Articles for internal audit
Articles on NIS2, DORA and MaRisk with legal references and sources. Each article states its date.
All articles
-
As of 4 November 2026
How to write an IT audit program: six steps to a reliable audit.
A good audit program decides what is tested, against what, and which evidence is enough before the first document arrives. Here is how to proceed, with an example of an audit step.
Read article: How to write an IT audit program: six steps to a reliable audit.
-
As of 14 October 2026
What NIS2 and DORA mean for internal audit planning in 2027.
BAIT is ending, DORA and the new German BSI Act bring their own structure. What follows for the audit universe, the audit cycle and follow-up.
Read article: What NIS2 and DORA mean for internal audit planning in 2027.
-
As of 14 October 2026
Tracking audit findings: what DORA, MaRisk and the IIA Standards require.
A finding is closed only when implementation is confirmed. Three frameworks describe how internal audit shows this, and the new German MaRisk sets a faster pace.
Read article: Tracking audit findings: what DORA, MaRisk and the IIA Standards require.
-
As of 22 October 2026
MaRisk 2026 for small institutions: what changes for internal audit.
The ninth amendment of the German MaRisk is more principles-based and defines size classes for the first time. For internal audit in small institutions it brings relief, but also tighter conditions.
Read article: MaRisk 2026 for small institutions: what changes for internal audit.