-
Preventive, Detective and Corrective Controls: Taxonomy, 50 Examples, Four Processes Drawn
Definitions without the usual conflations, the cost and assurance trade-offs, the layering doctrine, fifty tagged examples across six process families, the three columns drawn for four real-shaped engagements,…
Updated
·
21–32 minutes -
COSO’s 17 Principles: The Complete List, What Each Requires, and How to Evaluate Them
All seventeen COSO 2013 principles across the five components: the question each asks, the evidence that answers it, what each looks like when it fails, the present-functioning-operating-together evaluation,…
Updated
·
18–28 minutes -
How to Run an ERP Segregation of Duties Analysis (Any Platform)
Vendor rulesets flag thousands of conflicts; a few dozen matter. The platform-agnostic method for an ERP segregation of duties analysis: a conflict matrix built from your own risks…
Updated
·
21–31 minutes -
How to Perform a User Access Review That Actually Works
Most user access reviews are signatures, not reviews. How to build one that removes access: scoping by tier with the right reviewers, population completeness reconciled to the system…
Updated
·
19–29 minutes -
Management Review Controls: Documenting and Testing the Hardest Controls in SOX
How to design a management review control that can be tested and test one that exists: the six-element anatomy, the precision factors from PCAOB Staff Audit Practice Alert…
Updated
·
19–29 minutes -
SOX 404 Explained: The Complete Guide to ICFR Compliance
Section 404 in full for the internal auditor: what 404(a), 404(b), 302 and 906 require, the filer categories and exemptions as amended in April 2020 that decide whether…
Updated
·
19–29 minutes -
How to Audit Privileged Access: Admin Rights, Break-Glass, and Vaulting
Privileged access decides how bad everything else can get. The method for auditing it: privilege defined by capability across every layer from the directory to the database and…
Updated
·
19–28 minutes -
ITGC vs Application Controls: The Dependency Everyone Gets Backwards
An application control is only as reliable as the general controls over the system it runs in. The two layers defined precisely, the mechanism by which each ITGC…
Updated
·
21–31 minutes -
Segregation of Duties Beyond the ERP: A Universal SoD Framework
Segregation of duties is taught as an ERP problem and most of the losses it prevents happen nowhere near one. The universal framework: the four incompatible functions and…
Updated
·
19–28 minutes -
How to Audit Identity and Access Management: The Full IAM Program
Identity is the control plane of everything else. The program audit of identity and access management: the seven domains and their frameworks, the joiner-mover-leaver chain with the leaver…
Updated
·
20–29 minutes -
Risk and Control Matrix (RCM) Template: Every Column, Six Worked Rows, One Real Rebuild
The full risk and control matrix template with every column explained, six fully worked rows, a real rebuild of an accounts payable matrix showing how the walkthrough and…
Updated
·
25–38 minutes -
How to Audit Accounts Payable: Risks, Controls, a 14-Test Program and a Worked Engagement
The internal auditor’s guide to accounts payable: where the risk concentrates in procure-to-pay, a ten-control starter matrix, a fourteen-test program with attributes, the analytics that find real dollars,…
Updated
·
23–34 minutes -
IT General Controls (ITGC) Audit: The Complete Primer for Non-IT Auditors
How to scope and test ITGCs without an IT background: a 24-row test matrix with populations, samples and evidence, a PBC list, a 20-question IT interview script, and…
Updated
·
31–46 minutes -
The Checklist Manifesto by Atul Gawande: Summary and Lessons for Auditors
Gawande’s argument for checklists, summarised for auditors: the cases, the design principles, why experts resist, a vocabulary, an audit map and a worked example auditing a surgical checklist…
Updated
·
18–28 minutes -
Internal Controls: What They Are, Who Tests Them, and How
A precise definition of internal control, the classifications that decide how each control is tested, who tests controls and why five parties test the same one, the four…
Updated
·
21–31 minutes -
The COSO Internal Control Framework: Five Components and 17 Principles, for Auditors
COSO’s Internal Control Integrated Framework is the most widely used definition of what internal control is and how to judge whether it works, and it is the criteria…
Updated
·
18–26 minutes -
What Is an Internal Control? Definition, Types, 40 Examples
A control is an action, not a policy, a system, a report, or a person. The COSO and IIA definitions taken apart, the seven attributes every control description…
Updated
·
24–36 minutes