How we review audit software.

Evidence levels: what each page is based on

Every review, comparison and alternatives page carries an evidence line in its verdict box, and every guide carries one in its “How to read this guide” box. The line says what the page is built from, using one of three levels. A page moves up a level only when the access behind it improves, and the level is not inferred from how confident the writing sounds.

Level	What it means	Where it applies today
Research-based	Vendor documentation and release notes, public procurement records and contracts, third-party pricing data, verified user reviews on Gartner Peer Insights and G2, analyst coverage, and the vendor’s own trust, security and pricing pages. No product access.	Every page in the section as of September 2026. Each page says so in its own words: we have not used the product hands-on.
Demo-reviewed	A live vendor demonstration run to this site’s own script, with the site controlling the scenarios and writing the verdict. The vendor sees the script, not the draft.	Not used for any page in this section. The script is published so any reader can run it: the audit software demo script.
Hands-on	Use of the product in a trial, sandbox or real audit work, with screenshots taken by this site.	Not used for any page in this section. A hands-on page names the version, how long it was used and what was tested.

Research-based is the honest label for the section today, and it is stated on every page rather than left for the reader to guess. It is also a real method: a procurement record is better evidence of price than a sales call, a vendor’s own release notes are better evidence of what shipped than a demo, and a few hundred verified reviews are better evidence of day-to-day experience than one reviewer’s afternoon in a sandbox. What research cannot do is judge the feel of a workflow, which is why the scorecard rates what a product does, not how it feels to use.

What we read, and what we do not treat as evidence

• Vendor documentation and release notes. Product pages, help centers, release notes with dates, trust and security pages, pricing pages, and the vendor’s own case studies, quoted as claims rather than facts.
• Public procurement records. Council agendas, state bid documents, UK Contracts Finder and Find a Tender notices, G-Cloud rate cards, and cloud-marketplace listings. These are the only figures this site presents as prices actually paid or bid.
• Third-party pricing data. Vendr’s buyer data (medians and ranges), used with its sample size and update date shown, and described as a guide rather than a quote.
• Verified user reviews. Gartner Peer Insights, using the Audit Management Solutions market figures unless a page says otherwise, and G2. Review themes are paraphrased and attributed to the platform; individual reviewers are not quoted at length, and none are invented.
• Analyst coverage. Gartner’s Market Guide for Audit Management Software (13 April 2026), Gartner’s Magic Quadrant for GRC Tools (a broader market, October 2025), the Forrester Wave for GRC Platforms (Q2 2026), and Gartner’s 16 September 2026 adoption research. Vendor badge walls are read against the actual reports.
• Company and ownership records. Press releases, acquisition announcements, public filings and the FedRAMP Marketplace, because who owns a vendor and what it is authorized to run matters to a five-year decision.

Not treated as evidence: vendor comparison pages about competitors (read, but quoted only as the vendor’s own position), AI-written aggregator sites, unattributed “starting at” prices, and anything this site could not open and date itself. Where a fact could not be verified, the page says so rather than rounding it into a claim.

The scorecard: twelve areas plus vendor viability

Each product is rated Strong, Adequate, Limited or Not offered on twelve areas, with one line of evidence per area. The areas follow how an internal audit function actually works, from the audit universe to the renewal conversation, and several map directly to the IIA’s Global Internal Audit Standards. For analytics tools and Excel add-ins, the areas that describe running an audit function are marked “n/a: not what the tool is for,” and the scorecard adds data connectivity, learning curve and reproducibility of results instead.

Area	What we look for	Standards link
1. Risk assessment and planning	Audit universe, risk scoring, a rolling plan, resourcing	GIAS 9.4 and 9.5
2. Engagement workflow	Planning memo, risk and control matrix, test steps, review and sign-off	GIAS 13 and 14
3. Workpapers and evidence	Linking, versioning, retention, a real audit trail	GIAS 14.6
4. Issues and follow-up	Action plans, validation, aging, escalation, management self-reporting	GIAS 15.2
5. Reporting	Engagement reports, audit committee dashboards, exports	GIAS 15.1
6. SOX and controls testing	Control library, testing cycles, deficiency evaluation, certifications	—
7. Analytics and automation	Data connections, scripted tests, continuous monitoring	—
8. AI features	What exists today, which model, how customer data is used, whether outputs can be checked	—
9. Quality program support	QAIP metrics, methodology enforcement	GIAS Principle 12
10. Auditee experience	Request portal, action-plan updates, notifications	—
11. Administration, integrations and security	SSO, API, data residency, the vendor’s own SOC 2 or ISO 27001, FedRAMP status	—
12. Cost and contract	Pricing model, what costs extra, renewal terms, how to get your data out	—
Vendor viability	Ownership, acquisitions, financing, roadmap risk	—

The four levels mean what they say. Strong: the capability is native, documented and specific enough that a buyer can test it in a demo. Adequate: it exists and works for most functions, with a documented limitation. Limited: it exists in a form most functions would supplement or work around. Not offered: nothing found in the product’s own documentation, which the page states as “not found” rather than “does not exist” where the vendor’s documentation is thin. The site’s guide to the Global Internal Audit Standards explains the standards the areas point to.

Fit by situation: the decision device

A single score out of ten would be false precision, because the same product can be the obvious choice for a 40-person bank audit function and the wrong purchase for a team of three. So every review and comparison rates the product against eight buying situations as Strong fit, Workable or Poor fit, each with a one-line reason. Analytics tools are marked n/a for situations they are not built to serve.

Situation	What Strong fit means here
First system for a small team (1 to 5 auditors)	A real public price a small buyer can pay, light administration, and a product that works without a dedicated administrator
Mid-size function (6 to 25 auditors)	The whole audit lifecycle native, with the review volume and price evidence to support a normal selection
Large or global function (25+ auditors)	Scale, entity and language handling, role-based administration, and a customer base at that size
SOX-heavy public company	A named SOX and controls layer with testing cycles, deficiency evaluation and certifications, not a generic control library
Bank or credit union	A regulated-financial-services customer base, examiner-facing reporting and the certifications examiners ask about
Public sector, higher education or nonprofit	Authorizations that can be verified (FedRAMP, GovRAMP, G-Cloud), public-sector price evidence and a customer base to match
Analytics-heavy team	Full-population, repeatable, scripted testing with a documented audit trail, natively or through a first-class integration
Consolidating GRC across the three lines	Risk, compliance and audit on one data model, with audit deep enough not to be diluted by the rest

Ratings are set once per product, centrally, before the pages are written, and every page that shows a product’s rating copies it from the review unchanged. That is why a comparison matches the review it draws on, and why the best-of guide’s 25-by-8 matrix can be checked cell by cell against the reviews. Where a writer thought a rating was wrong, the page keeps the rating and says so.

How prices are sourced

Every price on every page carries its source and date in the same sentence or the same table cell, and it belongs to one of four kinds: a public procurement record (a bid, a quote in a council agenda, a rate card, a tender award), a cloud-marketplace contract, a vendor’s own published list price, or third-party buyer data. Buyer data is shown with its sample size and its update month, and described as a median or an average, not as a quote. Where a total in a public record does not sum from its line items, the page uses the record’s own total and says so. Where no public figure exists, the page says “no public price” and reports what the vendor asks a buyer to do instead. Cost illustrations over five years are labeled as illustrations, built only from public figures, with every assumption stated.

What every review contains

• A verdict box: the verdict in one or two sentences, best for, not for, evidence level, price evidence and a last-verified date
• What the product is and who owns it, including rebrands, acquisitions, financing and a dated timeline
• The modules and editions, and where internal audit sits among them
• A walkthrough by audit stage, from planning to follow-up, built from documentation and release notes
• The twelve-area scorecard and the fit-by-situation table
• AI: what shipped, when, on which model, and what the vendor says happens to customer data
• Pricing and contract notes, with every figure sourced and dated
• What verified users praise and complain about, paraphrased and attributed
• How it compares, linking the site’s comparisons and alternatives pages
• Implementation and migration notes
• A worked example where one helps, using the site’s fictional entities (MidState Beverage, Lakeshore Bancorp), labeled as fictional
• Questions readers actually ask, a non-affiliation statement, a sources list and related guides

What we do not do

• No hands-on claims. No page implies product use it did not have. Screenshots appear only when they are this site’s own.
• No vendor money. No paid placements, no affiliate links, no sponsored rankings, no lead forms sold to vendors.
• No previews. Vendors do not see drafts and do not approve anything. Factual corrections are welcome after publication.
• No invented quotes or reviews. Review themes are paraphrased from verified platforms and attributed to them. Where a quotation appears, it is verbatim from a source the page lists.
• No logos or trademark symbols. Product and company names appear in plain text and belong to their owners.
• No single score. The scorecard and the eight situations are the whole verdict; there is no number to compare across products because none would survive contact with a real function’s circumstances.
• No “Gartner Magic Quadrant for audit management.” There is none. Gartner publishes a Market Guide for the category; the Magic Quadrant vendors cite covers GRC tools, and the pages say which is which.

Corrections, updates and the last-verified date

Every page carries the date its facts were last checked. This market renames itself often enough that a date matters: AuditBoard became Optro, StandardFusion became TeamMate Risk & Compliance, HighBond became the Diligent One Platform, and SAP Audit Management is moving into SAP GRC 2026, all within the period these pages cover. The “Last verified” date on each page is the date its prices, ownership, authorizations and product names were last checked, and the hub lists the market changes these pages reflect. A reader or a vendor who finds an error can write to desk@internalauditguide.com with the page, the claim and the source; corrections that change a fact are made on the page and dated.

Who writes this

internalauditguide.com is written by practising internal auditors for other practitioners: people who have run audit functions, sat on selection committees, lived through implementations and argued with renewal quotes. Pages in this section are published under the site’s name rather than an individual byline, and the site, not any vendor, is accountable for every word. The site’s guide to the mistakes audit teams make when buying software is the shortest statement of what that experience taught, and the buyer’s guide is where all of it lands.