Help companies assess their internal audit needs.

Now that the SEC has approved the November 2003 New York Stock Exchange rule that listed companies must have an internal audit function, clients and employers are asking their CPAs how it might affect their businesses and exactly what it requires. Here's a list of frequently asked questions and responses you can use to help these public companies assess their internal audit needs and readiness to comply.

* What companies are affected by the SEC's approval of the new standards? The commission's approval has an impact only on NYSE-listed entities. While the SEC also approved new listing standards for the Nasdaq stock market, these did not include an internal audit provision. As for large private companies with diverse and complex operations, many may find that developing such a function will assist them in maintaining, validating and improving internal controls; identifying opportunities to reduce costs and improve processes; and enhancing governance.

* Will companies have to add staff to meet the internal audit requirement? Companies with adequately staffed internal audit departments likely won't need to institute changes. Those that lack such a department or are understaffed may opt for an arrangement with a third-party provider other than the external auditor, as permitted by the regulations.

* What if a company already has an internal audit function? Companies should review their internal audit staffing. Employees should have the resources and skills to respond to cyclical workloads, meet the challenges of the current regulatory environment and address the risks they now confront.

* What is the proper internal audit staffing mix? CPAs should recommend companies look at their individual risk profiles to drive staffing decisions. Businesses that have complex transactions, are in heavily regulated industries or require highly secure data will require a range of specialists and experts. Most internal audit departments are headed by a chief audit executive and include layers of staff such as managers, senior auditors and auditors. Many companies also rely on other in-house professionals or tap into the specialized skill sets of outside providers.

* How much should a company spend on internal audit? Actual budgets vary widely, and risk should be one of the key factors in determining the level of expenditures and resources allocated. A recent Institute of Internal Auditors study identified a general range of between 0.03 percent and 0.2 percent of revenues for an internal audit budget.

* What are the first steps in initiating an internal audit function? Early steps should include clarifying expectations with senior management, the board and the audit committee; determining the appropriate staffing model (third-party provider, in-house or a combination thereof); and formulating reporting responsibilities. Other key tasks involve developing an audit charter, completing an initial risk assessment and developing an audit plan.

* What are the qualities of a strong internal audit function? The most salient qualities include an experienced and effective chief audit executive, a supportive audit committee and senior management team, a sound risk-assessment process, an identifiable and well-conceived audit methodology and a focus on meeting customer needs.

* What are the most effective ways for management to use internal audit? Corporate officers need to understand the key risks their company faces and work with internal audit to determine how best to mitigate them. They need to understand internal audit's role as primary support for management's assertion on internal control over financial reporting and safeguarding of assets against unauthorized acquisition, use or disposition.

* Can a company use its external auditor to perform internal audit work? Recent SEC regulations prohibit companies from hiring out internal audit work to their external auditor, although there are certain exceptions where a limited amount of internal audit work can be performed by an external auditor--for example, internal audit work is permitted if it won't be relied on as part of the external audit.