Academic journal article Journal of Accountancy

Internal Audit's New Role: Put Together a Top-Notch Department

Academic journal article Journal of Accountancy

Internal Audit's New Role: Put Together a Top-Notch Department

Article excerpt


* NYSE-LISTED COMPANIES MUST HAVE INTERNAL audit departments in place in advance of an October 31 deadline. Internal auditors also are evaluating the scope of work their departments should take on to comply with Sarbanes-Oxley and other rules.

* A COMPANY STILL PUTTING TOGETHER ITS INTERNAL audit department should proceed logically, hiring a new director first and letting him or her develop a plan for the audit function. In the search for a new director companies should involve not only the CFO but also human resources and the board of directors.

* THE BIGGEST TASKS THE INTERNAL AUDIT DEPARTMENT faces are determining the scope of work and having the personnel and budget to complete it. In instituting internal controls over financial statements, companies must decide how they will document their compliance and how much of this work they expect internal auditors to complete. In most cases the department also will need to balance this work with its pre-404 tasks.

* COMPANIES SHOULD EXPECT TO PAY BETWEEN .03% and .2% of annual revenues for an effective internal audit function that also fulfills Sarbanes-Oxley requirements. Companies that pay at the top of the range typically are highly regulated, decentralized entities with facilities spread across the globe.

* AS INTERNAL AUDIT DEPARTMENTS SHED SOME of their operations focus, they must evaluate existing staff to see who has the financial expertise the department needs to perform its new functions. Communication skills also will be important to internal auditors as they undertake their new responsibilities, especially building relationships with the board's audit committee.

Not since WorldCom whistle-blower Cynthia Cooper graced the cover of Time magazine has internal audit been in such sharp focus. The New York Stock Exchange (NYSE) now requires all companies listed there to "maintain an internal audit function to provide management and the audit committee with ongoing assessments of the company's risk management processes and system of internal control"--and do it before October 31, 2004.

This rule will affect CPAs in many companies. While most of the 2,800 NYSE-listed companies already maintained internal audit departments, the fact that some did not prompted the exchange to require them. Experts estimate about half of NYSE companies, including some that already had internal audit departments, will need to take action to comply with the ruling. An Institute of Internal Auditors (IIA) survey in late 2003 showed 80% of the large companies included in the Fortune 1,000 already had an internal audit function. Even though the Nasdaq declined to require the same of the 3,400 companies trading there, it supports an internal audit function as a best practice.

Since the NYSE stopped far short of fully defining the role the now-required internal audit function must fulfill, each company is left to determine on its oven what constitutes a properly structured internal audit department. CPAs who serve as internal auditors or as CFOs or controllers who oversee their employer's internal audit department will find themselves needing to decide what ongoing assessments might be necessary. New internal audit directors must determine the scope of work their group should address, the skills required, the cost of the task and what framework to follow. Companies that currently have internal audit departments can answer some of these questions. By reporting the experiences of some of these entities, this article will help CPAs introducing or expanding an internal audit function to better understand the task they face.


"The move to establish internal audit functions will spread because a properly structured internal audit department adds value" to any company, says Robert Hirth, CPA, a managing director of internal audit services at Protiviti Inc., a risk management and internal audit consultant in Menlo Park, California. …

Search by... Author
Show... All Results Primary Sources Peer-reviewed


An unknown error has occurred. Please click the button below to reload the page. If the problem persists, please try again in a little while.