A certain level of internal auditing must be carried out by the enterprises to ensure corporate objectives are met and no faults or deficiencies are discovered in the course of official inspection. Internal auditing is an organic part of ERM (Enterprise Risk Management) while ERM is integrated into the business model. Internal auditing, which forms the sub-system of the corporate controlling system in addition to ownership audits, can be divided into two parts: the internal control system and independent internal audit. By means of the questionnaires of our exploratory research the controls and auditing methods that support management to the greatest extent have been identified. Its significance lies in the fact that such research on SMEs does not exist in Hungary as only the internal control system and auditing situation of larger companies have been revealed so far. The proportion of SMEs in Hungary is similar to that of the EU average so new information suitable for regional comparison has been created that also aligns the possible future direction of research.