-
Black Box Thinking by Matthew Syed: Summary and Lessons for Auditors
Syed on why some fields learn from failure and most do not, summarised for auditors: the structure, the aviation and healthcare cases checked and updated to 2026, later…
Updated
·
34–51 minutes -
Meltdown by Clearfield and Tilcsik: Summary and Lessons for Auditors
Clearfield and Tilcsik on why complex, tightly coupled systems fail, summarised for auditors: the danger zone, the cases checked against official records, seven remedies, a vocabulary, an audit…
Updated
·
26–39 minutes -
The Field Guide to Understanding ‘Human Error’ by Sidney Dekker: Summary for Auditors
Sidney Dekker’s guide to investigating failure, summarised for auditors: the Old View and the New View, the four reactions to failure, the six steps, accident models, a vocabulary,…
Updated
·
29–43 minutes -
Normal Accidents by Charles Perrow: Summary and Lessons for Auditors
Perrow’s theory of system accidents, summarised for auditors: the two dimensions, the Three Mile Island archetype, nine ideas, a vocabulary, an audit map and a worked example sorting…
Updated
·
19–28 minutes -
Internal Audit in Telecom and Media: The Complete Guide to Networks, Billing and Content
A telecom operator bills hundreds of millions of events a month from systems that nobody fully understands, runs networks that governments treat as critical infrastructure, and sells through…
Updated
·
25–38 minutes -
Internal Audit in Retail: The Complete Guide to Stores, Shrink, Omnichannel and Supply Chain
Retail is the industry of small transactions at enormous volume, performed by a workforce that turns over every year in locations head office rarely sees, and internal audit’s…
Updated
·
22–33 minutes -
Internal Audit in Manufacturing: The Complete Guide to Plants, Supply Chains and Cost
Manufacturing is where internal audit was born, and it remains the industry where the function’s work is most physical: inventory that can be counted, scrap that can be…
Updated
·
22–33 minutes -
How to Audit Capital Projects and Construction: Cost, Contract and Schedule Controls
Capital projects are where organizations spend their largest discretionary sums through contracts they rarely understand, administered by people who want the building finished, and the result is that…
Updated
·
20–30 minutes -
Building an Operational Risk Framework: Taxonomy, Tools and Governance
An operational risk framework is the machinery through which an organization sees the losses that come from its own processes, people, systems and external events before they arrive,…
Updated
·
21–32 minutes -
Designing a KRI Program: From a Metric Wishlist to an Early Warning System
Most organizations have a KRI list and almost none have an early warning system. This guide explains the difference and how to close it: what a key risk…
Updated
·
18–27 minutes -
How to Run a Business Impact Analysis: RTOs, RPOs and the Processes That Matter
The business impact analysis is the document every continuity and resilience program rests on and the one most often done as a questionnaire exercise. This guide gives the…
Updated
·
18–27 minutes -
Operational Resilience Explained: Important Business Services, Impact Tolerances, Tests
Operational resilience began as a UK regulatory idea and has become the way financial firms and, increasingly, other organizations think about disruption. This guide explains the framing and…
Updated
·
19–28 minutes -
Risk Taxonomy: How to Build One, With a Full Three-Level Example and Six Design Rules
Every risk program references a taxonomy and almost nobody explains how to build one. This guide does: what a taxonomy is and is not, the six design rules…
Updated
·
18–27 minutes -
How to Audit Operational Risk Management: A Work Program for the Framework, Not the Events
Auditing operational risk management means auditing the framework that identifies, assesses, monitors and reports operational risk, not re-auditing the processes where losses happen. This guide sets out the…
Updated
·
23–34 minutes -
How to Audit Payment Operations and Wire Transfers: Stopping the Nine-Figure Mistake
The internal auditor’s guide to payment operations and wire transfers, for banks and corporates: the eight-stage payment life cycle and the rails, who bears the loss under UCC…
Updated
·
19–28 minutes -
Vendor and Third-Party Models: Validating What You Cannot See Inside
Vendor does not mean exempt: the types of vendor model and what is visible in each, six due-diligence substitutes for transparency, the customisation boundary where your configuration becomes…
Updated
·
19–28 minutes -
Third-Party Resilience: Continuity When the Failure Is Not Yours
Continuity planning for the failures that belong to someone else: criticality-tiered continuity requirements for suppliers, the evidence that proves resilience rather than asserting it, the arithmetic linking a…
Updated
·
19–28 minutes -
Fourth Parties and Vendor Concentration: The Risk Behind the Risk
Your vendors’ vendors: three failures that arrived through the back door (CrowdStrike, Change Healthcare, MOVEit), the terms defined precisely, what DORA, the interagency guidance, the EBA and PRA,…
Updated
·
18–28 minutes -
Vendor Due Diligence: What to Actually Check, by Risk Tier
A due-diligence workbench organised by what you need to know before you sign and calibrated by risk tier: the fourteen interagency factors with the evidence that counts, depth…
Updated
·
19–29 minutes -
Third-Party Risk Management End-to-End: The Full Lifecycle Program
The third-party risk management lifecycle end to end: the regimes the program must satisfy (interagency guidance, the IIA Third-Party Topical Requirement, DORA, EBA, PRA, UK Critical Third Parties),…
Updated
·
21–32 minutes -
How to Audit Cloud Security: A Control-by-Control Program
A provider-agnostic cloud security audit program: the shared-responsibility test map by service model, criteria (CSA CCM v4, ISO/IEC 27017 and 27018, NIST SP 800-210, CIS Foundations Benchmarks, DORA),…
Updated
·
19–28 minutes -
How to Audit Patch and Vulnerability Management
You cannot patch what you cannot see. The method for auditing vulnerability and patch management as a program: the frameworks from NIST SP 800-40 Rev. 4 to the…
Updated
·
19–29 minutes -
How to Review a SOC 2 Report: Trust Services Criteria for User Entities
The user entity’s method for a SOC 2 report under the AICPA Trust Services Criteria: what the report is and is not, which of the five categories your…
Updated
·
20–29 minutes -
How to Review a SOC 1 Report: A User Entity’s Working Method
The user entity’s method for a SOC 1 report under SSAE 18: what the report is and is not, the five sections and what to read in each,…
Updated
·
21–31 minutes -
How to Run a Risk and Control Self-Assessment (RCSA) That Is Not Theater
RCSA end to end: scoping, workshop vs survey design, scoring discipline, the challenge function, facilitator scripts, and the classic failure modes.
Updated
·
18–27 minutes -
Third-Party Topical Requirement: The 17 Requirements, Mapped for 15 September 2026
The IIA’s Third-Party Topical Requirement, effective 15 September 2026, as a working guide: what counts as a third party, when the requirement binds, all seventeen requirements in three…
Updated
·
30–46 minutes -
Operational Risk Guide for Internal Auditors (2026)
Operational risk from the third line’s seat: the Basel event types with examples, the framework’s components with the audit test for each, twelve leading KRIs with thresholds, loss…
Updated
·
21–31 minutes -
RPA in Internal Audit: Where Bots Pay Off, Building Them as Evidence, Auditing the Program
RPA as two subjects for internal audit: using bots in the function (where they pay off, how to build one that produces audit evidence, the economics, the boundary…
Updated
·
18–27 minutes -
OCC Risk Categories: The 8 Risk Stripes Explained
For decades the OCC supervised US national banks through eight risk categories, often called risk stripes: credit, interest rate, liquidity, price, operational, compliance, strategic, and reputation. Since 2025…
-
Risk: A User’s Guide by McChrystal and Butrico: Summary for Auditors
McChrystal and Butrico’s framework for the risk immune system, summarised for auditors: the argument, the ten factors, the cases, a vocabulary, an audit map for response capability and…
Updated
·
18–27 minutes