Brink’s Modern Internal Auditing: A Common Body of Knowledge is the large reference text that Robert R. Moeller has carried forward from the work of Victor Z. Brink, one of the founders of the profession. Its eighth edition, published by Wiley in January 2016 and the most recent we could find, runs to 832 pages in 34 chapters and eight parts: the foundations of internal auditing; internal controls, from the COSO framework to Sarbanes-Oxley, COBIT and enterprise risk management; planning and performing audits; organising and managing the function; information systems; governance, ethics and fraud; the professional internal auditor; and the quality, Lean and ISO disciplines that Moeller groups as professional convergence. Its organising idea is in the subtitle. The book defines a common body of knowledge, a statement of what internal auditors need to know, which each chapter breaks into its own elements and which Moeller says rests on more than forty years of his own experience, research and professional activity rather than on surveys of what other auditors do.
A reference work of this kind is consulted more than it is read, and this guide does not summarise it chapter by chapter or reproduce its content. It explains what each part covers and how a function can use it in 2027, and it says plainly where the eighth edition predates current practice. It was written before the IIA revised its Standards with effect from January 2017 and before they were replaced by the Global Internal Audit Standards, published in January 2024 and effective from 9 January 2025; before the IIA’s 2020 Three Lines Model; before COSO’s 2017 update of its enterprise risk management framework; and before NIST’s Cybersecurity Framework 2.0. The guide ends with a worked example in which a $9 billion bank’s audit function uses the book as the spine of its training curriculum and checks each part against current sources. The Sawyer’s Guide summary covers another comprehensive internal audit reference.
In this guide
- The book in one page
- Who Robert Moeller is, and how the book came about
- The structure: eight parts, thirty-four chapters
- The common body of knowledge: what Moeller means by it
- Where the eighth edition predates current practice
- How to use a reference book in 2027
- The nine ideas worth keeping
- The vocabulary: fourteen terms defined for practitioners
- What it means for internal audit: a part-by-part map
- The criticisms, and what the book leaves out
- Editions, reading time and how to read it
- A one-hour discussion guide for an audit team
- Worked example: Lakeshore Bancorp builds a curriculum on it
- Frequently asked questions
- Related guides
The book in one page
| Question | The answer, in our words |
|---|---|
| What is it? | A reference text and, in its preface’s words, a definition of a common body of knowledge for internal auditing: what individual auditors need to complete audits, and what an organisation needs to set up an effective function. |
| Who wrote it? | Robert R. Moeller, a CPA, CISA, CISSP and PMP who built Sears Roebuck’s first corporate information systems audit function and later founded his own firm. He wrote the fifth edition, in 1999, and every edition since, including the eighth. |
| Where does it come from? | Victor Z. Brink’s doctoral thesis, completed at New York University in 1941, and the first edition, Modern Internal Auditing, in 1942, according to the fifth edition’s preface. Brink revised it three times, the last two with Herbert Witt. |
| How is it organised? | Eight parts and 34 chapters. The preface lists the knowledge elements found in each chapter, and the preface separates the topics that call for strong knowledge from those where a general understanding is enough. |
| What does it do well? | In our reading, breadth: the whole span of an internal audit function’s work in one volume, with controls frameworks, information systems, governance and fraud side by side. |
| Where is it out of date? | It predates the Global Internal Audit Standards and their topical requirements, the Three Lines Model, COSO’s 2017 ERM framework, COBIT 2019, NIST CSF 2.0 and the 2025 CIA syllabus, and no chapter title mentions cloud computing or artificial intelligence. |
| Why use it as an auditor? | As a structured reference and the spine of a training curriculum, provided every procedure taken from it is checked against the current Standards and frameworks. |
| Reading time | Not a cover-to-cover read. Our estimate is an evening per part for study; most readers will consult it a chapter at a time. |
Who Robert Moeller is, and how the book came about
The author biography carried with the eighth edition describes a career centred on information systems audit. Moeller was national director of information systems auditing at Grant Thornton, where he developed firm-wide audit procedures and was responsible for the Chicago office’s IS consulting practice. In 1989 Sears Roebuck recruited him to build its first corporate information systems audit function, at a time when the Sears group included Allstate Insurance, Dean Witter, Discover Card and the retail business, and he later became audit director there. He helped launch a consulting practice at EMC, founded Compliance and Control Systems Associates in 1996 to run seminars on internal controls and corporate governance, managed telecommunications projects, including a worldwide cellular telephone financial system, and led Sarbanes-Oxley section 404 projects. He holds an MBA in finance from the University of Chicago, an undergraduate engineering degree and the CPA, CISA, PMP and CISSP credentials. He was president of the IIA’s Chicago chapter, served on the IIA’s International Advanced Technology Committee and chaired the AICPA’s Computer Audit Subcommittee. His other books include Sarbanes-Oxley and the New Internal Auditing Rules (Wiley, 2004), IT Audit, Control, and Security and Executive’s Guide to COSO Internal Controls.
The book is older than its author’s career. According to the preface of the 1999 fifth edition, Victor Z. Brink completed a doctoral thesis at New York University in 1941 arguing that internal auditors should serve management rather than act chiefly as assistants to external auditors, and the first edition, Modern Internal Auditing, followed in 1942 and promoted what became known as operational auditing. Brink revised it three times, with Herbert Witt, who had worked at Price Waterhouse and in the Office of Inspector General of the US Department of Health and Human Services, working on the last two revisions; the fourth edition appeared in 1982, and Brink died in 1992. Moeller wrote the fifth edition, published in 1999 under his and Witt’s names, and every later one: the sixth in 2005, the seventh in 2009 and the eighth, all from Wiley. The eighth edition’s preface explains the word modern in the title: Brink’s first edition described a new profession whose early practitioners were often little more than clerical support for external auditors, and Brink envisaged a much broader service to management.
For the eighth edition, Moeller describes the main change as a sharper focus on which knowledge areas are essential, separating those that call for strong knowledge from those where a general understanding is enough. He names the forces behind it as pervasive information technology and the Internet, consistent rules for defining internal controls, and a global economy. He writes for internal auditors at every level of experience, in any business area and any country, and adds that senior managers, regulators and other professionals should understand what internal auditors do. The book appeared in Wiley’s Corporate F&A series, in hardback and in three electronic formats.
The structure: eight parts, thirty-four chapters
The table reproduces the book’s table of contents at part and chapter level, as listed by O’Reilly and by the bookseller Lavoisier and in the publisher’s own reading sample, with a summary of what each part covers drawn from the preface’s guide to the parts. The right-hand column is the guide’s view of how to use each part now.
| Part | Chapters | What the part covers, from the preface | How to use it in 2027 (our view) |
|---|---|---|---|
| One: Foundations of Modern Internal Auditing | 1 Significance of Internal Auditing in Enterprises Today: An Update; 2 An Internal Audit Common Body of Knowledge | Background on the importance of internal auditing and the case for a body of knowledge | Read once; chapter 2 is the key to the rest |
| Two: Importance of Internal Controls | 3 The COSO Internal Control Framework; 4 The 17 COSO Internal Control Principles; 5 Sarbanes-Oxley (SOx) and Beyond; 6 COBIT and Other ISACA Guidance; 7 Enterprise Risk Management: COSO ERM | Internal control reviews: the revised COSO framework, Sarbanes-Oxley, COBIT and COSO ERM | COSO chapters as background; replace the ERM and COBIT material with the current frameworks |
| Three: Planning and Performing Internal Audits | 8 Performing Effective Internal Audits; 9 Standards for the Professional Practice of Internal Auditing; 10 Testing, Assessing, and Evaluating Audit Evidence; 11 Continuous Auditing and Computer-Assisted Audit Techniques; 12 Control Self-Assessments and Internal Audit Benchmarking; 13 Areas to Audit: Establishing an Audit Universe and Audit Programs | Audit standards, evidence, continuous auditing, control self-assessment and audit universes | Use for method; replace chapter 9 with the Global Internal Audit Standards |
| Four: Organizing and Managing Internal Audit Activities | 14 Charters and Building the Internal Audit Function; 15 Managing the Internal Audit Universe and Key Competencies; 16 Planning Audits and Understanding Project Management; 17 Documenting Audit Results through Process Modeling and Workpapers; 18 Reporting Internal Audit Results | Building and managing the function: competencies, project management, workpapers and reporting | A checklist for the methodology manual, read against Domains III and IV of the Standards |
| Five: Impact of Information Systems on Internal Auditing | 19 ITIL Best Practices, the IT Infrastructure, and General Controls; 20 BYOD Practices and Social Media Internal Audit Issues; 21 Big Data and Enterprise Content Management; 22 Reviewing Application and Software Management Controls; 23 Cybersecurity, Hacking Risks, and Privacy Controls; 24 Business Continuity and Disaster Recovery Planning | IT governance and controls: general controls, mobile devices and social media, big data, applications, cybersecurity and continuity | Background for non-IT auditors; the part that has aged fastest |
| Six: Internal Audit and Enterprise Governance | 25 Board Audit Committee Communications; 26 Ethics and Whistleblower Programs; 27 Fraud Detection and Prevention; 28 Internal Audit GRC Approaches and Other Compliance Requirements | Audit committee communications, ethics and whistleblower programmes, fraud and GRC | Read with the Standards’ Domain III and the current fraud guidance |
| Seven: The Professional Internal Auditor | 29 Professional Certifications: CIA, CISA, and More; 30 The Modern Internal Auditor as an Enterprise Consultant | Professional certifications and the internal auditor as a consultant to the enterprise | Replace chapter 29 with current IIA information; chapter 30 for advisory work |
| Eight: The Other Sides of Auditing: Professional Convergence | 31 Quality Assurance Auditing and ASQ Standards; 32 Six Sigma and Lean Techniques for Internal Audit; 33 ISO and Worldwide Internal Audit Standards; 34 A CBOK for the Modern Internal Auditor | Quality assurance, Six Sigma and Lean, ISO and international standards, closing with the proposed body of knowledge | Chapter 34 as the summary of the whole; the rest for functions working near quality or ISO auditors |
The proportions say something about the book. By our count from the page numbers in the table of contents, information systems take the largest share, about 170 pages across Part Five, a little more than either internal controls or planning and performing audits, while governance, ethics and fraud together take about 75 pages and the two chapters on the professional auditor fewer than 40. The average chapter is about two dozen pages. In our reading that is the profile of a book written by an IT auditor, and of a survey text: each chapter introduces its subject and the knowledge an auditor needs, and the reader who needs depth goes elsewhere. The site’s guides do that work for most chapters, and the map further down points to them.
The common body of knowledge: what Moeller means by it
The phrase in the subtitle needs care, because the IIA uses the same words for something different. The IIA’s Common Body of Knowledge is a research programme administered by the Internal Audit Foundation; its 2015 practitioner survey, the third global study of its kind, drew about 14,500 respondents in 166 countries and territories. Moeller’s body of knowledge is his own. The preface says it is built on more than forty years of his experience, research and professional activity rather than on surveys of what other auditors do; the preface lists the knowledge elements each chapter contributes, chapter 2 explains the idea, and chapter 34 assembles the whole. The eighth edition’s main change, in the preface’s account, was to say which areas call for strong knowledge and which for a general understanding.
That distinction is, in our view, the book’s most useful device, and a function can apply it whether or not it agrees with Moeller’s allocation. The Global Internal Audit Standards address competence under Principle 3, Demonstrate Competency, through Standard 3.1, Competency, and Standard 3.2, Continuing Professional Development, in the ethics and professionalism domain; the CIA exam, now in three parts covering internal audit fundamentals, the engagement and the function under a 2025 syllabus, is the profession’s own statement of the knowledge it tests. The table is our suggestion of how deep each part’s knowledge needs to go at three levels of a function; it is not the book’s allocation, which a reader should take from chapter 34.
| Part of the book | Staff auditor (our view) | In-charge or senior (our view) | Manager or chief audit executive (our view) |
|---|---|---|---|
| One: foundations | General understanding | General understanding | Strong knowledge |
| Two: internal controls | Strong knowledge of COSO; general understanding of the rest | Strong knowledge | Strong knowledge |
| Three: planning and performing audits | Strong knowledge of evidence and testing | Strong knowledge | Strong knowledge, with the Standards |
| Four: organising and managing | General understanding | Strong knowledge of workpapers and reporting | Strong knowledge |
| Five: information systems | General understanding of general and application controls | Strong knowledge of general controls | General understanding, with access to specialists |
| Six: governance, ethics and fraud | General understanding; strong knowledge of fraud indicators | Strong knowledge of fraud | Strong knowledge |
| Seven: the professional auditor | General understanding | General understanding | Strong knowledge of the advisory role |
| Eight: professional convergence | Awareness | General understanding | General understanding |
The internal auditor skills guide sets out competencies by level in the site’s terms, the career ladder guide shows when each starts to matter, and the guide to the 2025 CIA syllabus covers what the exam now tests.
Where the eighth edition predates current practice
A reference book is only as good as its date, and the eighth edition’s is January 2016. Some of its subjects have barely moved since; others have been rewritten. The table sets out the changes we could confirm from the bodies that issue the standards and frameworks concerned, chapter by chapter, with the site guide that covers the current position. Where the table says a chapter describes an earlier version, that is an inference from the publication date, not a statement about the chapter’s text, which we have not seen.
| Chapter | What has changed since January 2016 | Status of the book’s treatment | Where to go now |
|---|---|---|---|
| 9: Standards for the Professional Practice of Internal Auditing | The IIA revised its International Standards in October 2016, effective 1 January 2017; in 2023 its standards board approved the Global Internal Audit Standards, published 9 January 2024 and effective 9 January 2025, whose ethics domain replaces the former Code of Ethics; the framework now includes topical requirements, mandatory for assurance engagements whose scope includes the topic and recommended for advisory work; the first, on cybersecurity, was issued in 2025, and three more, on third parties, organisational behaviour and organisational resilience, have followed | Superseded | The guide to the 2024 Standards and the 2017-to-2024 mapping |
| 3 and 4: COSO internal control | COSO still describes its 2013 refresh as the current framework, and has added supplemental guidance on sustainability reporting (2023), robotic process automation (2024) and generative AI (2026) | Current in substance | The COSO 17 principles guide |
| 7: COSO ERM | COSO updated its 2004 ERM framework as Enterprise Risk Management: Integrating with Strategy and Performance in 2017 | Earlier framework | The guide to auditing the ERM programme |
| 6: COBIT and other ISACA guidance | ISACA’s current version is COBIT 2019, which it describes as an evolution of COBIT 5 | Earlier version | The IT audit plan guide |
| 23: cybersecurity, hacking and privacy | NIST released Cybersecurity Framework 2.0 on 26 February 2024, adding a Govern function and widening its scope to all organisations; the EU adopted the GDPR in April 2016, after the book appeared | Earlier frameworks | The NIST CSF 2.0 method and the cybersecurity topical requirement workbook |
| Governance roles (no chapter title) | The IIA updated its Three Lines of Defense as the Three Lines Model in July 2020 | Any treatment predates the update | The Three Lines Model guide |
| 29: professional certifications | The CIA exam now has three parts, on fundamentals, the engagement and the function, under a 2025 syllabus; some language versions move to it only at the end of 2026 | Out of date | The certifications guide |
| 33: ISO and worldwide internal audit standards | ISO revised its guidelines for auditing management systems, ISO 19011, in July 2018 and again in May 2026, and the 2026 edition is now current | Earlier editions | The ISO 9001 internal audit guide |
| Cloud and AI (no chapter title) | Neither appears in a chapter title; both are now central to IT audit and to the function’s own methods | Not covered by chapter | The cloud audit guide and the AI tools guide |
Three points follow. The first is that the internal control chapters have aged best, because the framework they describe, COSO’s 2013 refresh, is still the one COSO presents as current. The second is that the professional chapters have aged worst: anything the book says about the IIA’s Standards, Code of Ethics or certifications has to be checked against the current versions before it is taught or cited, and a function that cites the book in its methodology manual on those subjects is citing a superseded source. The third, in our reading, is that the information systems part, the book’s largest, is a mixture: its treatment of general controls, application controls and continuity planning addresses subjects whose principles have changed less than their technology, while its cybersecurity, privacy, mobile and big-data material belongs to the frameworks and risks of 2015. The history of the IIA’s Standards sets the Standards changes in sequence.
How to use a reference book in 2027
There are three ways a function can use the book, and each calls for a different discipline. As a curriculum, its parts and the knowledge elements in each chapter give a training programme a structure that is easy to explain and to track; the discipline is to replace or supplement the parts the table above marks as superseded before anyone is taught from them. As a reference, it answers the question an auditor new to an area asks first, what the subject is and what an auditor needs to know about it; the discipline is to treat it as the start of the research, not the end, and to cite current sources in workpapers. As a cross-check on the methodology manual, its Part Four lists the elements a function needs, from the charter to workpapers and reporting; the discipline is to test each against the Standards, which govern, rather than against the book. The table suggests a reading order by role.
| Reader | Read first | Consult as needed | Read alongside |
|---|---|---|---|
| New staff auditor | Parts One, Two (COSO chapters) and Three (evidence and testing) | Parts Five and Six | The internal audit process guide and the audit evidence guide |
| IT auditor or non-IT auditor moving into IT work | Part Five, chapters 19 and 22 | Chapter 11 on continuous auditing and CAATs | The ITGC primer |
| In-charge auditor or manager | Parts Three and Four | Part Six | The methodology manual guide |
| Chief audit executive | Parts Four and Six, and chapter 34 | Part Eight | The Global Internal Audit Standards guide |
| CIA candidate | Parts One to Four as background | Part Six | The current CIA syllabus, not chapter 29 |
Whichever use a function chooses, one rule holds: when the book and the Standards disagree, the Standards govern, and when the book and a current framework disagree, the framework’s issuer governs. The book’s own preface makes the point in its way, by insisting that every internal auditor needs a strong understanding of the IIA’s standards; the standards it meant have changed, and the instruction now points at the 2024 version.
The nine ideas worth keeping
- Internal audit serves management, not the external auditor. Brink’s founding argument, as the fifth edition’s preface records it, is still the profession’s starting point.
- A body of knowledge needs levels. The eighth edition’s main change was to separate what needs strong knowledge from what needs a general understanding; any curriculum should do the same.
- Controls are the grammar. Part Two puts COSO, Sarbanes-Oxley, COBIT and ERM before planning and performing audits, which is the right order for a new auditor.
- Information systems are not a specialism apart. Part Five is the largest in the book by page count, and its place in a general text argues that every auditor needs the basics.
- The function is a managed operation. Part Four treats charters, competencies, project management, workpapers and reporting as the machinery that makes audits possible.
- Governance is part of the auditor’s subject. Audit committee communications, ethics, whistleblowing, fraud and GRC sit together in Part Six.
- The auditor is also a consultant. Chapter 30 and the preface’s note that the standards allow internal auditors to act as consultants to their own organisations describe a role the 2024 Standards keep: their statement of purpose includes advice alongside assurance.
- Other audit disciplines have something to teach. Part Eight’s quality assurance, Six Sigma, Lean and ISO chapters are a reminder that internal audit is not the only profession that audits.
- A reference must carry its date. In our reading the book’s greatest limitation is time: every borrowed procedure should be checked against the current Standards and frameworks before it is used.
The vocabulary: fourteen terms defined for practitioners
| Term | What it means in the book’s scheme | What it looks like in an audit |
|---|---|---|
| Common body of knowledge (CBOK) | Moeller’s statement of what internal auditors need to know, listed chapter by chapter and assembled in chapter 34 | A knowledge matrix for the function, by role |
| Strong knowledge or general understanding | The eighth edition’s distinction between the areas an auditor must master and those an auditor must recognise | Levels in a training plan and a competency framework |
| Modern internal auditing | The title’s word, from Brink’s first edition: internal audit as a broad service to management, not clerical support for external auditors | A plan and reports addressed to management and the board |
| Operational auditing | The approach the first edition promoted, according to the fifth edition’s preface | Engagements on efficiency and effectiveness as well as compliance |
| COSO internal control framework | The framework of Part Two, which the preface calls the worldwide standard for assessing internal controls | Control evaluations against the five components and 17 principles |
| COSO ERM | The enterprise risk management framework of chapter 7, since updated by COSO in 2017 | Audits of the ERM programme against the current framework |
| COBIT | ISACA’s IT governance framework, the subject of chapter 6, now COBIT 2019 | IT governance reviews and the IT audit universe |
| General controls | The IT infrastructure controls of chapter 19 | ITGC testing: access, change, operations |
| Continuous auditing and CAATs | Chapter 11’s subjects: technology-based audit techniques and ongoing testing | Analytics scripts and monitoring routines |
| Control self-assessment | Chapter 12’s technique of having management assess its own controls | RCSA programmes and reliance decisions |
| Audit universe | The set of auditable areas from which plans and programmes are drawn, the subject of chapters 13 and 15 | The inventory behind the risk-based plan |
| GRC | Governance, risk and compliance, the frame of chapter 28 | Coordinated assurance across the three lines |
| Enterprise consultant | Chapter 30’s description of the internal auditor’s advisory role | Advisory engagements, with objectivity safeguards |
| Professional convergence | Part Eight’s term for the overlap between internal audit and quality, Lean, Six Sigma and ISO auditing | Coordination with quality and ISO auditors |
What it means for internal audit: a part-by-part map
The book’s practical value lies in the processes it can support, provided each is anchored in the current Standards. The map takes eight of them. The Global Internal Audit Standards guide sets out the full structure of the Standards the map refers to.
| Audit activity | What the book implies | Procedure it changes |
|---|---|---|
| Methodology manual (Standard 9.3) | Part Four lists the machinery a function needs | Cross-check the manual’s sections against Part Four, then confirm each against the Standards; cite the Standards, not the book; the methodology manual guide |
| Training and development (Standards 3.1 and 3.2) | A body of knowledge with levels | A curriculum built on the parts, with levels by role and superseded chapters replaced; the skills guide |
| Planning (Standard 9.4) | The audit universe is the base of the plan | Keep the universe as an inventory and let the risk assessment drive the plan; the audit universe guide and the risk assessment playbook |
| Controls evaluation | COSO is the reference framework | Evaluate against the 2013 framework’s components and principles; the COSO framework guide |
| IT audit | Every auditor needs the basics of general and application controls | An IT primer for all auditors, using current frameworks for cybersecurity; the ITGC primer |
| Audit committee reporting (Standard 11.3 and Domain III) | Communication with the board is part of the auditor’s job | Report formats checked against the Standards’ requirements on communicating results; the audit committee reporting guide |
| Fraud and ethics | Ethics programmes, whistleblowing and fraud belong together | A fraud risk assessment and an audit of the ethics programme; the fraud risk guide and the ethics programme audit guide |
| Quality (Standards 8.3, 8.4 and 12.1) | Quality assurance has its own discipline | Keep the IIA’s quality programme separate from ASQ-style quality auditing; the QAIP playbook |
One row needs a warning. The quality chapter in Part Eight covers ASQ-style quality auditing and also quality assurance reviews of the internal audit function, but those sections predate the internal and external quality assessments that the IIA’s Standards now set out in Standards 12.1 and 8.4. A function preparing for an external quality assessment needs the Standards and the IIA’s guidance, and the guide to preparing for an external quality assessment sets out the runway.
The criticisms, and what the book leaves out
We found no independent review of the eighth edition, so the criticisms here are the guide’s own reading. The first is the date. A reference work published in January 2016 cannot describe the Global Internal Audit Standards, the topical requirements, the Three Lines Model, COSO’s 2017 ERM framework, NIST CSF 2.0 or generative AI, and the gap grows every year that no ninth edition appears; we found none by October 2026. That is not a fault of the book so much as a condition of using it, but it means that a function relying on it needs a currency check of the kind set out above.
The second is the source of the body of knowledge. Moeller’s is one experienced practitioner’s statement of what auditors need to know, and the preface says so; it is not the result of the IIA’s research or of a survey of practitioners, and it does not carry the authority of the CIA syllabus. A function adopting its levels should test them against its own risks and the current syllabus. The third is depth against breadth. With chapters averaging about two dozen pages, the book introduces each subject rather than teaching it to working depth; a staff auditor learning to test journal entries, or a manager scoping a cybersecurity audit, needs more than a chapter. The fourth is perspective: many of the frameworks it covers, COSO, Sarbanes-Oxley and ASQ’s standards among them, are American in origin, although it also covers ISO and international standards, and readers outside the United States will need their own regulatory material alongside it. The book’s breadth remains its case: as a map of the whole territory in one volume, it does something a set of separate guides does not.
Editions, reading time and how to read it
| Edition | Details | Note |
|---|---|---|
| First, 1942 | Modern Internal Auditing by Victor Z. Brink, following his 1941 doctoral thesis at New York University, according to the fifth edition’s preface | The origin of the title and of operational auditing |
| Fourth, 1982 | Brink’s last revision, with Herbert Witt | Brink revised the book three times |
| Fifth, 1999 | Brink’s Modern Internal Auditing, Fifth Edition, John Wiley and Sons; Robert R. Moeller and Herbert Witt | Moeller takes over the book |
| Seventh, 2009 | Wiley | The edition the eighth replaced; Moeller wrote it, and a sixth in 2005 |
| Eighth, 2016 | Wiley, January 2016 (Bokus gives 5 January); 832 pages; hardback ISBN 978-1-119-01698-4, with ePDF, ePub and oBook editions; Wiley Corporate F&A series | The current edition; we found no later one |
| How to read it | Part One and chapter 34 first, for the shape of the body of knowledge; then the parts that match the reader’s role, using the table in the section on how to use it | A reference, not a cover-to-cover read |
| Companion reading | The Sawyer’s Guide summary; the Auditing That Matters summary for a practitioner’s argument about what to audit; the guide to the 2024 Standards for the update the book lacks | Placing the book |
Read it with the current Standards and the function’s methodology manual open beside it. For each chapter consulted, ask two questions: is the subject one where the book’s date matters, and if so, what is the current source? For the COSO internal control chapters and much of Part Three the answer to the first question is that it matters little; for chapters 6, 7, 9 and 29 and much of Part Five it matters a great deal. The first 90 days as CAE guide and the year-one audit plan guide describe two moments when a reference of this breadth is most useful: taking over a function, and building one.
A one-hour discussion guide for an audit team
- Ten minutes: the currency check. Pick the three chapters the function relies on most. For each, name what has changed since January 2016 and the current source that replaces or supplements it.
- Fifteen minutes: strong knowledge or general understanding. For the function’s five most common engagement types, agree which knowledge areas each auditor must master and which they need only recognise. Compare with chapter 34.
- Ten minutes: the citation audit. Search the methodology manual and recent workpapers for references to the book or to the IIA’s pre-2024 Standards. List each one that needs replacing.
- Fifteen minutes: the IT basics. Ask each non-IT auditor to explain, in two minutes, what general controls are and why they matter to their next engagement. Decide whether the function needs an IT primer.
- Ten minutes: the convergence question. Name the other auditors in the organisation, quality, ISO, safety or regulatory, and decide whether the function coordinates with them under Standard 9.5 on coordination and reliance.
Worked example: Lakeshore Bancorp builds a curriculum on it
Lakeshore Bancorp is a fictional US bank with $9 billion of assets and an internal audit function of 22. In 2027 the chief audit executive had two tasks: to build a structured training curriculum for a function that had hired five new auditors in eighteen months, and to bring the methodology manual into line with the Global Internal Audit Standards before an external quality assessment planned for 2028. The function chose the eighth edition of the book as the spine of the curriculum, because its parts gave a structure the audit committee could follow and its knowledge elements could be tracked, and set one rule: no part would be taught until a manager had checked it against current sources and marked what to replace.
| Part of the book | How Lakeshore used it | What was replaced or supplemented | Result by the end of 2027 |
|---|---|---|---|
| One: foundations and the body of knowledge | The knowledge elements in each chapter became the skeleton of a knowledge matrix for all 22 auditors | The levels set for Lakeshore by role and against the 2025 CIA syllabus, not taken from the book | Matrix completed; seven auditors had gaps in IT general controls |
| Two: internal controls | COSO chapters taught in the new-auditor course | The ERM chapter replaced by COSO’s 2017 framework; the COBIT chapter by COBIT 2019 material | Five new auditors completed the course |
| Three: planning and performing | Evidence, analytics and audit universe chapters used as background reading | Chapter 9 replaced by the 2024 Standards and the IIA’s mapping from the 2017 Standards | 46 references to the old Standards in the methodology manual replaced |
| Four: organising and managing | Charter, workpaper and reporting chapters used as a checklist for the manual | Each element confirmed against the Standards: the charter against Standard 6.2, documentation against Standard 14.6 | Three gaps found and closed before the assessment readiness review |
| Five: information systems | General and application control chapters used for an IT primer for non-IT auditors | Cybersecurity material replaced by NIST CSF 2.0 and the IIA’s cybersecurity topical requirement; cloud and AI taught from current guides | Primer delivered to 15 auditors; two began studying for the CISA |
| Six: governance, ethics and fraud | Audit committee communication and fraud chapters used for a seminar | Compared with the Standards’ Domain III and the bank’s audit committee charter | Quarterly report to the audit committee reorganised |
| Seven and Eight: the professional auditor and convergence | The chapter on the auditor as consultant used to discuss advisory work; the Lean chapter for a pilot on report turnaround | Certification chapter replaced by current IIA information | Report turnaround in the pilot team fell from 34 working days to 21 |
The readiness review in the fourth quarter of 2027, an internal self-assessment run by the function’s quality lead, found the manual conformant on the points it tested and recorded no remaining references to superseded standards. The audit committee chair asked for the knowledge matrix to be reported once a year, alongside the function’s performance measures, and for the currency check to be repeated whenever a source the curriculum relies on is revised.
Two decisions carry the lesson. The first was to use the book for structure and breadth, which it supplies well, and never as the authority on the Standards, which it cannot be. The second was the rule that no part is taught until it has been checked, which turned a decade-old reference into a usable curriculum at the cost of a few days of a manager’s time per part. The guide to internal audit in banking and the guide to what regulators expect from internal audit describe the setting in which a function like Lakeshore’s operates.
Frequently asked questions
Is there a newer edition than the eighth?
We found none by October 2026. The eighth edition, published by Wiley in January 2016, followed a seventh in 2009; it predates the Global Internal Audit Standards, which were published in January 2024 and took effect on 9 January 2025.
Does the book cover the Global Internal Audit Standards?
No. It was written before them, and before the IIA’s 2017 revision of its earlier International Standards; chapter 9 should be replaced by the current Standards and the IIA’s mapping. The guide to the 2024 Standards sets out what changed.
Is it useful for the CIA exam?
As background reading on the subjects the exam covers, yes. It is not aligned with the current three-part exam or its 2025 syllabus, and its certification chapter is out of date; candidates should study from the syllabus and the guide to the 2025 CIA syllabus.
Who was Victor Brink?
The author of the original book. According to the fifth edition’s preface, his 1941 doctoral thesis at New York University argued that internal auditors should serve management, his first edition appeared in 1942 and promoted operational auditing, and he revised it three times before his death in 1992.
How does it compare with Sawyer’s Guide?
Both are comprehensive references. In our reading Brink’s is distinctive for organising its content as a body of knowledge with levels and for the space it gives to information systems. The Sawyer’s Guide summary covers the other book.
Where does the book sit in the reading list?
Among the reference texts in the internal audit reading list, as a book to consult by chapter rather than read through.
Related guides
- Sawyer’s Guide for Internal Auditors: Summary, Editions and Free Study Notes — the other comprehensive reference
- Global Internal Audit Standards 2024: What Changed, Standard by Standard — the update the book lacks
- Old IPPF to New GIAS: The Complete Mapping Table — replacing chapter 9
- The Audit Methodology Manual: What Belongs in It (and a Full Outline) — using Part Four as a checklist
- Internal Auditor Skills: The Twelve Competencies, by Level, and How to Build Each — a body of knowledge with levels
- COSO’s 17 Principles: The Complete List, What Each Requires, and How to Evaluate Them — the part of the book that has aged best
- The Best Books for Internal Auditors — where this book sits among the others
- All book summaries — the full set of summaries for auditors
Leave a Reply