GRC software for audit management:
61 providers with AI classification.

Which audit steps does audit management software cover?

Audit management software (in banks also called internal audit software) guides an audit through its cycle: risk-based planning, the audit programme, working papers and evidence, findings, the report and the follow-up of agreed actions. The category also includes tools for external financial statement audits, SOX control testing under the US Sarbanes-Oxley Act, and ISO and quality audits. Ledger and financial statement data are analysed with AI by twelve providers, mostly for external audits, in several cases also for internal audit. For 15 of the 61 providers, the documented headquarters is in the United States, the highest share of any category.

• No specific AI function in the sources checked: 3 entries
• Only announced or in-development functions: 1 entry
• Documented AI use cases by topic, an entry can count more than once: Assessing audit evidence (31) · Drafting audit reports and findings (20) · Audit planning and risk and control matrices (14) · Preparing and running control tests (13) · Natural-language questions on audit files (12)
• Documented headquarters in Europe: 30 of 61 providers, headquarters not separately checked: 6
• Full entries on 2 alphabetical subpages

Questions for the demo, derived from the five criteria of the comparison:

• Does the link between audit finding, evidence and control remain intact when several departments are involved?
• How does a finding become a measure, and how does the evidence of its completion return to the audit?
• Do the access rights protect the independent review when AI drafts reports or assigns evidence?

On what cycle must a bank's internal audit cover each activity?

Within three years as a rule, for every activity including outsourced ones (MaRisk AT 4.4.3 para. 6, Circular 06/2026). Special risks call for a shorter cycle. Activities that are not material from a risk perspective still belong in the plan and must be audited within five years. The previous version set no such upper limit. Where the new version adds requirements, BaFin grants a transition period until 1 January 2027. Internal audit updates its risk-based plan every year, and the management board approves it.

Which DORA rules apply to the internal audit of ICT risk management?

Regular internal audit of the ICT risk management framework in line with the audit plan (Art. 6(6) DORA). Microenterprises are exempt. The auditors need sufficient knowledge, skills and expertise in ICT risk as well as appropriate independence, and the frequency and focus of ICT audits follow the entity's ICT risk. The conclusions lead to a formal follow-up process with rules for the timely verification and remediation of critical ICT audit findings (Art. 6(7)).

What goes into internal audit's quarterly report?

The quarter's audits, the material deficiencies found with the measures to remedy them and their status, all material deficiencies still open from earlier quarters, and an assessment of whether the audit plan is (likely to be) met (MaRisk AT 4.4.3 para. 9). Particularly serious deficiencies are reported immediately. If material deficiencies stay open beyond a reasonable time, the head of internal audit informs the responsible board members in writing, and the full management board by the next quarterly report at the latest if they persist (para. 12).

Which providers of GRC software for audit management are headquartered in Germany, Austria or Switzerland?

Of the 61 providers, 16 have a documented headquarters in Germany, Austria or Switzerland: in Germany Audavis, AuditHeroes, CGS mbH, cluetec, Cortea, ibo Software, IBS Schreiber, LOKIQ, nextAudit, proISMS, PwC Deutschland, QualityReady and zapliance; in Austria Audit Compass and AuditJet; in Switzerland Digital Airways. For six further providers, the headquarters has not been checked separately; they are not included in this list. Headquarters means the seat of the provider entity named in the entry, documented by the entry's location source (imprint, legal texts, official contact and company pages, occasionally official registers); it says nothing about ownership, hosting or data storage.

Regulatory framework.

• MaRisk AT 4.4.3, BaFin Circular 06/2026 (BA): risk-based audit plan, quarterly report, traceable working papers kept for six years and monitoring of remediation (paras. 6 to 12) (Source: BaFin, in German)
• Art. 6(6) and (7) DORA (Regulation (EU) 2022/2554): regular internal audit of the ICT risk management framework by qualified, independent auditors and formal follow-up of critical findings (Source: EUR-Lex)
• Section 25a(1) no. 3 KWG (German Banking Act): internal control procedures with an independent internal audit function that may not be combined with other business areas or control functions (Source: gesetze-im-internet.de, in German)

Further reading on t-nex.de: Ninth MaRisk amendment, DORA for financial entities and GRC software selection criteria.