-up evidence.

A usable handover, explained assumptions and accessible records can matter more than a small initial saving. Request a service-specific proposal based on your facts; do not assume an advertised starting price includes the full engagement.