About internalauditguide.com
Built by practitioners. Free for the profession.
internalauditguide.com is an independent, practitioner-written reference for internal auditors and the people who work with them: audit leaders, audit committees, risk and compliance teams, auditees, CIA candidates and teams choosing audit software. More than 500 in-depth guides and nine free tools, with no paywall, no signup and no vendor money behind any of it.
- Practitioner-written
- Independent: no ads, no sponsors, no affiliate links
- Free to read, nothing gated
- Grounded in the IIA Standards, COSO and regulators’ guidance
At a glance
What internalauditguide.com is
internalauditguide.com is a free online library about internal auditing. It covers how audits are planned, performed and reported; the risks auditors test, from credit and liquidity to IT, fraud and model risk; the Global Internal Audit Standards and the frameworks around them; the careers and certifications of the profession; and the software audit teams buy.
The library is organized the way the work happens. Every guide sits in one of eleven domains and 65 practice areas, and the A–Z index lists every one of them on a single page. Hubs such as Start Here, Topics, By Role and the Risk Library give each audience its own way in.
Alongside the guides sit templates with worked examples, a complete CIA exam section, a buyer’s guide to internal audit software and nine free tools that run in your browser. All of it is free to read and use.
| Name | internalauditguide.com |
|---|---|
| Publishing since | 2023 |
| What it publishes | In-depth guides, templates with worked examples, free in-browser tools, a CIA exam section and independent reviews of internal audit software |
| Size | More than 500 guides in 11 domains and 65 practice areas, plus nine free tools |
| Written by | Practicing internal auditors with more than a decade inside multinational institutions (see who writes it) |
| Audience | Internal auditors at every level, audit leaders and CAEs, audit committees, risk and compliance teams, auditees, CIA candidates and teams buying audit software |
| Cost to readers | Free, with no signup, paywall or email wall |
| Business model | No ads, sponsored content, affiliate links or vendor payments; the only paid products are two books of its own |
| Standards referenced | The IIA’s Global Internal Audit Standards, COSO’s internal control and enterprise risk frameworks, and regulators’ handbooks from the OCC, the Federal Reserve, the FFIEC and the Basel Committee |
| Affiliations | None. Not affiliated with or endorsed by The Institute of Internal Auditors, COSO, ISACA, or any audit firm, software vendor or training provider |
| Contact | desk@internalauditguide.com |
Who it’s for
One library, eight ways in
The library is organized around the seat you are in, from a first week in internal audit to the audit committee. Start with the one that fits.
New to internal audit
What internal audit is, how an engagement runs end to end, and the vocabulary that makes the rest of the library readable.
Start here → PracticePracticing auditors
Planning, walkthroughs, testing, sampling, workpapers, findings and reports, organized the way an engagement actually runs.
Browse the topics → LeadershipAudit leaders and CAEs
The director-to-CAE layer: sourcing, methodology and quality, regulators, and the relationship with the audit committee.
See the career ladder → GovernanceAudit committees and boards
What to expect from internal audit, how to oversee it, and the questions worth asking the chief audit executive.
Read the committee guides → The other sidePeople being audited
What an audit asks of a business team, how to prepare for fieldwork, and how to respond to findings.
Prepare for an audit → RiskRisk and compliance teams
A program-grade risk library: credit, market, liquidity, interest-rate, operational, compliance, model and fraud risk.
Open the Risk Library → CertificationCIA candidates
The complete CIA exam guide, 156 practice questions, a day-by-day study planner and 199 flashcards, all free.
Study for the CIA → Buying softwareTeams choosing audit software
Independent reviews of 25 platforms and tools, head-to-head comparisons, buying guides, a shortlist finder and a requirements matrix.
Open the software guide →What’s here
Every section, one library
Everything on the site links to everything else. These are the places to start.
Every guide, A to Z
Foundations, the audit process end to end, risk, governance and standards, technology and data, careers, running the function, communication and industries, all on one page.
Open the A–Z index → Risk Library119 guidesEvery major risk, for the auditor who tests it
Credit and market risk, liquidity, interest-rate risk and ALM, operational and compliance risk, model risk, fraud and business continuity.
Open the Risk Library → Standards78 guidesGovernance, standards and regulation
The Global Internal Audit Standards domain by domain, COSO’s 17 principles, the audit committee, and what regulators expect of the function.
Read the standards guides → CIA exam3 free toolsThe CIA exam, explained
Eligibility, the three parts and their 2025 weights, every fee, how scoring works and a study plan for each part, plus a question bank, a planner and flashcards.
Open the CIA section → Software25 reviewsInternal audit software
Reviews of 25 platforms and analytics tools, 30 head-to-head comparisons, 15 buying guides and two decision tools, with no vendor money behind any of it.
Open the software guide → Free tools9 toolsWorking software for the job
Four tools for audit work, three for the CIA exam and two for choosing audit software. No accounts, no uploads, no license keys.
Open the tools → DataPrimary-source data you can audit
Free datasets built from primary sources such as SEC filings, starting with the Material Weakness Tracker: material weaknesses disclosed in 10-K and 10-Q filings, with every row linked to its filing and free to reuse under CC BY 4.0.
Browse the data → TemplatesTemplates and downloads
From the annual audit plan to the closed finding, each template sits inside the guide that explains it, with a worked example filled in.
Open the resource hub →Two books of the site’s own
The Internal Audit Field Guide for the people who do the work, and The Auditee’s Playbook for the people on the other side of the table.
They are the site’s only paid products.
The Arcade
Five-minute games for a coffee break: Auditle, Red Flag, Out of Office, Neon Swarm and Steam Shift.
Play a round →How the library is organized
Eleven domains and 65 practice areas, organized by hand around the way internal audit work happens. Counts are published guides in each domain; a guide can sit in more than one.
- Internal Audit Foundations112 guides
- Audit Process & Methodology118 guides
- Risk & Risk Management119 guides
- Governance, Standards & Regulation78 guides
- Roles & Audiences107 guides
- Careers & Certifications77 guides
- Technology, Data & the Future148 guides
- Running the Audit Function48 guides
- Communication & Influence46 guides
- Insights & Commentary43 guides
- Industries & Sectors12 guides
Cornerstone guides
Where serious readers start
Long-form references the rest of the library builds on, each written to be the last tab you need open on its subject.
The internal audit FAQ: the top 50 questions
Ten thousand words answering the questions practitioners, auditees and boards actually ask.
Read the guide → Audit processThe beginner’s guide to audit workpapers
Organize, document and complete audit testing, with examples and templates.
Read the guide → StandardsThe Global Internal Audit Standards
The Standards domain by domain, with what changed from the previous framework.
Read the guide → StandardsThe COSO framework guide
The 2013 framework and its 17 principles, translated into working audit language.
Read the guide → Audit processWhat audit risk is, and why it drives scoping
The concept that quietly governs every scoping decision, unpacked properly.
Read the guide → Risk libraryFraud risk and fraud risk management
Prevention, detection and response, and internal audit’s role in each.
Read the guide → Risk libraryLiquidity risk: the definitive guide
From LCR mechanics to what actually breaks banks, written for auditors.
Read the guide → Audit functionInternal audit co-sourcing 101
The first of a four-part series on the strategy, economics and politics of co-sourcing.
Read the guide →The people behind it
Who writes it
internalauditguide.com is researched, written and maintained by practicing internal auditors: people who have spent more than a decade inside multinational institutions including Mitsubishi UFJ Financial Group (MUFG), Barclays, American Express, Royal Bank of Canada, ING and Gap Inc., working across banking and finance, retail, technology and manufacturing, with academic roots at the University of California and The Claremont Colleges.
Guides are published under the site’s name rather than personal bylines. That is deliberate: the writing draws on current, real audit work, and keeping the site independent of any employer is what lets it stay specific and candid. Every claim still has to survive the test that matters: would this hold up in front of a reviewer, a regulator or an audit committee?
That test shapes what the guides look like. They start from what a reviewer flags, what an examiner asks and where a walkthrough falls apart, and they say plainly when practice varies or when a question belongs to your own function, counsel or regulator.
- 2023internalauditguide.com publishes its first guides.
- Early 2025The library reaches about 280 in-depth guides.
- July 2026The RCM Workbench launches, the first of the current free tools.
- August 2026The Arcade opens.
- September 2026The CIA exam section and the internal audit software section launch, and the library passes 500 guides.
Editorial standards
How the guides are written
The bar every guide has to clear, in six parts.
Checked against the source
Guides work from the standards and rules they describe: the IIA’s Global Internal Audit Standards, COSO’s frameworks, and regulators’ own handbooks from the OCC, the Federal Reserve, the FFIEC and the Basel Committee, with links out so you can verify claims yourself.
Written from the field
Explanations start where the work happens: what a reviewer flags, what a regulator asks, where a walkthrough falls apart. Templates and examples come from doing the work, not from summarizing other sites.
Useful in the first paragraph
Guides open with the answer and then the detail: tables wherever things compare, templates with worked examples, and a table of contents on the long references.
Anything that moves carries a date
Fees, prices, exam rules and product facts come with a source and a date. The software reviews carry a “Last verified” date, and prices appear only with the evidence behind them.
Reworked when the ground moves
A new standard, a renamed framework or a changed exam syllabus means the affected guides get reworked rather than left as they were. In 2026, for example, the CIA guides were rewritten to the 2025 exam syllabus.
Errors get fixed
No paywall means no sunk-cost defensiveness. When a reader or a re-read surfaces a mistake, the guide is corrected. If you spot one, write to the desk with the page and the sentence.
Independence
No one pays to be here.
internalauditguide.com is not owned by, sponsored by or affiliated with any audit firm, software vendor, training provider or professional association. There are no ads, no sponsored posts, no affiliate links and no paid placements. When a guide recommends an approach, that is a professional judgment, not a placement.
The same rule covers the software section: no vendor has paid for, seen or approved a review before it is published. The site’s only paid products are two books of its own; no guide, template or tool is gated behind them.
The site is not affiliated with or endorsed by The Institute of Internal Auditors. References to the IIA’s standards, the CIA exam and its syllabus describe publicly available material and link to the IIA’s own pages.
Tools and privacy
Nine free tools, private by architecture
Eight tools run in your browser and the requirements matrix runs in Excel on your own machine. There are no accounts, no uploads and no license keys, and what you enter stays on your machine: work saves to your browser’s own storage, and portability comes from files you download.
Audit tools
RCM Workbench, mySampler, myDayLog and the Self-Assessment Hub: plan the audit, select a sample a reviewer can reperform, log the day, and assess a function against the Standards.
For CIA candidates · 3 toolsCIA exam tools
CIA Practice Questions, the CIA Study Planner and CIA Flashcards, written to the 2025 syllabus and built to work together.
For software buyers · 2 toolsSoftware buying tools
The Shortlist Finder narrows the market to a shortlist with reasons, and the Requirements Matrix scores the finalists in a free Excel workbook.
Software reviews
How audit software is reviewed
The internal audit software section reviews 25 platforms and analytics tools against the same 12-area scorecard and rates each one for eight buying situations, from a small team’s first system to SOX-heavy companies, banks and the public sector. The same ratings appear on every review, comparison and alternatives page, so a product does not change grade from one page to the next.
The reviews are research-based, not hands-on tests, and each review says so. The evidence is vendor documentation and release notes, public procurement records, analyst reports, verified-buyer reviews and pricing data, each with a source and a date. Prices appear only with the evidence behind them.
For vendors and their agencies. Mentions and links are not for sale or trade, and none is added because a vendor or its agency asks. What helps is evidence: product documentation, release notes, pricing records, demo access and corrections of fact, sent to desk@internalauditguide.com. Everything sent is checked like any other source and used only where it holds up. There is no promise of coverage, and no vendor sees or approves a review before it is published.
For writers, teachers and teams
Cite, quote or feature this work
Everything on internalauditguide.com may be quoted and cited with attribution: by journalists covering audit and governance, professors and training programs, audit teams building internal methodology, and anyone writing about the profession. Link to the guide you used; that is the whole ask.
internalauditguide.com, “[Guide title],” [URL of the guide], accessed [date].Classroom and internal use are welcome without asking permission: assign guides in coursework, drop tool links into your methodology and excerpt with credit. To reproduce a template wholesale, translate a guide or feature the site, write to the desk.
Contact and corrections
One address for everything
Corrections, questions about a guide, a template or a tool, reuse requests and notes from practitioners who want to push on the work all go to desk@internalauditguide.com. The desk does not take sponsored posts, guest posts, paid placements or vendor listings.
Questions
About internalauditguide.com: common questions
Who runs internalauditguide.com?
Practicing internal auditors with more than a decade inside multinational institutions. Guides are published under the site’s name rather than personal bylines, so the writing can draw on current audit work while the site stays independent of any employer.
Is internalauditguide.com free?
Yes. Every guide, template and tool is free to use, with no signup, paywall or email wall. The site’s only paid products are two books of its own, and no guide, template or tool is gated behind them.
Is internalauditguide.com affiliated with The Institute of Internal Auditors?
No. The site is independent and is not affiliated with or endorsed by The Institute of Internal Auditors, COSO, ISACA, or any audit firm, software vendor or training provider.
Do software vendors pay to be reviewed or ranked?
No. There are no sponsored posts, affiliate links or paid placements, and no vendor has paid for, seen or approved a review before publication. The reviews are research-based and say so on every page.
Where does the information come from?
From primary sources wherever they exist: the IIA’s Global Internal Audit Standards, COSO’s frameworks, regulators’ handbooks and guidance, and, for software, vendor documentation, procurement records and pricing data. Guides link out so claims can be checked.
How current are the guides?
Facts that change, such as exam rules, fees, prices and product details, carry a source or a date, and the software reviews carry a Last verified date. When the CIA exam moved to its 2025 syllabus, for example, the CIA guides were rewritten to match.
Can I use the guides and templates at work or in a class?
Yes. Quoting with attribution, internal methodology use and classroom use need no permission. Nothing on the site is legal, regulatory or audit advice for a specific engagement; your own function, counsel and regulators decide how a method applies to you.
Where does my data go when I use the tools?
It stays on your device. The tools run in your browser with no account and no server behind them, and your work saves to your browser’s own storage. The requirements matrix is an Excel workbook you download and fill in on your own machine.
How do I cite a guide?
Use this form: internalauditguide.com, “[Guide title],” [URL of the guide], accessed [date]. A link to the guide you used is the whole ask.
How do I report an error or ask a question?
Write to desk@internalauditguide.com with the page and the sentence in question.
The whole library is open.
More than 500 guides and nine free tools, every framework explained by people who use them: free, ungated and independent. Start anywhere; it all connects.
internalauditguide.com