If you are a small audit shop (5-10 professionals), what audit documentation tools do you use? I am trying to find a tool that would save time in documentation but would not be costly.

4.3k viewscircle icon2 Upvotescircle icon4 Comments
Sort by:
Information Security Manager9 months ago

CISO assistant has an open source version and supports audits against many different frameworks

Senior Manager Internal Audit in Travel and Hospitality9 months ago

For a small audit shop of 5-10 professionals, an Excel-based system works perfectly fine if structured well. It’s cost-effective, easy to customize, and flexible enough to handle risk matrices, audit programs, and findings trackers. Pairing it with SharePoint or Teams can add collaboration and version control, making it even more efficient. If you’re looking for something slightly more advanced without breaking the bank, tools like AuditBoard and ZenGRC might be worth exploring. In my opinion, the key is to keep it simple, ensure consistency with templates, and choose something that fits your team's needs without overcomplicating things. 

Lightbulb on1
Finance Manager in Healthcare and Biotech10 months ago

We use Audimex, and I also know IboQSR from the past. Both are German vendors.

Lightbulb on1
Internal Audit Specialist in Energy and Utilities10 months ago

there is lots of competition for software that automates working papers (e.g., AutoAudit, TeamMate).  Go price them.  Some smaller software vendors probably aren't keeping up with enhancing their tools to become new Governance/Risk/ Control software that combines enterprise risk management, first line of defense, and audit working papers (and more). These lagging software companies probably lowered their prices to keep business.  When you price out the software vendors, also check out how easy it is for you to run reports.  Some software almost needs an IT specialist to run reports, while others are more intuitive for casual users.

Lightbulb on1

Content you might like

AI-driven threats (deepfakes, automated attacks) 19%

Software supply chain risks 19%

Insider risk (both malicious & accidental) 10%

Regulatory compliance 9%

Cloud misconfigurations 11%

Shadow IT (or shadow AI) 11%

Ransomware 7%

Talent shortage in cybersecurity10%

Something else (comment to explain)4%

View Results

Network Detection and Response (NDR)21%

Endpoint Detection and Response (EDR)47%

Extended Detection and Response (xDR = NDR / EDR / CDR)62%

Intrusion Detection & Prevention Systems (TLS Decrypting) IDPS34%

Deception Technology (External Only)10%

Deception Technology (Internal Only)16%

Deception Technology (External & Internal)8%

View Results