-
Accelerate by Forsgren, Humble and Kim: Summary and Lessons for IT Auditors
The research behind the DORA metrics, summarised for IT auditors: the four key metrics and the 2017 data, the 24 capabilities and Westrum’s culture model, the change approval…
Updated
·
26–39 minutes -
Weapons of Math Destruction by Cathy O’Neil: Summary and Lessons for Auditors
Cathy O’Neil’s critique of harmful algorithms, summarised for auditors: the tests of opacity, scale and damage, five cases checked against the record, the rules written since 2016, a…
Updated
·
29–44 minutes -
The Cuckoo’s Egg by Clifford Stoll: Summary and Lessons for IT Auditors
Clifford Stoll’s hunt for a KGB-linked hacker, summarised for auditors: the 75-cent discrepancy, the case checked against the 1990 verdict, the investigator’s methods, the weaknesses exploited, a vocabulary,…
Updated
·
23–35 minutes -
The Phoenix Project: Summary and What It Means for IT Auditors
Kim, Behr and Spafford’s DevOps novel, summarised for auditors: the story, the Three Ways, the four types of work, the audit scoping sub-plot, a vocabulary, an IT audit…
Updated
·
19–28 minutes -
Normal Accidents by Charles Perrow: Summary and Lessons for Auditors
Perrow’s theory of system accidents, summarised for auditors: the two dimensions, the Three Mile Island archetype, nine ideas, a vocabulary, an audit map and a worked example sorting…
Updated
·
19–28 minutes -
Writing Audit Reports With AI Assistance: The Workflow and the Guardrails
A working protocol for AI-assisted audit writing: the tasks drafting assistance reliably improves, the fabrication patterns specific to audit reports, the three-stage workflow with a verification pass built…
Updated
·
18–27 minutes -
Continuous Monitoring on a Small Budget: Five to Ten Indicators, No Platform
Continuous monitoring is sold as a platform purchase, and most small internal audit functions conclude it is not for them. It is, if the ambition is right: five…
Updated
·
21–31 minutes -
Generative AI Across the Audit Lifecycle: Use Cases, Review Gates and Failure Modes
Generative AI is already inside most internal audit functions, whether the function decided that or not, and the question has moved from whether to use it to where…
Updated
·
23–35 minutes -
Documenting Analytics as Audit Evidence: Queries, Scripts and Reproducibility
When an audit test is a query, the workpaper is the code, and most analytics workpapers would not survive the question a reviewer, an external auditor or a…
Updated
·
18–27 minutes -
Auditing Agentic AI: When the System Acts, Not Just Answers
A chatbot that gives a wrong answer embarrasses the company; an agent that takes a wrong action refunds a customer, deletes a database, grants an administrator role or…
Updated
·
25–37 minutes -
Internal Audit in Telecom and Media: The Complete Guide to Networks, Billing and Content
A telecom operator bills hundreds of millions of events a month from systems that nobody fully understands, runs networks that governments treat as critical infrastructure, and sells through…
Updated
·
25–38 minutes -
Internal Audit in Energy and Utilities: The Complete Guide to Rates, Reliability and Risk
Utilities are the industry where the regulator sets the price, the public cannot refuse the product, and a failure of the asset can start a wildfire, freeze a…
Updated
·
24–35 minutes -
Internal Audit at Tech and SaaS Companies: The Complete Guide to a Function Built Fast
Technology companies build their internal audit functions late, fast and under a deadline that is usually an IPO, and the function that results looks different from any other…
Updated
·
22–33 minutes -
How to Audit HIPAA Compliance: Privacy Rule, Security Rule and Breach Notification Assurance
HIPAA is the rule set every healthcare organization claims to comply with and the one whose enforcement record shows how often the claim is wrong: the Office for…
Updated
·
21–32 minutes -
Auditing Enterprise AI Governance: A Program for the NIST AI RMF and EU AI Act Era
Enterprise AI governance is the set of structures through which an organization decides which AI systems it builds or buys, how much risk each may carry, who is…
Updated
·
20–30 minutes -
Designing a KRI Program: From a Metric Wishlist to an Early Warning System
Most organizations have a KRI list and almost none have an early warning system. This guide explains the difference and how to close it: what a key risk…
Updated
·
18–27 minutes -
SQL for Auditors: 20 Queries Mapped to Audit Questions, Practice Data, Learning Path
SQL is the one technical skill that pays back in the first week. This guide teaches it the way auditors use it: a fictional accounts payable schema, twenty…
Updated
·
17–26 minutes -
Monetary Unit Sampling (MUS) for Internal Auditors: Sample Size, Selection and Evaluation
Monetary unit sampling makes every dollar in a population a sampling unit, so large items are more likely to be selected and the sample can be evaluated in…
Updated
·
19–28 minutes -
Internal Audit KPIs: 30 Metrics That Show Whether the Function Works, With Targets
Internal audit functions measure what is easy (hours, reports issued) and skip what matters (whether risk went down). This guide sets out thirty key performance indicators grouped by…
Updated
·
20–29 minutes -
AI Usage Policy for Internal Audit: A Model Policy, Clause by Clause, With Workpaper Rules
Most internal audit functions now use generative AI and most have no written rules for it. This guide supplies them: why the function needs its own policy even…
Updated
·
18–27 minutes -
TeamMate vs Ideagen Internal Audit (Pentana): The UK and Public-Sector Shortlist
How TeamMate (Wolters Kluwer) and Ideagen Internal Audit (formerly Pentana Audit) compare for UK public-sector, housing, higher-education and credit-union audit teams: modules, SOX and analytics depth, the AI…
Updated
·
24–37 minutes -
IBM OpenPages vs Archer: Which Regulated-Industry GRC Platform for Audit?
This comparison covers what IBM OpenPages and Archer each publish about ownership, audit workflow depth, SOX and controls, the AI features each shipped from 2024 through 2026, pricing…
Updated
·
23–34 minutes -
TeamMate vs Onspring: Two FedRAMP-Authorized Options for Public-Sector Audit Teams
Why public-sector and higher-education teams weigh TeamMate against Onspring, what each vendor’s FedRAMP authorization actually covers, real prices from a two-user city quote to a Vendr median, the…
Updated
·
22–32 minutes -
IDEA vs Arbutus vs ACL: Choosing an Audit Analytics Tool
How Caseware IDEA’s built-in function library, Arbutus Analyzer’s ACL-compatibility claims, and ACL Analytics’ Diligent One Platform dependency and Claude-4.6-powered AI Studio compare on scripting engines, SOX, security, AI,…
Updated
·
23–34 minutes -
Optro vs MetricStream: Audit-First SaaS Suite Against the Enterprise GRC Veteran
What Optro (formerly AuditBoard) and MetricStream are and who owns them, the review-base gap between Optro’s 890 Gartner Peer Insights reviews and MetricStream’s six, how their audit workflow,…
Updated
·
23–35 minutes -
MetricStream vs ServiceNow IRM: Specialist GRC Suite or Platform Add-On?
What MetricStream and ServiceNow IRM are and who owns each, how their audit workflow, SOX coverage and 2024-2026 AI launches differ, a head-to-head scorecard and fit-by-situation table, the…
Updated
·
23–35 minutes -
IBM OpenPages Internal Audit Review: Published Prices, AI Agents and the Fit
What IBM OpenPages is and who owns it, the nine-module platform Internal Audit Management sits inside, SOX and controls, the AI releases from OpenPages 9.1 through 9.2.1, the…
Updated
·
28–42 minutes -
Optro vs Hyperproof: Internal Audit Platform Against Compliance Operations
What Optro (formerly AuditBoard) and Hyperproof are each actually built to do, the ITGC and SOC 2 situations where Hyperproof earns a real second look, the two products’…
Updated
·
19–28 minutes -
TeamMate vs Workiva: Audit-First Platform Against the SOX and Reporting Suite
TeamMate and Workiva compared for internal audit and SOX: where each vendor’s workflow, pricing model, public-sector standing, and SOX and AI features actually differ, a side-by-side scorecard, fit…
Updated
·
22–33 minutes -
Ideagen Internal Audit (Pentana Audit) Review: Who It Suits and Who It Doesn’t
What Ideagen Internal Audit (formerly Pentana Audit) is and who owns it, the modules and editions on offer, a stage-by-stage walkthrough, where it stands on SOX and analytics,…
Updated
·
22–33 minutes