—IIA 2024 · Technology
Audit management software for the IIA 2024 Standards.
The Standards don't prescribe software — but several of them are hard to evidence without it. This guide sets out what an audit management system needs to support so that conformance falls out of the work instead of being reconstructed for the assessor.
—What the Standards Require
The requirements, in plain terms.
Standard 10.3
Technological Resources
The CAE seeks technology that supports the audit process, evaluates it regularly, trains auditors to use it, and tells the board about technology limitations.
Standard 9.3
Methodologies
The CAE establishes methodologies, keeps them current and trains the team on them — software is where a methodology is actually enforced.
Standard 14.6
Engagement Documentation
Documentation must let an informed, competent person re-perform the work and reach the same results, with review by the supervisor and approval by the CAE.
Standard 15.2
Confirming the Implementation of Recommendations or Action Plans
A methodology for follow-up — progress enquiries, risk-based follow-up and a tracking system — with documented explanations for delays.
—In Practice
What it looks like when it's done well.
The lifecycle is the spine
Software that conforms well follows the Standards' own sequence — risk assessment, plan, engagement, communication, follow-up — so each step inherits the record of the one before it. A generic ticketing or GRC tool bent into an audit shape leaves the links between those steps to people.
Review is captured, not remembered
Supervision and CAE approval (Standards 12.3 and 14.6) need to be visible on the working paper itself. When sign-off lives in email, it has to be rebuilt every time an assessor asks.
Follow-up is a system, not a spreadsheet
Standard 15.2 expects a tracking system for action plans. The test is whether the board can see status, ageing and explanations for delay without someone compiling them by hand.
—Evidence of Conformance
What an assessor will ask to see.
A record of how the technology was evaluated and how auditors were trained on it (10.3)
Documented methodologies that the system's workflow reflects (9.3)
Working papers showing preparer, supervisor review and CAE approval (14.6, 12.3)
An action-plan tracker with status, ageing and documented reasons for delay (15.2)
How ControlVista Supports It
ControlVista audit management software
ControlVista runs the IIA 2024 lifecycle in five modules — plan, fieldwork, findings, reporting and AI drafting — with preparer → reviewer → approver sign-off and remediation tracking built in, on your own infrastructure.
—Further Reading
From our resources.
—IIA 2024 Hub
More on the Standards.
—Frequently Asked
Questions audit leaders ask.
Do the IIA 2024 Standards require audit management software?
No. They require outcomes — documented risk assessment, re-performable documentation, tracked action plans — not a tool. Standard 10.3 does make the CAE responsible for seeking and regularly evaluating technology that supports the audit process.
Can a spreadsheet-based function conform?
It can, but the evidence is harder to produce and keep consistent: review trails, plan changes and action-plan status have to be maintained by hand and reconstructed for the assessor.
Last reviewed October 2026. Standards references paraphrase The IIA's Global Internal Audit Standards (2024); they are not a substitute for the official text.
—Request a demo
See ControlVista run your audit lifecycle, end to end.
A 30-minute walkthrough with the team that built it — from the audit universe to the board-ready committee pack, in English and Arabic.
A product of Vantage Technologies.