The internal audit software requirements matrix.

What is in the workbook

Six working sheets and a start page.

The start page explains the method on one page. Everything you fill in is yellow, and everything else calculates or explains, so the workbook runs without a vendor or a consultant.

The ten areas and their starting weights

Weights decide more than the list does.

Every system on the market claims every capability on a requirements list, so products separate on the weights. The eight core areas carry the starting weights from the RFP method for three sizes of function; each column adds to 100. The two optional areas start at zero: give them points only if SOX testing or AI capability is part of the decision, and take the points from another row. The RFP method scores AI through the data-use and roadmap lines, which is why that area starts at zero.

Must, should and could are the site’s suggested priorities; you set your own in the workbook. 34 of the lines (A1 to A6, B1 to B7, C1 to C6, D1 to D4, E1 to E5 and F1 to F6) are the requirements template published in the RFP method, word for word.

How the scoring works

Codes, not prose. Formulas, not feelings.

Vendors answer each line with one of five codes rather than a paragraph, because prose answers are where “yes” turns into “yes, with services”. The codes are also the scoring key.

• Five response codesStandard scores 1.00 (available now, in the base product, shown in the demo). Configuration 0.75 (an administrator can do it without the vendor). Customization 0.25 (vendor development or paid services). Roadmap and Not available score zero.
• Three prioritiesM for must: a product that cannot meet it is out, whatever its score. S for should: it scores. C for could: it breaks ties. Out takes a line off the list without deleting it.
• Area scoresPoints earned on an area’s must and should lines, divided by the number of those lines. An unanswered line counts as zero and is counted separately, so gaps cannot hide.
• The weighted scoreEach area’s score times its weight, added up and scaled to 100. Could lines stay out of it and appear as a separate tie-breaker.
• Knock-outsRoadmap or Not available on a must line puts a vendor out. Customization on a must line keeps it in but is shown on its own row, because it means paying for services.
• The demo sits beside itThe demo score and the reference calls are reported next to the requirements score, not blended into it, so a strong demo cannot paper over a failed must-have.

Seven steps

From blank workbook to a defensible shortlist.

1. Set up the function.Team size, vendor names and, if your function differs from the defaults, new weights with the reason written next to each move.
2. Set the priorities before any vendor sees the list.Read every line and mark it must, should, could or out. A list with too many musts ranks nobody, because every product fails one of them.
3. Send the response form with the RFP.Copy the form into a new workbook, paste columns A to C as values, keep every row (out lines stay struck through) and require one code per line. Give vendors two to three weeks.
4. Paste the codes back.Each returned form has a Code column; paste it as values into that vendor’s column on the Requirements sheet, starting at row 6. The rows line up because none were deleted.
5. Read the Summary, then chase the gaps.Unanswered lines and must-haves met only through customization are the follow-up questions for the next round.
6. Run the demo script with the finalists.Score the 25 scenarios on your own data, with weights set before the first session.
7. Make the reference calls.Ask the nine questions in order and write the answers up the same day. Score nothing: what you hear belongs in the contract.

Mapped to the Global Internal Audit Standards

Why each requirement matters to an audit function.

102 of the 156 lines carry a reference to the standard they help a function evidence, 37 different standards in all, from engagement documentation (14.6) and monitoring action plans (15.2) to the internal audit plan (9.4) and protection of information (5.2). A system does not make a function conform; it makes the evidence of conformance cheaper to produce and easier to show an external assessor. The standard behind the purchase itself is 10.3, Technological Resources. The guide to the Global Internal Audit Standards explains each one.

• 5.2 Protection of Information
• 14.6 Engagement Documentation
• 15.2 Confirming the Implementation of Recommendations or Action Plans
• 9.4 Internal Audit Plan
• 14.1 Gathering Information for Analyses and Evaluation
• 12.3 Oversee and Improve Engagement Performance
• 12.2 Performance Measurement
• 9.3 Methodologies
• 14.2 Analyses and Potential Engagement Findings
• 14.3 Evaluation of Findings

Standard numbers and names are from the IIA’s Global Internal Audit Standards, effective 9 January 2025. internalauditguide.com is not affiliated with or endorsed by The Institute of Internal Auditors. 70 lines also name the demo scenario that tests them.

Questions

About the requirements matrix.

Keep going

Related guides.

• Internal audit software: the independent buyer’s guide — every review, comparison and buying guide in one place
• How we review audit software — the evidence levels, the scorecard and the fit-by-situation method
• The audit software shortlist finder — eight questions, a shortlist with reasons
• Selecting an audit management system — the RFP method this workbook puts into practice
• The audit software demo script — 25 scenarios that make vendors show rather than tell
• Audit software due diligence — security, data residency, AI data use and vendor risk
• Internal audit software pricing — real numbers, pricing models and how to negotiate
• The business case for audit software — getting the budget approved
• 15 mistakes teams make when buying software — and how to avoid each one
• Implementing audit management software — the first 120 days and the migration
• Best internal audit software, by situation — 25 platforms and tools rated for eight buying situations