Are there best practices for the time of year in which to do it? For example, is it best to do it in Q3/Q4 prior to the external auditors coming in for year-end?
Some companies choose to do a recovery audit during the months in which is most convenient, based on volume and workload. Since a recovery audit is usually looking at the past three years and your auditors should be looking at past six+ months, the RA should not be a higher priority for picking when to begin. If you look at workload, it is usually best not to pick Q3/4 due to the heavy year-end requirements.
Recovery audit does bring added work; based on the findings, you will need to make correcting/adjusting entries into AP. You will need time to do that, especially if you have the RA firm review with you their findings and recommendations for preventing these situations in the future.