United States

Internal audit services help large REIT enhance control processes


Download this case study


Our client is a large real estate investment trust (REIT) that manages assets in several different segments. Its main focus is retail, with a large portfolio of strip malls and drugstores. The company also manages a growing number of student housing assets near colleges and universities. The client is one of the largest public, nontraded REITs in the United States. As a nonaccelerated filer, they are required to comply with the Sarbanes-Oxley (SOX) Act of 2002 requirements.


As a public company, our client understood the importance of having an established internal audit function. Previously, they used multiple internal audit providers; however, the REIT was not getting the service they needed. Prior providers were not responsive, and the audit committee did not receive the communication and information they needed on a timely basis. Therefore, the company sought an internal audit provider with better communication, one that understands the challenges it faces and is more responsive.


RSM was chosen to outsource the internal audit function. As a first step, the RSM team developed a risk assessment to determine the key risk areas within the organization. Those areas were communicated to management and the audit committee, with the results being used to develop an internal audit plan.

The plan detailed specific audits that RSM would execute over the first year. Following these audits, the RSM team helped the REIT develop documentation through process flowcharts, giving it a better understanding of its control environment. That helped the organization gain greater visibility into processes and how data flows when handoffs of information occur between multiple departments and locations.

Several internal audit projects took place that aligned with the REIT’s overall goals and objectives. One example was an internal audit of the organization’s acquisition process. Another key special project was an assessment of information technology (IT) services provided by a shared services company, evaluating it from an operational perspective and determining whether the services the REIT received were in its best interests. RSM then provided recommendations and suggestions for enhancements and potential implications for each scenario.

The process reviews helped the REIT better understand what the vendor was providing, along with the related costs of the service. The results opened many eyes in the organization. Management was surprised with some services they thought they were getting, but were not in fact receiving, and that some equipment and data centers were antiquated. Based on these insights, in addition to the internal audit work, the company also requested that RSM assist with its IT SOX audits.

In addition, as part of our services to our internal audit clients, we provided education to the audit committee, detailing best practices for oversight. The team helped the company develop and implement stronger processes, while remaining transparent and integrating their concerns into the internal audit approach.

RSM’s internal audit approach is very flexible and designed to accommodate the changing needs of the company as it evolves. Now they receive the information they need to remain compliant and efficient, instead of receiving only what was indicated in the original framework. In addition to the IT SOX work, the company reached out to RSM for additional reviews, such as debt management.


The REIT’s audit committee requires an internal audit function, but it has an expectation for responsiveness and quality that previous providers did not live up to. RSM has built a strong relationship and a high level of trust with the organization, leading to multiple years of outsourced internal audit engagements and additional key projects. The company’s audit committee cannot be everywhere, and RSM evaluates the overall control environment, providing advice and educating the committee on processes within the organization.

Other benefits of RSM’s internal audit service to the REIT included:

  • A thorough internal audit plan, providing greater visibility into risks and the overall control environment
  • A better understanding and documentation of control processes
  • A new resource for the company to leverage to learn about processes and best practices and receive recommendations
  • A flexible internal audit approach that can change as the company evolves

How can we help you?

Contact us by phone 800.274.3978 or
submit your questions, comments, or proposal requests.


Complete our Cybersecurity Rapid Assessment form to be contacted about receiving our "quick-hit" evaluation of your organization’s overall security risk.

Learn more