Regardless of whether internal audit activities are outsourced, the board of directors remains ultimately responsible for the internal audit function.