-
Thinking in Bets by Annie Duke: Summary and Lessons for Auditors
Duke’s argument that decisions are bets, summarised for auditors: resulting and the Super Bowl call, fielding outcomes, truthseeking groups and Merton’s norms, mental time travel, a vocabulary, an…
Updated
·
28–41 minutes -
How to Measure Anything by Douglas Hubbard: Summary and Lessons for Auditors
Hubbard’s method for measuring “intangibles”, summarised for auditors: the definition of measurement, calibrated estimates, the value of information and the measurement inversion, small-sample tools, a vocabulary, an audit…
Updated
·
32–48 minutes -
Accelerate by Forsgren, Humble and Kim: Summary and Lessons for IT Auditors
The research behind the DORA metrics, summarised for IT auditors: the four key metrics and the 2017 data, the 24 capabilities and Westrum’s culture model, the change approval…
Updated
·
26–39 minutes -
Weapons of Math Destruction by Cathy O’Neil: Summary and Lessons for Auditors
Cathy O’Neil’s critique of harmful algorithms, summarised for auditors: the tests of opacity, scale and damage, five cases checked against the record, the rules written since 2016, a…
Updated
·
29–44 minutes -
Brink’s Modern Internal Auditing by Robert Moeller: Summary and How to Use It
Moeller’s eighth edition of Brink’s reference text, summarised: the eight parts and 34 chapters, the common body of knowledge and its levels, where the 2016 edition predates the…
Updated
·
25–38 minutes -
Noise by Kahneman, Sibony and Sunstein: Summary and Lessons for Auditors
Kahneman, Sibony and Sunstein on unwanted variability in judgment, summarised for auditors: the error equation, level, pattern and occasion noise, the evidence and its critics, decision hygiene, a…
Updated
·
31–47 minutes -
The Field Guide to Understanding ‘Human Error’ by Sidney Dekker: Summary for Auditors
Sidney Dekker’s guide to investigating failure, summarised for auditors: the Old View and the New View, the four reactions to failure, the six steps, accident models, a vocabulary,…
Updated
·
29–43 minutes -
Auditing That Matters by Norman Marks: Summary and Lessons for Audit Leaders
Norman Marks’s case for auditing only what matters to leadership, summarised: enterprise risk-based auditing, the risk universe against the audit universe, reports built for executives, budgets tied to…
Updated
·
25–38 minutes -
The Failure of Risk Management by Douglas Hubbard: Summary for Auditors
Hubbard’s case against scoring methods and his calibrated, simulated alternative, summarised for auditors: the argument, the method in six steps, a vocabulary, an audit map and a worked…
Updated
·
19–28 minutes -
Superforecasting by Tetlock and Gardner: Summary and Lessons for Auditors
Tetlock and Gardner’s study of forecasting accuracy, summarised for auditors: how accuracy was measured, the ten habits, a vocabulary, three audit forecasts to start scoring and a worked…
Updated
·
18–27 minutes -
The Audit Committee Effectiveness Review: How to Assess the Committee That Oversees You
The audit committee evaluates everyone: the external auditor, the chief audit executive, the finance function, the compliance program. Once a year it has to evaluate itself, and at…
Updated
·
23–34 minutes -
Generative AI Across the Audit Lifecycle: Use Cases, Review Gates and Failure Modes
Generative AI is already inside most internal audit functions, whether the function decided that or not, and the question has moved from whether to use it to where…
Updated
·
23–35 minutes -
How to Run an Internal Self-Assessment of Your Audit Function (Step by Step)
The Standards require an internal audit function to assess itself, and most functions do it badly: a checklist completed by the person who wrote the methodology, a conformance…
Updated
·
18–28 minutes -
Testing Controls in Small Populations: The Twice-a-Year Control Problem, Solved
A control that operates twice a year gives the auditor two chances to see it work, and the usual sampling logic collapses: you cannot sample two, you cannot…
Updated
·
18–27 minutes -
Sustainability Testing: Validating That Audit Fixes Stay Fixed
A control validated at closure is a control that worked for a quarter while everyone was watching. Sustainability testing asks whether it still works a year later, after…
Updated
·
18–28 minutes -
Yellow Book vs IIA Standards: GAGAS for Internal Auditors, Mapped Standard by Standard
Government internal auditors in the United States work under two sets of standards: the Yellow Book, GAO’s Government Auditing Standards (GAGAS, 2024 revision), which many audit organizations are…
Updated
·
22–32 minutes -
Types of Internal Audits: The 15 Kinds Explained, With What Each Tests and When to Use It
Internal audit engagements come in named kinds, and the names decide the criteria, the methods, the evidence and the report. This guide explains fifteen of them: operational, financial,…
Updated
·
18–27 minutes -
The One-Person Internal Audit Shop: An Operating Manual for the Solo Auditor
A large share of internal audit functions are one person, and almost all the profession’s guidance is written for twenty. This manual is for the solo auditor: how…
Updated
·
18–27 minutes -
Assurance Mapping: A Worked Example From Blank Page to Board View
Everyone agrees an assurance map is a good idea and almost nobody publishes a finished one. This guide builds one from a blank page: defining the rows (risk…
Updated
·
18–27 minutes -
Control Design Principles: What Makes a Control Actually Work, With Three Redesigns
Most controls are not designed; they accumulate. This guide gives the principles for designing one deliberately: a control objective stated as the error it must catch, precision matched…
Updated
·
19–28 minutes -
How Internal Audit Should Audit the ERM Program Itself: Criteria, Maturity and Independence
Auditing the second line is the engagement that proves whether internal audit’s independence is real. This guide gives the method for the enterprise risk management program: the three…
Updated
·
18–28 minutes -
How to Run a Business Impact Analysis: RTOs, RPOs and the Processes That Matter
The business impact analysis is the document every continuity and resilience program rests on and the one most often done as a questionnaire exercise. This guide gives the…
Updated
·
18–27 minutes -
How to Audit the Business Continuity Program End to End: A Work Program With Test Steps
Business continuity programs are audited often and badly: the auditor confirms that plans exist and tests were held, and the next real disruption shows that the plans did…
Updated
·
18–27 minutes -
Risk Taxonomy: How to Build One, With a Full Three-Level Example and Six Design Rules
Every risk program references a taxonomy and almost nobody explains how to build one. This guide does: what a taxonomy is and is not, the six design rules…
Updated
·
18–27 minutes -
Risk Assessment Matrix: How to Design, Calibrate and Use One Without Fooling Yourself
The risk assessment matrix is the most used and least examined tool in risk management. This guide explains what it can and cannot do: the choice between 3×3,…
Updated
·
19–28 minutes -
The Internal Audit Methodology Manual: What Goes in It, With a Full Outline Mapped to GIAS
Standard 9.3 requires the chief audit executive to establish methodologies to guide the function, and the manual is where they live. This guide explains what a methodology manual…
Updated
·
18–27 minutes -
Internal Audit KPIs: 30 Metrics That Show Whether the Function Works, With Targets
Internal audit functions measure what is easy (hours, reports issued) and skip what matters (whether risk went down). This guide sets out thirty key performance indicators grouped by…
Updated
·
20–29 minutes -
How to Audit Operational Risk Management: A Work Program for the Framework, Not the Events
Auditing operational risk management means auditing the framework that identifies, assesses, monitors and reports operational risk, not re-auditing the processes where losses happen. This guide sets out the…
Updated
·
23–34 minutes -
AI Usage Policy for Internal Audit: A Model Policy, Clause by Clause, With Workpaper Rules
Most internal audit functions now use generative AI and most have no written rules for it. This guide supplies them: why the function needs its own policy even…
Updated
·
18–27 minutes -
Setting Audit Criteria When No Framework Exists: Operational Audits Done Right
The hardest planning problem in internal audit, solved: what an operational audit is and the three Es it evaluates, why criteria decide whether findings are facts or opinions,…
Updated
·
22–33 minutes