Dubai, UAE · Written by Sajjad Asif, Managing Director · 6 min read
Every hotel group eventually asks the same question: do we build an internal audit function in-house, bring in outside specialists, or blend the two? The right answer depends less on budget than most operators assume, and more on what the function actually needs to achieve.
Three Models, Not One Right Answer
Internal audit doesn’t have to be all-or-nothing. Most groups fall into one of three models, and the right fit changes as the business grows, restructures, or takes on new properties.
Fully In-House
A dedicated internal audit team, employed directly, running the full annual plan themselves. Works well at scale, but carries fixed headcount cost even in quieter periods and can struggle to keep pace with specialist areas like IT general controls or tax.
Fully Outsourced
An external firm runs the entire internal audit function — planning, fieldwork, reporting — as if it were your own department, without the fixed overhead. Common for groups without the scale to justify a standalone internal audit team year-round.
Co-Sourced
Your own team runs part of the plan, while specialists are brought in for specific areas — IT audit, tax, or a particular property type — or simply to add capacity during a busy period. The most common model for mid-sized groups.
“The mistake we see most often isn’t choosing the wrong model, it’s never revisiting the choice. A group that outsourced everything at 5 properties often still should be doing that at 25 — but not always, and the only way to know is to actually look at it.”
— Sajjad Asif, Managing Director
Questions That Actually Determine the Right Fit
- How many properties, and how spread out? — A single-city portfolio has very different logistics from one spanning multiple countries or time zones.
- Do you have specialist needs? — IT general controls, tax, or hospitality-specific risk areas often need expertise an in-house generalist team doesn’t have.
- How much does the plan fluctuate year to year? — Fixed in-house headcount is efficient when the workload is stable, and expensive when it isn’t.
- Does the owner or board expect independence? — Some ownership structures specifically require a level of independence that’s harder to demonstrate with a fully in-house team.
- What’s actually happening today, versus what was decided years ago? — Many groups are running a model that made sense at a different size or ownership structure, and haven’t revisited it since.
What Good Co-Sourcing Actually Looks Like
Co-sourcing works best when the split is deliberate, not accidental. That means a documented internal audit plan showing exactly which areas your own team owns and which are covered externally, a single reporting line so findings don’t get lost between two teams, and a genuine transfer of knowledge — the external specialist should be building your team’s capability, not just filling a gap indefinitely.
Signs your current model may need a second look
- The same specialist gaps show up in every audit cycle, year after year, with no plan to close them.
- Internal audit headcount sits idle for part of the year, or is consistently overwhelmed at year-end.
- Findings from IT, tax, or hospitality-specific reviews consistently arrive later or feel less rigorous than the rest of the plan.
- Nobody can clearly explain why the current model was chosen, only that “it’s what we’ve always done.”
The Real Cost of the Wrong Model
An internal audit function that’s mismatched to the business doesn’t just cost more than it should — it produces weaker assurance. A stretched in-house team skips depth to cover breadth. A fully outsourced arrangement with no institutional handover leaves the organisation no more capable next year than it was this year. Getting the model right is what makes the rest of the internal audit programme actually work.
Not Sure Your Internal Audit Model Still Fits?
We work as a fully outsourced internal audit function or alongside your existing team, bringing specialist capacity exactly where it’s needed.