Internal audit plays an indispensable role in the business environment. From providing assurance about risk mitigation to identifying opportunities for cost savings, internal audit simply helps businesses operate better. So obvious is its value that the New York Stock Exchange requires all listed companies to have an internal audit function. Yet, despite the widespread embrace of internal audit by publicly traded companies, there is still one category of businesses for which the possibility of enjoying its benefits of appears, at least temporarily, to be out of reach: small businesses.
Representing 99.99% of all businesses and 43.5% of US GDP, small businesses are the lifeblood of the American economy. Despite this disproportionate role in the economy, small businesses suffer from an inherent limitation that prevents them from enjoying the benefits of internal audit: lack of resources. According to Glassdoor.com, as of April 2025, based on forty-four salaries disclosed, the median salary for a chief audit executive in the US is over $240k a year. For many small businesses, increasing their budgets by this amount for any expense is unfathomable. Even for those businesses that can achieve that much net income, out of all the possible uses of the money, paying an annual salary of a chief audit executive is likely to be at the bottom of the list of priorities, especially when compared to more immediate concerns, such as repaying loans or reinvesting to achieve scale. As rational as this prioritization sounds, the presence of seemingly more urgent priorities does not diminish the inherent risks of the various business processes needed to run a small business and the need to control these risks. Consequently, in the absence of an internal audit function, small businesses are at risk of operating inefficiently, encountering materialization of risks, and possible ultimate failure.
It is no wonder that, according to current data from the Commerce Institute, the five-year survival rate of small businesses barely surpasses 50%. While this poor survival rate is likely due to a variety of factors (including those unrelated to the quality of business administration, such as low market enthusiasm or an inability to compete), at least some of these failing businesses might have had a fighting chance if they had an opportunity to enjoy the benefits of internal audit. In other words, the lack of internal audit scrutiny is an aggravating factor in the poor odds that small businesses regularly face.
CPAs should be on the front lines of solving this problem, as the low success rate of small businesses directly impacts CPAs and CPA firms. Every small business that fails represents one less customer for tax preparation and accounting services, or one business that will never achieve the scale to go public and seek an auditing firm for a SOX opinion. In short, the symbiotic relationship between CPAs and small businesses necessitates a CPA-led initiative.
While the mutual need for a solution to this problem is clear, what remains uncertain is how to bring internal audit to small businesses in a way that is sustainable and cost-effective. One solution would be for entrepreneurial, intrepid CPAs with internal auditing expertise to partner with talented software engineers to develop customizable software. This approach could help small businesses be their own internal auditors. This software could be cheaply developed by a CPA firm, with the help of AI, and could be sold to business owners, CEOs, COOs, and investors. This software would, ideally, bring a basic internal audit framework to customers with no prior finance background and provide them with the ability to identify risk, learn about best practices, document controls, perform testing, and identify control weaknesses.
To illustrate the potential benefits of this product, consider a small business that operates for ten years before achieving enough scale to afford to hire its first chief audit executive. Even if resource constraints would be allowed for only one audit per quarter, over the ten-year period, forty audits could be conducted. At a minimum, these audits represent opportunities for the business to educate itself about risks inherent in its various departments. Control deficiencies identified could be mitigated before they became problems. For example, a business owner using this theoretical software might identify incompatible duties assigned to the same employee and take steps to ensure prompt detection of embezzlement.
Another benefit of this potential software would be that once a small business achieved enough scale to afford its first audit employee, that employee would not have to build a new audit program from scratch. He or she would be joining a company that would have already created an audit universe, performed a risk assessment, drafted an audit plan, and been operating with a basic audit methodology. By contrast, when a chief audit executive joins a newly created audit function of a business, it typically takes weeks and even months of laying the groundwork (for example, drafting an audit charter, surveying the different departments, drafting policies and procedures, etc.) prior to conducting the inaugural audit. If this proposed solution could be implemented, it would not only help businesses “weather the storm” in those beginning years of operations but also set them up for success when they decided to invest resources in a new audit function.
To be sure, there are obstacles that would need to be overcome to produce this type of software. Small businesses come in all shapes and sizes and span a variety of industries. A one-size-fits-all platform is not appropriate. Risks and corresponding controls are different for a house-flipping business, as compared to a restaurant. Due to these differences, customization would have to be limited to achieve economies of scale. It is important to bear in mind that the purpose of the software would be to help identify, map, monitor, and mitigate risk—not to conform with the latest Institute of Internal Auditors (IIA) Internal Audit Standards. In other words, even imperfect audits that would make the IIA cringe are better than no audits. These problems, therefore, must be taken into consideration when designing this product.
Internal audit is fundamental to business. There is no reason it cannot be more widely available. Just as the Protestant Reformation took away the monopoly on interpretation of Christianity that the clergy of the Catholic Church had enjoyed, by bringing it to the people, so CPAs should create a “sola scriptura” of internal audit to bring to small businesses, which face enough headwinds that threaten their viability and longevity. Internal audit is but another tool to help small businesses not only compete, but to thrive! CPAs may hold the key to the future of internal audit for small businesses by developing futuristic tools like those discussed above. All this challenge needs is a dedicated CPA willing to take a chance.
Joshua Schutze, CPA, CIA
References
Commerce Institute. 2025. “What percentage of businesses fail each year? 2025 Data Reveals the Answer.”https://www.commerceinstitute.com/business-failure-rate/.
Ferguson Melhorn, S., Hoover, M., & Lucy, I. (2024). “See the data behind America’s small businesses.” U.S. Chamber of Commerce. https://www.uschamber.com/small-business/small-business-data-center).
Glassdoor. “Chief Audit Executive Salaries.” Last updated April 10, 2025. https://www.glassdoor.com/Salaries/chief-audit-executive-salary-SRCH_KO0,21.htm.
