When Ben Franklin said that an ounce of prevention is worth a pound of cure, he could easily have been referring to the value of an internal audit. Properly conducted, an internal audit ensures that your company is compliant with the applicable policies, procedures and laws of your industry, state and country.  At best, the process verifies that your company is being run responsibly. At worst, serious problems are detected and can be addressed.  Most audit reports fall somewhere in between the aforementioned extremes, but nearly all result in actionable recommendations that will leave your company in better condition.

To initiate an internal audit process at your company, you can:

1. Bring in a specialist
2. Use internal audit software
3. Purchase an internal audit kit

Hire some help
An internal audit is a complex and labor-intensive process, and not every business has the resources or desire to tackle it in-house.

You can save time and effort — and gain credibility — if you go with an outside outfit, usually an accounting firm. Some firms are exclusively dedicated to internal audits, while others have a department of audit specialists.

If you go this route, you should not use the firm that handles your books regularly. The law prohibits your established accounting processes from overlapping with the internal audit, to avoid any potential conflicts of interest.

Get with a program
The audit process is fundamentally a matter of collecting and organizing information.  As such, the right software platform can be a significant boon to the process.

Internal audit software, such as AutoAudit for Windows by Paisley or ACL Desktop Edition by ACL Services, is available as a standalone application or as part of a risk management suite, and typically comes equipped with workflow management and version control functions.  These capabilities streamline collaboration among members of your audit team and facilitate the process of disseminating improvement recommendations to your staff.

Fill in the blanks
The ISO 9001 quality management system includes an annual internal audit as a requirement for certification.  It provides informational support kits stocked with forms, reports, checklists and schedules. It also has audit training and coaching kits.

All of these resources are designed to help the internal auditor or auditing committee assess organizational risk and controls, verify compliance and recommend process, policy and procedural improvements.

To be effective, an audit will need to cover a significant time span in order to provide reliable statistical sampling.  A month may be sufficient, but a fiscal quarter is better, and a full year better yet.

No matter what method you use for an audit, make sure you act on the findings. Your audit report is only information. Without action, it's neither prevention nor a cure.