They are required for all companies that are listed. After the SOX act (after the ENROR scandal), the audit requirements became a stricter. I am not talking only about external audit requirements but also for internal audit. The bottom line is that listed companies (in the US) need to have an internal audit function and have their accounts audited by independent auditors.
For companies that are not listed, there are certain thresholds (for example number of employees, total turnover, assets etc.) above which a company needs to appoint external auditors. These threshold change though from time to time.