What companies are affected by the SEC’s
approval of the new standards? The
commission’s approval has an impact only on
NYSE-listed entities. While the SEC also approved
new listing standards for the Nasdaq stock market,
these did not include an internal audit provision.
As for large private companies with diverse and
complex operations, many may find that developing
such a function will assist them in maintaining,
validating and improving internal controls;
identifying opportunities to reduce costs and
improve processes; and enhancing governance. |
Will companies have to add staff to meet
the internal audit requirement?
Companies with adequately staffed
internal audit departments likely won’t need to
institute changes. Those that lack such a
department or are understaffed may opt for an
arrangement with a third-party provider other than
the external auditor, as permitted by the
What if a company already has an
internal audit function?
Companies should review their
internal audit staffing. Employees should have the
resources and skills to respond to cyclical
workloads, meet the challenges of the current
regulatory environment and address the risks they
What is the proper internal audit
staffing mix? CPAs should
recommend companies look at their individual risk
profiles to drive staffing decisions. Businesses
that have complex transactions, are in heavily
regulated industries or require highly secure data
will require a range of specialists and experts.
Most internal audit departments are headed by a
chief audit executive and include layers of staff
such as managers, senior auditors and auditors.
Many companies also rely on other in-house
professionals or tap into the specialized skill
sets of outside providers.
How much should a company spend on
internal audit? Actual budgets
vary widely, and risk should be one of the key
factors in determining the level of expenditures
and resources allocated. A recent Institute of
Internal Auditors study identified a general range
of between 0.03 percent and 0.2 percent of
revenues for an internal audit budget.
What are the first steps in initiating
an internal audit function?
Early steps should include
clarifying expectations with senior management,
the board and the audit committee; determining the
appropriate staffing model (third-party provider,
in-house or a combination thereof); and
formulating reporting responsibilities. Other key
tasks involve developing an audit charter,
completing an initial risk assessment and
developing an audit plan.
What are the qualities of a strong
internal audit function? The
most salient qualities include an experienced and
effective chief audit executive, a supportive
audit committee and senior management team, a
sound risk-assessment process, an identifiable and
well-conceived audit methodology and a focus on
meeting customer needs.
What are the most effective ways for
management to use internal audit?
Corporate officers need to
understand the key risks their company faces and
work with internal audit to determine how best to
mitigate them. They need to understand internal
audit’s role as primary support for management’s
assertion on internal control over financial
reporting and safeguarding of assets against
unauthorized acquisition, use or disposition.
Can a company use its external auditor
to perform internal audit work?
Recent SEC regulations prohibit
companies from hiring out internal audit work to
their external auditor, although there are certain
exceptions where a limited amount of internal
audit work can be performed by an external
auditor—for example, internal audit work is
permitted if it won’t be relied on as part of the