Here is a comprehensive list of tools and techniques (T&Ts) used in internal auditing, aligned with the IIA’s 2024 Global Internal Audit Standards and best practices. These are grouped by purpose and usage across the internal audit lifecycle.
🔍 I. Risk Assessment & Planning Techniques
SWOT Analysis – Evaluates strengths, weaknesses, opportunities, and threats.
PESTLE Analysis – Considers external factors: Political, Economic, Social, Technological, Legal, Environmental.
Risk Control Matrix (RCM) – Aligns risks, controls, and testing procedures.
COSO ERM Framework – Used to identify and assess enterprise risks.
Heat Maps – Visual tool for prioritizing risks by impact and likelihood.
Risk Registers – Centralized repository for tracking risks.
Control Self-Assessments (CSA) – Involve stakeholders in evaluating internal controls.
Delphi Technique – Consensus-building through expert opinion in rounds.
Brainstorming Sessions – Team-based risk identification.
Scenario Analysis – Explores multiple risk/event outcomes.
📝 II. Fieldwork and Evidence Collection Techniques
Walkthroughs – Step-by-step tracing of processes to understand workflows.
Interviews – Gather insights from process owners or stakeholders.
Surveys & Questionnaires – Quantify feedback or control effectiveness.
Observation – Direct monitoring of operations.
Document Review – Examining policies, reports, procedures, and records.
Process Mapping / Flowcharting – Visual representation of processes.
Sampling Techniques:
Random sampling
Stratified sampling
Judgmental sampling
Data Analytics / CAATs (Computer-Assisted Audit Techniques) – Use software (e.g., ACL, IDEA, Excel, Power BI) to analyze large data sets.
Reperformance – Auditor independently performs the control to verify accuracy.
Root Cause Analysis (RCA) – Determines underlying causes of deficiencies.
✅ III. Evaluation & Conclusion Techniques
Gap Analysis – Identifies deviations from standards or best practices.
Benchmarking – Compares performance or controls with peers or standards.
Compliance Testing – Tests adherence to policies, procedures, or laws.
Substantive Testing – Tests financial transactions or balances in detail.
Analytical Procedures – Identify trends, anomalies, or variances.
Control Effectiveness Evaluation – Determines if controls meet objectives.
Materiality and Risk Rating – Assessing the significance of findings.
📊 IV. Reporting & Communication Tools
Audit Report Templates – Standardized format for clarity and consistency.
Dashboards and Scorecards – Visual tools to summarize audit results or KPIs.
PowerPoint or Infographics – For presenting audit results to stakeholders.
Gantt Charts / Project Plans – Track audit project timelines and resources.
Issue Tracker / Action Plans – Tools to monitor resolution of findings.
Executive Summaries – High-level highlights for senior leadership.
🤝 V. Collaboration & Engagement Techniques
Stakeholder Mapping – Identifying key stakeholders and communication plans.
Workshops / Focus Groups – Engaging multiple stakeholders in assessment.
Collaboration Platforms (e.g., Teams, SharePoint) – For document sharing and team discussions.
Agile Auditing Techniques – Iterative, responsive audit delivery.
Ethical Dilemma Discussions – Used in assessing integrity or compliance risks.
💻 VI. Technology-Enabled Tools
Audit Management Software – e.g., TeamMate, AuditBoard, Galvanize (formerly ACL GRC).
Continuous Monitoring & Auditing Tools – Real-time analytics and alerts.
Robotic Process Automation (RPA) – Automate repetitive testing or data gathering.
Artificial Intelligence / Machine Learning – For anomaly detection or risk prediction.
Document Management Systems – Secure storage of working papers.