-
How to Write an Engagement Scoping Memo (With a Full Worked Example)
Most audits that blow their budget or miss the risk that mattered were scoped wrong before fieldwork began, and the scoping memo is where the decision was or…
Updated
·
21–31 minutes -
The Issue Closure Memo: An Annotated Template That Stands Up to Regulators
The closure memo is the document that turns an auditor’s judgment that an issue is fixed into a record a regulator, an external auditor or a successor can…
Updated
·
18–27 minutes -
The Organizational Resilience Topical Requirement: A Conformance Workbook for April 2027
The IIA issued the Organizational Resilience Topical Requirement on 30 April 2026; it becomes mandatory for assurance engagements on 30 April 2027. This workbook sets out all twenty…
Updated
·
21–31 minutes -
The Internal Audit Methodology Manual: What Goes in It, With a Full Outline Mapped to GIAS
Standard 9.3 requires the chief audit executive to establish methodologies to guide the function, and the manual is where they live. This guide explains what a methodology manual…
Updated
·
18–27 minutes -
Audit Committee Charter: A Clause-by-Clause Template Mapped to SEC, NYSE, Nasdaq and GIAS
The audit committee charter is the document that gives the committee its authority and tells internal audit who it works for. This guide supplies a complete template, clause…
Updated
·
21–32 minutes -
Audit Committee Annual Agenda: A Quarter-by-Quarter Calendar, Standing Items, Deep Dives
An audit committee that meets four times a year has about twelve hours to discharge a charter with fourteen clauses, and the agenda is where that either happens…
Updated
·
18–28 minutes -
AI Usage Policy for Internal Audit: A Model Policy, Clause by Clause, With Workpaper Rules
Most internal audit functions now use generative AI and most have no written rules for it. This guide supplies them: why the function needs its own policy even…
Updated
·
18–27 minutes -
Implementing Audit Management Software: The First 120 Days and Migrating Off Excel
A vendor-neutral guide to the first 120 days of implementing audit management software: methodology decisions, a week-by-week plan, what to migrate versus archive, a data mapping table, admin…
Updated
·
19–29 minutes -
The Audit Software Demo Script: 25 Scenarios That Make Vendors Show, Not Tell
This guide gives internal audit teams 25 scripted demo scenarios covering planning, fieldwork, workpapers and review, issues, reporting, SOX, analytics, AI, administration and the auditee portal, each with…
Updated
·
20–30 minutes -
Audit Tick Marks That Mean Something: A Standard Set With Usage Examples
Audit tick marks explained: what they are for, the rule that a tick mark records a procedure rather than a result, a standard legend of 18 marks with…
Updated
·
19–28 minutes -
Selecting an Audit Management System: A Vendor-Neutral RFP Method
How to choose an audit management system without a vendor ranking, updated for the rebrands to Optro, TeamMate Risk and Compliance and the Diligent One Platform: whether you…
Updated
·
29–43 minutes -
The Cybersecurity Topical Requirement: A Conformance Workbook
The IIA Cybersecurity Topical Requirement turned into a working checklist: the three domains and seventeen requirements with what to assess, example evidence and the common gap for each,…
Updated
·
22–33 minutes -
How to Review a SOC 2 Report: Trust Services Criteria for User Entities
The user entity’s method for a SOC 2 report under the AICPA Trust Services Criteria: what the report is and is not, which of the five categories your…
Updated
·
20–29 minutes -
How to Review a SOC 1 Report: A User Entity’s Working Method
The user entity’s method for a SOC 1 report under SSAE 18: what the report is and is not, the five sections and what to read in each,…
Updated
·
21–31 minutes -
The Auditor’s Prompt Library: Reusable Prompts for Audit Work (With Guardrails)
Twelve reusable prompts for planning, fieldwork, reporting, and function management, written in full with structure notes and verification steps, opening with the eight guardrails that keep model output…
Updated
·
21–32 minutes -
The Sampling Memo: A Template for Documenting Every Sampling Decision
A nine-section sampling memo written before testing: objective, population and completeness, method, size rationale, selection mechanics with the seed, exception definition, evaluation rules, conclusion boundary, and changes. Annotated…
Updated
·
18–27 minutes -
The Auditee Communication Pack: Notification, Kickoff Deck, and Status Templates
The four documents that run an engagement’s communication with the people being audited, in full and annotated for tone: the notification letter, the eight-slide kickoff deck, the Friday…
Updated
·
19–29 minutes -
The CAE’s Audit Committee Deck Template: Quarterly Reporting Slides That Work
The quarterly audit committee deck as a template: twelve slides mapped to what the Standards require the CAE to communicate, slide-by-slide headlines, content, and presenter notes, design rules…
Updated
·
19–28 minutes -
The QAIP Documentation Kit: Self-Assessment Workbook and Quality Metrics Sheet
The four documents a quality program runs on, in full: the standard-by-standard self-assessment workbook with rating definitions and completed rows, a one-page engagement QC checklist at three checkpoints,…
Updated
·
18–27 minutes -
How to Write a Control Description: Well-Written vs Poor Examples
Who, what, when, how, and evidence, plus precision and exception handling: the formula for a control description a stranger can test, ten poor descriptions rewritten, the five-question testability…
Updated
·
19–28 minutes -
The Finding and Issue Log Template: Fields That Make Follow-Up Work
A complete internal audit issue log template: every field defined, a status taxonomy that survives audit-committee scrutiny, ageing and escalation rules, the committee-reporting cuts, an Excel-tier build, and…
Updated
·
22–32 minutes -
The Internal Audit Report Template Set: Full, Short-Form and Memo Shells, Annotated
Three annotated audit report shells — full report, short-form, and advisory memo — with model language for every section, house style rules, and a fully worked example: MidState…
Updated
·
28–41 minutes -
The Walkthrough Documentation Template: Capturing a Process End-to-End
The walkthrough artifact done properly: an eight-part narrative-plus-flowchart structure with control-point call-outs, system handoffs, evidence inventory, the documented-vs-actual gap log, and a conclusion that drives testing — with…
Updated
·
24–36 minutes -
The Engagement Planning Memo Template (Annotated): Eight Sections Mapped to GIAS 13.1–13.6
An annotated engagement planning memo template: all eight sections, each mapped to Global Internal Audit Standards 13.1 to 13.6, a worked example from a route cash-handling audit, variants…
Updated
·
19–28 minutes -
The Annotated Internal Audit Plan Template
The complete annual audit plan document — eight sections with model language, drafting guidance on every one, and a fully worked example for a real-shaped company. Risk summary,…
Updated
·
18–28 minutes -
Finding Severity Ratings: The Calibrated Matrix, Twelve Cases and the Report Rating Rule
The calibrated High/Medium/Low matrix: impact and likelihood anchors, the 4×4 grid, twelve rated cases from worked engagements, the rule that derives the report rating, a rating memo template,…
Updated
·
24–36 minutes -
Old IPPF to New GIAS: The Complete Mapping Table
Every 2017 Attribute and Performance Standard mapped to the 2024 Global Internal Audit Standards, following the IIA two-way mapping: Code of Ethics and Core Principles crosswalks, the requirements…
Updated
·
29–43 minutes -
Segregation of Duties Beyond the ERP: A Universal SoD Framework
Segregation of duties is taught as an ERP problem and most of the losses it prevents happen nowhere near one. The universal framework: the four incompatible functions and…
Updated
·
19–28 minutes -
Internal Audit Work Program: The Template, Two Worked Programs and a Filled-In Change Log
Every section of the work program template and why it exists, the five-element procedure standard, two fully worked programs (a user access review and a 232-hour payroll audit),…
Updated
·
21–31 minutes -
The Risk Register: Anatomy, a Worked Example, and How to Keep It From Becoming a Graveyard
The risk register end to end: every field and why it exists, a worked enterprise register, scoring and appetite wiring, governance that keeps it alive, and the classic…
Updated
·
18–27 minutes