-
Entity-Level Controls: Auditing the Controls Above the Processes
A complete guide to entity-level controls for internal auditors: what they are, the categories the PCAOB lists, the difference between indirect, monitoring and precise controls, examples mapped to…
Updated
·
18–28 minutes -
Compensating Controls: When Plan B Is Good Enough, and When It Is Not
A precise guide to compensating controls for internal auditors and control owners: the definition and the vocabulary around it (mitigating, redundant, complementary), where compensating controls come up, the…
Updated
·
19–29 minutes -
Control Ownership: Making Someone Actually Accountable
What a control owner is accountable for, how owner, performer, reviewer and monitor differ, how controls become orphans and a simple analytic to find them, an ownership register,…
Updated
·
18–28 minutes -
How to Audit Account Reconciliations as a Program: Standard, Tests and a Worked Engagement
Account reconciliations audited as a program: what a reconciliation proves, a ten-control matrix, the standard a complete reconciliation must meet, a 14-test program, population analytics, and Lakeshore Bancorp’s…
Updated
·
20–29 minutes -
How to Audit the Financial Close: Speed, Accuracy and Control, With a Worked Engagement
The financial close audited as a process: the eight stages and the two clocks, a twelve-control matrix, a close calendar standard, a 14-test program, the analytics that profile…
Updated
·
20–30 minutes -
How to Audit Fixed Assets: Existence, Capitalization, Disposals and a Worked Engagement
The internal auditor’s fixed asset audit: the lifecycle and its risks, a ten-control starter matrix, a 14-test program with two-direction counts and both-way capitalization tests, the register analytics,…
Updated
·
19–29 minutes -
How to Audit Order-to-Cash End to End: The Integrated Audit and a Worked Engagement
The integrated order-to-cash audit: the six handoffs where fragment audits go blind, a cross-stage risk map and twelve-control matrix, a 14-test program, the analytics that join the stages,…
Updated
·
20–30 minutes -
How to Audit Procure-to-Pay End to End: The Integrated P2P Audit and a Worked Engagement
The integrated procure-to-pay audit: the five handoffs where stage audits go blind, a cross-stage risk map and twelve-control matrix, a 14-test program, the analytics that join the stages,…
Updated
·
23–34 minutes -
Financial Statement Fraud: How the Numbers Get Cooked, and Who Should Catch It
The financial reporting branch of the fraud tree: the five mechanisms and their mirror images, who commits it and the pressures that produce it, the cases from Enron…
Updated
·
20–29 minutes -
The ACFE Fraud Tree Explained: Every Occupational Fraud Scheme, With Controls and Analytics
The ACFE fraud tree walked branch by branch: corruption, asset misappropriation and financial statement fraud, every named scheme with how it works, who commits it, the red flags,…
Updated
·
20–29 minutes -
How to Audit Cash Management and Bank Reconciliations: Controls, Not Rituals
The internal auditor’s guide to cash management and bank reconciliations: the cash structure and where it fails, the seven properties of a reconciliation that is a control rather…
Updated
·
19–29 minutes -
How to Audit Inventory: Counts, Costing and Shrink, With a 14-Test Program
The internal auditor’s guide to inventory: the six handoffs where the record and the stock part company, a ten-control starter matrix, a fourteen-test program, how to observe a…
Updated
·
20–30 minutes -
How to Audit Accounts Receivable and Collections: Risks, Controls and a 14-Test Program
The internal auditor’s guide to accounts receivable and collections: where the risk concentrates from invoice to cash, a ten-control starter matrix, a fourteen-test program with sample sizes, the…
Updated
·
20–29 minutes -
Walkthrough vs Test of Controls: Different Questions, Different Evidence
A walkthrough answers whether the process is understood and the control is designed and implemented; a test of controls answers whether it operated across the period. This guide…
Updated
·
19–29 minutes -
Manual, Automated, and IT-Dependent Manual Controls: Testing Implications of Each
The three control natures defined by what can fail, their testing implications side by side (design test, operating test, sample sizes, ITGC reliance, evidence, roll-forward), a five-question classification…
Updated
·
20–30 minutes -
How to Audit Active Directory and Entra ID: The Identity Backbone
The directory is the control plane of every other control. The method for auditing Active Directory and Entra ID: why it is in scope of everything, the privileged…
Updated
·
20–30 minutes -
Testing Automated Controls and System Configurations: A Non-IT Auditor’s Method
How to test the controls a system performs without anyone watching: the seven types of automated control and where their logic lives, why one well-designed test can cover…
Updated
·
21–31 minutes -
How to Audit IT Change Management: From Ticket to Production
The working method for auditing IT change management: the ten controls and their COBIT, ITIL, NIST and COSO references, why the population must come from the production system…
Updated
·
26–39 minutes -
How to Write a Control Description: Well-Written vs Poor Examples
Who, what, when, how, and evidence, plus precision and exception handling: the formula for a control description a stranger can test, ten poor descriptions rewritten, the five-question testability…
Updated
·
19–28 minutes -
Preventive, Detective and Corrective Controls: Taxonomy, 50 Examples, Four Processes Drawn
Definitions without the usual conflations, the cost and assurance trade-offs, the layering doctrine, fifty tagged examples across six process families, the three columns drawn for four real-shaped engagements,…
Updated
·
21–32 minutes -
COSO’s 17 Principles: The Complete List, What Each Requires, and How to Evaluate Them
All seventeen COSO 2013 principles across the five components: the question each asks, the evidence that answers it, what each looks like when it fails, the present-functioning-operating-together evaluation,…
Updated
·
18–28 minutes -
GIAS Domain II: Ethics and Professionalism, Including Professional Courage
Domain II of the Global Internal Audit Standards, standard by standard: the five principles and thirteen standards at a glance, why the Code of Ethics became testable standards,…
Updated
·
19–29 minutes -
How to Run an ERP Segregation of Duties Analysis (Any Platform)
Vendor rulesets flag thousands of conflicts; a few dozen matter. The platform-agnostic method for an ERP segregation of duties analysis: a conflict matrix built from your own risks…
Updated
·
21–31 minutes -
How to Perform a User Access Review That Actually Works
Most user access reviews are signatures, not reviews. How to build one that removes access: scoping by tier with the right reviewers, population completeness reconciled to the system…
Updated
·
19–29 minutes -
Management Review Controls: Documenting and Testing the Hardest Controls in SOX
How to design a management review control that can be tested and test one that exists: the six-element anatomy, the precision factors from PCAOB Staff Audit Practice Alert…
Updated
·
19–29 minutes -
SOX 404 Explained: The Complete Guide to ICFR Compliance
Section 404 in full for the internal auditor: what 404(a), 404(b), 302 and 906 require, the filer categories and exemptions as amended in April 2020 that decide whether…
Updated
·
19–29 minutes -
How to Audit Privileged Access: Admin Rights, Break-Glass, and Vaulting
Privileged access decides how bad everything else can get. The method for auditing it: privilege defined by capability across every layer from the directory to the database and…
Updated
·
19–28 minutes -
ITGC vs Application Controls: The Dependency Everyone Gets Backwards
An application control is only as reliable as the general controls over the system it runs in. The two layers defined precisely, the mechanism by which each ITGC…
Updated
·
21–31 minutes -
Segregation of Duties Beyond the ERP: A Universal SoD Framework
Segregation of duties is taught as an ERP problem and most of the losses it prevents happen nowhere near one. The universal framework: the four incompatible functions and…
Updated
·
19–28 minutes -
How to Audit Identity and Access Management: The Full IAM Program
Identity is the control plane of everything else. The program audit of identity and access management: the seven domains and their frameworks, the joiner-mover-leaver chain with the leaver…
Updated
·
20–29 minutes