Legal status: October 2026 (MaRisk as amended by Circular 06/2026 (BA))
Why the question keeps coming up
Small and mid-sized institutions face a dilemma. Requirements for Internal Audit keep rising, yet a broadly staffed in-house audit unit is hard to run economically at a modest size. This is especially true where specialist knowledge is needed, for example in anti-money laundering, sanctions, ICT risk or outsourcing governance. No single auditor can cover everything in equal depth.
Outsourcing Internal Audit is therefore a realistic option for many firms. It only works if governance is right.
What speaks for outsourcing?
- Specialist depth on demand: You can draw on expertise without keeping it permanently in-house.
- Flexible capacity: Effort can be adjusted to the audit plan, special audits and peak loads.
- An independent outside view: An external auditor is not embedded in internal routines and questions the familiar.
- Predictable costs: Instead of fixed personnel costs, you pay for services actually rendered.
Non-financial institutions that are obliged entities under the German Anti-Money Laundering Act (GwG) can benefit too. For them, the point is to have the effectiveness of their safeguards independently reviewed, where this is appropriate given the nature and scale of the business. A dedicated audit department would often be oversized for that.
The regulatory framework
For credit institutions and financial services institutions in Germany, these provisions are the main reference points:
- Section 25a(1) sentence 3 no. 3 of the German Banking Act (KWG) requires internal control procedures with an internal control system and an independent Internal Audit function. Internal Audit must not be combined with other business units or control functions of the institution.
- Section 25b KWG governs the outsourcing of material activities and processes. The institution must take appropriate precautions against excessive additional risk, and effective risk management must cover the outsourced activities (para. 1). BaFin’s information and audit rights must remain intact (para. 3).
- MaRisk AT 4.4.3 covers Internal Audit, AT 9 covers outsourcing. Since the 9th MaRisk amendment (Circular 06/2026 (BA) of 30 June 2026), the requirements are more principles-based and more proportionate. Where additional requirements arise, a transitional period applies until 1 January 2027.
- Section 6(2) no. 7 GwG lists the independent review of policies and procedures among the internal safeguards, to the extent appropriate given the nature and scale of the business. Under Section 6(7) GwG, responsibility for the safeguards remains with the obliged entity. Anyone who has internal safeguards carried out by a third party must notify the supervisory authority beforehand, and the authority can prohibit the transfer. Before engaging a provider, check whether a notification is required for your set-up.
The key takeaway: you outsource the performance, not the responsibility. Senior management must be able to steer, oversee and, if necessary, defend the audit function itself.
Important when choosing a model: AT 9 No. 5 MaRisk provides for a full outsourcing of Internal Audit only in certain cases, namely for very small institutions (total assets of no more than EUR 1 billion on a four-year average) and for non-material subsidiary institutions within a banking group. All other institutions can outsource parts of the audit work (co-sourcing), but must ensure that the outsourced services are effectively monitored.
What to look out for when outsourcing
1. Materiality and risk assessment up front
Before deciding, carry out a documented analysis. It clarifies whether the outsourcing is material, which risks arise and how they are mitigated. When a special function such as Internal Audit is outsourced, it requires particularly careful examination how it remains integrated into risk management.
2. Independence and conflicts of interest
The provider must not mix advisory, implementation and audit mandates in ways that compromise its objectivity. Anyone who helped shape a project should not audit it afterwards. Reputable providers therefore keep audit and advisory work strictly separate, both organisationally and in terms of staff.
3. A contract with clear rights
The contract should cover audit and information rights, instruction and reporting lines, confidentiality, subcontractors and termination rights. Under the current MaRisk, Internal Audit needs not only a right to information but also a right of access to documents, systems and units, at any time and also when accompanying material projects (AT 4.4.3 No. 1). The provider must be able to exercise this in practice. Audit rights of the supervisor and the statutory auditors must be preserved.
4. Internal oversight remains mandatory
Appoint someone in-house to steer the audit plan, reports and follow-up of findings. “Outsource and forget” is the most common mistake and a classic audit finding. Where Internal Audit is outsourced in full, AT 9 No. 10 requires an independent and competent audit officer who reports directly to senior management. This person draws up the audit plan together with the provider, writes the quarterly report and checks whether findings have been remedied.
5. Audit plan and risk orientation
An external provider also works to a risk-based, multi-year audit plan. It must fit the institution’s risk profile and cover all material activities and processes, including AML and sanctions compliance.
6. Follow-up of findings
Audit only works if findings are consistently followed up. Audit findings need owners, deadlines and proof of effectiveness. The MaRisk expressly require the quarterly Internal Audit report to include the status of remediation and any outstanding material deficiencies from other reporting quarters (AT 4.4.3 No. 9). Without this findings management, audit remains paper.
7. Exit strategy
Before signing, clarify how you would continue the function if the provider fails or terminates: handover of working papers, knowledge transfer, transition periods.
When outsourcing is less suitable
For very large, complex institutions with high audit volumes and many specialist topics, an in-house unit is often more sensible, possibly complemented by selective co-sourcing. Where a provider would itself be involved in implementation, take a close look at potential conflicts of interest.
Conclusion
Outsourced Internal Audit is a proven model when materiality assessment, contract, independence and internal oversight are properly arranged. It then combines specialist depth with economic flexibility and gives senior management a reliable, independent picture.
Are you considering outsourcing your Internal Audit, or would you like to review your existing set-up? Get in touch.
