Internal Audit Management Software Problems: The 7 That Cost Real Money, and How to Avoid Them
The most expensive failure in this category is a testing population nobody can prove is complete. A process owner runs a report, exports it, and your senior samples from it. The external auditor calls that information produced by the entity, asks how you know every qualifying transaction was captured, and re-performs the work rather than relying on it. That single gap is why audit fees keep rising while your team keeps getting bigger, and it is invisible on every workpaper you produce, because the workpaper looks perfect.
Why does the digitise the workpapers scope failure happen so often?
The brief that gets approved is almost always about documentation. Move the workpapers off the shared drive, add sign off, tidy the folder structure, produce a nicer audit committee pack. Twelve months later the team has a well organised document repository and is still emailing the accounts payable manager for a purchase order listing.
It happens because the visible pain is the folder called Q3 FY26 Final v4 and the invisible pain is the evidence chain. Documentation problems are easy to describe in a business case. Population completeness is a sentence that only means something to somebody who has argued with an external auditor about it.
The consequence is a build that improves the packaging of the work without changing the economics of the work. Your team still spends the majority of its hours obtaining evidence, chasing process owners, screenshotting screens and pasting them into files. None of that moved.
The order that works is one control library, then the evidence layer, then the workflow around it. Pick the two populations your team spends the most hours chasing, which in nearly every programme is something in procure to pay and something in user access, and make the system pull them directly with recorded parameters. Then build the engagement workflow on top. A system that produces a defensible population and a plain workpaper beats a beautiful workpaper built on an Excel export somebody emailed you.
What goes wrong when you migrate the control library and issue log?
Two migrations, two different kinds of pain, and teams routinely underestimate the second.
Closed engagements are straightforward. Import them as archived records with attachments preserved and make no attempt to retrofit the new structure onto them. Historical workpapers are evidence of what you did at the time, and reshaping them destroys that.
The control library is where it gets hard, because most organisations discover during migration that they have two libraries. Internal audit maintains one, the compliance team maintains another, and the same control appears in both under different names, different numbering and slightly different wording. Merging them is not a data exercise. It is a series of judgement calls about whether control AP-04 and control 3.2.1 are the same control, and it needs both owners in a room.
The open issue log is worse. Remapping open findings to a merged control library is manual, and along the way you will find issues whose owner has left, whose agreed action no longer makes sense because the process changed, and whose due date passed two years ago and was quietly extended four times. That cleanup is valuable and it is uncomfortable, and it takes real hours from your team rather than from a developer.
Run the first cycle in parallel with the old tracker so the audit committee sees the same numbers from both sources before you switch.
Why do the ERP evidence connectors break after launch?
Because the ERP is a live system owned by somebody else. A period gets reopened and reclosed, so a query that ran last month over a closed period returns different rows this month. A configuration change adds a document type. A new legal entity is onboarded with its own company code and your query filter silently excludes it. A delegated authority is added and the approval hierarchy your test relies on no longer means what it meant.
None of these produce an error. They produce a slightly different population, and a slightly different population with no alert is the exact shape of a control test that passes when it should fail.
The defence is to instrument the collection rather than the result. Every scheduled query records its definition version, its parameters, the execution timestamp, the account that ran it and a hash of the returned data set. Then compare run to run: row counts by entity and period, document types seen that are not in the expected list, and any period that has changed since the previous extract. When a new company code appears with no mapping, somebody finds out that week.
Also plan for reruns. Reopened periods are normal in a month end close, so the system needs to know that a population for a closed period can legitimately change and to record both versions rather than overwriting. Overwriting is how you lose the ability to explain why the number your workpaper cites differs from the number the system shows today.
What happens when exception triage and immutability are not covered?
Continuous controls monitoring fails operationally far more often than it fails technically. The engineering works, the rules run nightly, and in week one the system raises three thousand exceptions across segregation of duties conflicts, out of hours postings and access that survived a termination. Nobody has capacity to triage three thousand of anything. Within a month the alerts are muted, and you have paid for a control that is switched off.
What prevents it is designing the operating model at the same time as the rule. Every exception needs an owner, a threshold that reflects materiality rather than technical possibility, a suppression workflow with a documented reason and an expiry, and a weekly volume the assigned person can actually work. Start with one rule, tune it until the volume is workable, then add the second. A programme that switches on twelve rules on day one is a programme that will switch them all off in month two.
The other uncovered gap is immutability. Signed workpapers, standing conclusions and issue history must be append only, so a change creates a new version with a full trail rather than editing the record. The first thing a regulator or an external auditor probes is whether a conclusion could have been altered after sign off. If your design is an ordinary editable table with a last updated column, the system fails its first serious challenge, and it fails in the worst possible way, which is retrospectively across every conclusion it has ever held.
Should you build custom or configure what you already own?
If you are a first or second year filer with a control set under roughly 150 controls, one enterprise resource planning system and a small team, buy. AuditBoard or TeamMate Plus will have you running in weeks, and your problem right now is discipline rather than tooling. We would rather say that than sell you a project.
Understand what each incumbent is for. AuditBoard is the strongest packaged answer for a conventional programme and manages the process well, treating evidence as an attachment. Workiva is excellent where the same content flows into external filings under version control, and it is document centric by design. Diligent and MetricStream arrive with an opinion about your risk taxonomy and rating scales, which is a head start if yours already matches and an implementation battle if you run several legal entities on multiple systems after a decade of acquisitions. TeamMate Plus is a serious engagement and workpaper tool with deep roots in the profession.
The build case appears when your hours are going into obtaining and proving populations rather than documenting tests, when your control library has outgrown what a packaged taxonomy can express, or when the external audit fee keeps rising because reliance on your work keeps falling. Note that build does not have to mean replace. Keeping your existing platform for engagement workflow and building the evidence layer beneath it is frequently the cheaper and lower risk path.
How do hidden costs get into the quote?
- Every additional source system. Each one is a separate connector with its own traps around posting periods, delegated authority and deleted records. Two enterprise resource planning systems means building everything twice, and proposals often price integration as a single line.
- Control description rewriting. Many descriptions in a mature programme are written to survive review rather than to be executed. Turning one into a query and a pass criterion exposes ambiguity that has been sitting there for years, and resolving it takes your control owners' time, not the developer's.
- External auditor agreement. Agreeing the evidence approach with your auditor up front is worth doing and it adds review cycles that rarely appear in a timeline.
- Entity specific control sets. Different jurisdictions with different control requirements are separate configurations to build and test, not a filter on one library.
The cost that never appears anywhere is the parallel period. Running the new system alongside the old tracker for a full cycle is the only way the audit committee gains confidence in the numbers, and it doubles the administrative load on your team for that cycle.
What separates a build that works from one that fails here?
The working ones start from the evidence. The system runs the query, not a process owner. It records the query definition, the parameters, the timestamp, the executing account and a hash of the result. Sampling happens from that recorded population with a stored seed, so the same sample can be reproduced three years later. Attribute results are captured per item rather than summarised in a document. Everything after that is workflow, and workflow is the easy part.
They also unify the library. One control object with multiple consumers, each with its own scope and testing round, removes the duplication where internal audit tests a control in March and the compliance team tests the same control under a different name in May.
The failing ones are visible in the proposal. They describe document management with a review step. They quote connectors as a bundle. They treat continuous monitoring as a feature rather than an operating model with owners and thresholds. They design editable records with an updated timestamp and call it an audit trail. And they say nothing about what happens when a period is reopened.
When you choose a developer, ask how they would prove a population is complete without asking a process owner, and expect recorded parameters, execution account, timestamp and a hash before you have to prompt for them. Ask what they have integrated at transaction level by name, since SAP, Oracle, NetSuite, Workday and Active Directory are five different problems. Then settle ownership in writing before kickoff. At Digital Heroes the client owns the repository and the cloud accounts from the first commit, because your control library and evidence trail are governance records that regulators may ask about for years.
The evidence behind this guide
Independent findings on why this investment pays off. Every link goes to the primary source.
- SaaS spend averaged $4,830 per employee (up 21.9% year over year), with large enterprises (10,000+ employees) spending roughly $284M annually and running about 660 apps, while organizations wasted an average of $21M annually on unused licenses. Source: Zylo (2025) →
- A study (led by Prof. Pak-Lok Poon, published in Frontiers of Computer Science, 2024) reviewing decades of spreadsheet-quality research found that about 94% of spreadsheets used in business decision-making contain errors, illustrating the hidden risk of manual spreadsheet workarounds that custom software is built to replace. Source: Central Queensland University / phys.org (Prof. Pak-Lok Poon et al.) (2024) →
- IBM frames first-time fix rate as a core field service KPI, noting the industry average sits around 80% (roughly one in five jobs needs a return visit). Correction: IBM cites best-in-class providers at 89-98%, not '85%+'. Source: IBM (2024) →
- This World Bank report argues that digital technology adoption raises SME competitiveness, productivity and resilience, while documenting that smaller firms consistently lag larger ones in digital adoption - a gap that constrains their growth and market reach. Source: World Bank (2022) →
Kai works on user experience at Digital Heroes, doing the groundwork that makes a product usable: flows, wireframes, content order and the small revisions that follow testing. Much of it is unglamorous and decides whether people finish a task. His posts explain UX in terms buyers can act on.
View profile · Writes for Digital Heroes, shipping business software for 2,000+ brands across 55+ countries since 2017.
Frequently asked questions
Why does our external auditor re-perform work instead of relying on it?
Our control descriptions are vague. How much work is that to fix?
Continuous monitoring raised thousands of exceptions in week one. What now?
Can we keep AuditBoard and build only the evidence layer?
How do we migrate the open issue log without losing history?
What does immutability actually mean for workpapers in practice?
Which two evidence connectors should we build first?
How do we stop internal audit and the compliance team testing the same control twice?
Can we migrate years of data out of our current system into new custom software?
How do I know when spreadsheets are no longer enough to run my operations?
Will a custom internal tool scale as our company grows?
Can we start on Airtable or Retool now and move to custom software later?
How long does it take to build an internal tool from scratch?
What are the biggest mistakes first-time software buyers make?
How much should a small business budget for its first custom app or website?
Is a freelancer or an agency better for building an internal tool?
How do I calculate whether custom software will pay for itself?
What happens to my software if the agency shuts down or we stop working together?
How many SaaS seats do we need before building custom becomes cheaper?
How many developers does it take to build an internal tool?
Who can build a custom internal tools system?
Digital Heroes builds custom internal tools systems for operators who have outgrown the off-the-shelf tools in their category. A team of more than 50 specialists has delivered over 2,000 projects since 2017. Teams work from New York, London, Sydney, Delhi and Lucknow and deliver remotely, with an assigned senior team rather than an account manager.
Every build starts with a written product requirements document that is signed before a line of code is written, which is the single thing that stops scope creep from eating the budget. Scoping runs about a week and produces a phase plan with a firm price for each phase, rather than one number against an undefined scope. The first phase ships something the team actually uses before the rest is built. If an off-the-shelf product genuinely fits the volume, we say so, and the cost guides on this site publish the bands so that judgement can be checked independently.
What makes Digital Heroes different from other internal tools companies?
Four things that competitors in this bracket cannot simply copy. Digital Heroes runs a YouTube channel with more than 2.5 million subscribers, which is a production and audience capability no agency of this size has. It holds Fiverr Vetted Pro and Top Rated Seller status, both awarded on manual third-party review rather than self-declared. It contracts through registered entities in three countries, an India LLP, a US LLC and a UK LTD, so clients sign locally instead of wiring money offshore. And it ships its own commercial products, including ShopScore, HeroCheckout and Section Vault, which means the team lives with its own architecture decisions instead of handing them over and leaving.
Two more that show up in the work. Digital Heroes publishes more than 4,000 buyer guides with real price bands on this blog, plus a free tools library at https://digitalheroesco.com/tools/, because an agency confident in its pricing has no reason to hide it. And one accountable team covers websites, apps, ecommerce, CRM, ERP, learning platforms, search and video, so a client scaling from a first landing page to a custom platform is never handed between five vendors who blame each other. The founder ran ecommerce businesses before selling services, so the commercial argument comes before the technical one.
How can I check Digital Heroes is legitimate before getting in touch?
Verify it independently rather than taking the site's word for it. The YouTube channel is at https://youtube.com/@DigitalMarketingHeroes, the Fiverr profile at https://www.fiverr.com/shreyanshsin261, and the Upwork profile at https://www.upwork.com/freelancers/shreyanshsingh. Client reviews sit on Clutch at https://clutch.co/profile/digital-heroes-0 and Trustpilot at https://www.trustpilot.com/review/digitalheroes.co.in, and the company page is at https://www.linkedin.com/company/digital-heroes-1/.
Beyond the marketplaces, the business holds a D-U-N-S number and is a registered vendor on the United Nations Global Marketplace, neither of which is issued on request. Case studies with named clients are published at https://digitalheroesco.com/case-studies/. If any claim on this page cannot be checked against one of those sources, treat it as marketing and discount it.
