Will companies have to add staff to meet the internal audit requirement? Companies with adequately staffed internal audit departments likely won’t need to institute changes. Those that lack such a department or are understaffed may opt for an arrangement with a third-party provider other than the external auditor, as permitted by the regulations.

What if a company already has an internal audit function? Companies should review their internal audit staffing. Employees should have the resources and skills to respond to cyclical workloads, meet the challenges of the current regulatory environment and address the risks they now confront.

What is the proper internal audit staffing mix? CPAs should recommend companies look at their individual risk profiles to drive staffing decisions. Businesses that have complex transactions, are in heavily regulated industries or require highly secure data will require a range of specialists and experts. Most internal audit departments are headed by a chief audit executive and include layers of staff such as managers, senior auditors and auditors. Many companies also rely on other in-house professionals or tap into the specialized skill sets of outside providers.

How much should a company spend on internal audit? Actual budgets vary widely, and risk should be one of the key factors in determining the level of expenditures and resources allocated. A recent Institute of Internal Auditors study identified a general range of between 0.03 percent and 0.2 percent of revenues for an internal audit budget.

What are the first steps in initiating an internal audit function? Early steps should include clarifying expectations with senior management, the board and the audit committee; determining the appropriate staffing model (third-party provider, in-house or a combination thereof); and formulating reporting responsibilities. Other key tasks involve developing an audit charter, completing an initial risk assessment and developing an audit plan.

What are the qualities of a strong internal audit function? The most salient qualities include an experienced and effective chief audit executive, a supportive audit committee and senior management team, a sound risk-assessment process, an identifiable and well-conceived audit methodology and a focus on meeting customer needs.

What are the most effective ways for management to use internal audit? Corporate officers need to understand the key risks their company faces and work with internal audit to determine how best to mitigate them. They need to understand internal audit’s role as primary support for management’s assertion on internal control over financial reporting and safeguarding of assets against unauthorized acquisition, use or disposition.

Can a company use its external auditor to perform internal audit work? Recent SEC regulations prohibit companies from hiring out internal audit work to their external auditor, although there are certain exceptions where a limited amount of internal audit work can be performed by an external auditor—for example, internal audit work is permitted if it won’t be relied on as part of the external audit.