Why does my business need an internal audit? We have an external audit done annually. We don't have any problems.

Though most business leaders ask that question, experts from Leading Edge firms say an internal audit is extremely valuable.

"Companies, small or large, ideally like to know their policies and procedures are being followed," says Lynne Burkart, a director at Leading Edge firm Postlethwaite & Netterville.

Robert Reynolds, director of accounting and assurance services at Leading Edge firm Brady Ware, agrees, noting that internal audits are not needed necessarily because of a problem.

"The real reason to have an internal audit is to make sure your internal controls safeguard assets, systems, etc. for effective financial planning," he explains.

Internal audits are an objective review of the policies and systems a company has in place but sometimes are never tested. "You have all these policies and procedures. It's just paper until somebody comes around and follows up on it," Reynolds says.

Tom Grottke, principal and director of financial services at Leading Edge firm, Carlin, Charron & Rosen, says internal auditors can serve as a second set of eyes with a different perspective than owners and managers who may be focused only on how to get their product or service to market as quickly and efficiently as possible.

Internal audits are especially critical for owners and managers who may not be as involved in the day-to-day operations, Grottke says.

Burkart says most companies think they have the right controls, but the objective review can provide great reinforcement or it can highlight areas for improvement in operations, efficiency and risk management.

"An internal audit drills down deeper to find the oil," she notes.

Reynolds says the first step is to make sure you formally document your controls, the policies and procedures you expect employees to follow. A lot of times controls are there, but they're not in writing, he says. "Written explanations allow you to show new hires, 'this is how we do it.'"

One company with sales totaling more than $80 million had been urged for years by Reynolds to develop an accounting manual. Now that the CFO and controller both plan to retire in the next 18 months, the owner finally sees the need to do so.

"It ought to be a priority now for everyone," he says, noting such documentation can help at those times when you experience an employee's sudden departure.

Burkart says that with existing policies and procedures documented, a good beginning point for an internal audit is for company leaders to do their own risk assessment. Ask questions such as what things aren't going as well and what could go wrong.

Consider those areas where there is a potentially relative ease to have an irregularity or to commit fraud, Grottke says. For example, an internal auditor may ask managers if they thought about the office administrator, Julie. She opens envelopes with cash, posts the payments, sends the bills and makes the deposit, all for only $15,000 a year. "Ever think she might want $25 to go to dinner one night?," he asks them.

In this case, another person should be involved in the process, or at the very least, closely oversee and reconcile the work that Julie is doing, Grottke says.

What if Julie does it all and your business is small enough that no one else can reconcile her work? One resolution is to have the business' bank statements mailed to the owner's home where he or she can examine the contents to make sure they're proper and deliver the opened bank statement to Julie.

Or perhaps the company has a service truck on the road and a tool shows up missing every now and then. The cumulative effect may never be measured so the company is unaware that the missing tools really are theft by the employee. Conducting internal audits, however, help create a culture of control.

After determining what areas need to be assessed, the next step is to have someone, an in-house person who is not directly involved in the particular area being reviewed or an outside consultant, conduct the evaluations. "The objective review can validate your processes or show a need for improvement," Burkart says.

Years ago, Reynolds worked for a chain of 7-11 convenience stores and was responsible for conducting a brief internal audit of the cashiers. He would show up unannounced, run a tape of the register and count the cash drawer. An employee who was plus or minus $5 would be written up. Three write-ups in a year and the employee was dismissed. "It was standard operating procedure," Reynolds notes.

That's the critical step to an internal audit-proper follow up to your investigative findings creates an environment where internal controls can succeed.

Reynolds refers to the 7-11 unexpected cash register check he did years ago. "The first time somebody got fired for coming up $5 over or under three times in a year, everyone realized they had to meet these controls," he explains.

Internal controls and testing are becoming the standard operating procedures at more companies these days because of the increased sensitivity and interest in corporate responsibility.

Third parties are more interested than they have been, Burkart says. For example, an insurance company may want proof that your policies and procedures are in place and effective before it considers issuing executive and directors insurance.

Executing internal controls does not have to be costly and time consuming. Gottke says he recommends internal audits when a company has 20 or more employees, or at least two locations.

Sometimes, internal audit steps can be simple and still demonstrate the company's commitment to fiscal and customer service responsibilities.

Mystery shoppers, for example, test retail stores to make sure the parent company's policies and procedures are working and done uniformly. "A Big Mac is a Big Mac no matter where you are," Reynolds notes.

A financial internal control could be having someone other than those who handle the day-to-day finances review the bank statements for odd entries with unfamiliar names or amounts. Then, the owner can sign off on the financial statements knowing that he or she has truly followed the safeguarding procedures.

"It's a lot harder for a business owner today, even with an annual audit or review, to cry foul or ignorance (if a problem is discovered). We've lost our tolerance for that," Reynolds says of the aftermath effects of high-profile corporate scandals.

Nonprofit organizations also must face the responsibility of internal controls and audits. Board members need to be educated on their roles and responsibilities, particularly when the group receives state or federal money, which has its own set of rules. A quality control function is essential to making sure the money goes where it should and the organization is compliant with grant requirements.

Benefits to internal auditing include minimizing waste, improving customer service and safeguarding your assets. "Knowing your internal systems are operating as they should is very important for a business owner. However, at the end of the day, the greatest benefit is the understanding where the potential weaknesses are in your system so corrective action can be taken," Reynolds says. e