Data
Internal audit data you can check, use and cite.
Datasets for internal auditors, SOX teams, audit committees and researchers, built from primary sources. Every row links to the document it came from, the method is published, and the data is free to reuse under CC BY 4.0.
- Primary sources
- Every row linked to its source
- Method published
- Free CSV downloads
- CC BY 4.0
Latest release: Material Weakness Tracker, Q3 2026 edition · published October 22, 2026
Datasets
Each dataset, with its source and its method.
Every dataset has its own page: the findings, a searchable table, a CSV download, the method and a changelog. Datasets released in editions list each edition with its own download.
Material Weakness Tracker
Every material weakness disclosed in 10-K and 10-Q filings made between July 1 and September 30, 2026, plus ineffective-controls conclusions, remediations and 8-K non-reliance notices. Each filing is classified by cause, filer status, industry and whether the weakness was newly disclosed, with a plain-English summary and a link to the filing on SEC EDGAR.
- 904 companies reported a material weakness
- 1,263 filings in the dataset, from 1,090 companies
- 120 large accelerated and accelerated filers, listed by name
- 16 cause categories, such as segregation of duties and IT general controls
The most common causes
Share of the 904 companies with a material weakness citing each cause, Q3 2026
Source: Material Weakness Tracker, internalauditguide.com
How the data is made
Human judgment, expert rules and frontier AI.
Every dataset here comes from three things working together, and none of them would be enough on its own.
Questions worth answering
Each dataset starts with a question auditors face, such as which public companies are reporting material weaknesses, and why. Practitioners decide what to measure, what counts and what a reader needs to see first.
Rules from audit practice
Definitions come from the rules that govern the subject, such as SEC and PCAOB requirements. Categories and counting rules come from how audit work is done. All of them are published with the data, so the rules behind every number can be checked.
Every row, read from its source
Frontier AI models read the source documents against those rules: for one quarter of the Material Weakness Tracker, the controls disclosures of 1,375 filings. Each dataset’s methodology sets out how that reading was checked. For the tracker, a second AI reader re-classified a sample blind, automated tests checked every row against its source text, and a separate AI review re-read the rows most likely to be quoted before release.
The result is data broad enough to show the whole picture and specific enough to check line by line: every row links to the document it came from.
Standards
Four rules every dataset here follows.
The point of publishing data is that others can rely on it. These rules are how we make that possible, and each dataset’s methodology shows how they were applied.
Primary sources only
Every row comes from a public document, such as a company’s filing on SEC EDGAR, and links straight to it. Nothing rests on press coverage or on another database’s reading.
Written rules, published
Each document is classified against a written rubric. The definitions, categories and counting rules are published with the data, so any reading can be checked.
Checked before release
Each dataset’s methodology reports its checks and what they found, including what was corrected or removed before publication.
Corrected in the open
If a row is wrong, tell us through the contact page. We check it against the source, and corrections are listed in the dataset’s changelog.
Use the data
Free to use, share and cite.
All datasets on this page are published under the Creative Commons Attribution 4.0 International license. Use them in articles, research, audit committee materials, training material or your own analysis, commercially or not, as long as you credit internalauditguide.com, link to the dataset’s page and the license, and say if you changed the data. No sign-up is needed to download anything.
internalauditguide.com. (Year). Dataset name: Edition [Data set]. URL. Leave out the edition for datasets published once.
For example:
internalauditguide.com. (2026). Material Weakness Tracker: Q3 2026 [Data set]. https://internalauditguide.com/material-weakness-tracker/Questions
About the data.
What data does internalauditguide.com publish?
Free datasets built from public primary sources on the subjects internal auditors, SOX teams and audit committees work with. Each one has its own page with the findings, a searchable table, a CSV download and the method, and is listed above with its source and coverage.
Is the data free to use?
Yes. Every dataset is published under CC BY 4.0, so you can use it for any purpose, including commercial work, if you credit internalauditguide.com, link to the dataset’s page and the license, and note any changes. Downloads need no sign-up.
How is AI used, and who decides what goes in?
Practitioners decide what to measure and write the rules that decide what goes in: the definitions, the categories and the counting rules each dataset publishes. Frontier AI models then read the source documents against those rules, at a scale that would take a team of people weeks by hand. Each dataset’s methodology lists how that work was checked and what the checks found. For the Material Weakness Tracker, a second AI reader re-classified a sample blind, automated tests checked every row, and a separate AI review re-read the rows most likely to be quoted. Every row links to its source, so anyone can check it.
How is the data checked?
Four ways: every row comes from a primary source and links to it; the rules are written down and published; each dataset is checked before release, and its methodology reports what the checks found and what was corrected; and reported errors are checked against the source and fixed in the open.
How do editions and updates work?
Each dataset page says exactly what period it covers. Datasets released in editions, such as the Material Weakness Tracker (each edition covers one quarter’s filings), list each edition with its own CSV; one-off studies cover a single period. Corrections to any edition are listed in that dataset’s changelog.
How should I cite a dataset?
Use the suggested citation on the dataset’s page. It names the edition, so a reader can find the exact numbers you used. The general pattern is in the “Use the data” section above.
Can I embed a chart on my own site?
Yes. Datasets with charts include ready-made embed code in their “Use the data” section, with the credit line and a link back to the source.
I think a row is wrong. What should I do?
Send the dataset name, the company or row, and what the source says through the contact page. We check it against the source document, and corrections are listed in that dataset’s changelog.
Can I suggest a dataset?
Yes. Write to us through the contact page with the question you want answered and the public source that could answer it.
Put the data to work
Guides that go with the data.
- Evaluating control deficiencies: how an exception becomes a significant deficiency or a material weakness.
- SOX 404 explained: management’s assessment, the auditor’s attestation and who needs which.
- SOX for control owners: what testers ask for, and what each phase of the year means.
- Segregation of duties beyond the ERP: the cause smaller companies cite most.
- IT general controls primer: the cause larger filers cite most.
- Evidence standards for issue closure: what proof a remediation needs.