There’s no question that executive compensation has come under the microscope recently. Since December companies have been dealing with new Securities and Exchange Commission requirements regarding various proxy disclosures about pay. SEC staffers have been asking for ever-more detail about compensation decisions for each executive named in the proxy. Now, new compensation-related rules are coming down the pike, thanks to the Dodd-Frank Wall Street Reform and Consumer Protection Act, signed into law Wednesday by President Obama.

As companies increasingly open up to the investing public, though, they may not be doing enough behind-the-scenes work to make sure their compensation practices are truly in line with the philosophies they are espousing. Fewer than half, or about 45%, of the internal auditors responding to a recent Institute of Internal Auditors (IIA) survey report that their company performs some type of internal review of executive compensation and benefits. And even those firms may not be going far enough, say industry experts.

“I have a suspicion that people are looking at various components of executive compensation and benefits,” such as cash compensation in conjunction with a payroll audit, or pension benefits as part of a general review of the pension plan, says Steven E. Jameson, chief internal audit & risk officer for Community Trust Bancorp. “But I would be surprised if anyone was hitting all components of it.”

Lynn Morley, a consultant specializing in internal-auditing issues and former director of internal audit for Suncor Energy, agrees: “Bits and pieces of executive compensation may be covered, but you won’t get some of the big risks until you approach it from [a more holistic], executive-only perspective.”

The IIA recently started a push to get internal audit more involved in reviewing executive-compensation plans, including writing up new guidance for auditors who are beginning the process. The 18-page guide outlines six categories of risk, including compliance risk and reputation risk, to which executive compensation can expose a company. “One of the key messages is that it’s a legitimate process for internal audit to get involved in,” says Morley, a co-author of the guidance.

The additional proxy disclosure requirements around executive pay, and the impending mandatory “say-on-pay” vote, are also push factors. “If companies are doing an appropriate risk assessment, this has to be moving up on the radar,” says Jameson.

The IIA survey shows that internal audit handles such reviews, in whatever scope they occur, at about one-third of the companies that perform them. Human resources is in charge of the review most often, at 46% of companies, although HR is likely to outsource the review to a third party such as the firm’s external auditor, says Morley.

What might internal auditors probe for? “They’ll want to make sure that whatever is happening is consistent with documents” and general policies, says Jameson, with criticisms likely related to executives claiming extra benefits or to other exceptions to rules, rather than to the overall design of a program. The IIA guidance encourages auditors to look beyond compliance, but, as Jameson says, “it’s a sensitive topic” and many are unlikely to do so.

Allowing internal audit to cover executive compensation and benefits is not likely to replace the work that an outside consultant might do in that area, however. “Outside consultants will [know] what other public companies are doing, and they’ll have first-hand knowledge about large private companies as well,” says Jameson. “Internal audit doesn’t have a ready source for that kind of information.”

Indeed, one new firm, Soundboard Review Services, is trying to make a market in exactly this area. According to co-founder Joshua Lurie, the consulting service has been hired by several companies, including DuPont, to sift through internal documents and talk with company employees and board members about their pay-setting processes. “What we’re most interested in seeing is if the [board] used and exercised good business judgments in their decisions,” says Lurie. “We believe that 99% of the time, if you have good processes in place, you’ll have good outcomes.”