{"version":"0.2.0","built_at":"2026-10-10T20:58:14.188Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","capability":{"id":"BC-160","name":"Internal Audit","level":1,"parent_id":null,"l1_id":"BC-160","industry":"cross-industry","macro_id":"MC-10","path":["Internal Audit"],"description":"Give the board independent, evidence-based assurance that risks are managed and controls work, by planning audits where the risk is, doing the fieldwork properly and following findings until they are actually fixed.","aliases":["Internal Audit Function","Third Line","Audit & Assurance","Audit Services"],"in_scope":["The audit universe, risk-based audit plan and audit charter","Audit engagements from scoping through fieldwork, testing and reporting","Findings, management actions and verification that they were completed","Assurance over key controls and coordination with external auditors"],"out_of_scope":["Designing risks and controls in the first place (see BC-130)","Second-line compliance monitoring (see BC-140)","The external financial statement audit itself (see BC-210)"],"csdm_note":"Lands as a Business Capability record realized by audit management applications; audit findings reference the Business Services, Business Applications and controls they were raised against.","status":"active","successor_id":null,"child_ids":["BC-160.10","BC-160.20","BC-160.30","BC-160.40","BC-160.50"]},"crosswalk":{"realized_by":[{"product_id":"PR-100","product":"ServiceNow","pc_id":"PC-100.80","pc":"Governance, Risk and Compliance","maturity":"partial","via":"BC-160.40"}],"used_in":[{"vs_id":"VS-70","vs":"Record-to-Report","stage_id":"VS-70.60","stage":"Assure Controls","order":6,"via":"BC-160.40"}],"patterns":[],"stacks":[],"books":[]},"ancestors":[],"children":[{"id":"BC-160.10","name":"Audit Planning & Universe","level":2,"child_count":3},{"id":"BC-160.20","name":"Audit Execution","level":2,"child_count":4},{"id":"BC-160.30","name":"Findings & Remediation Tracking","level":2,"child_count":4},{"id":"BC-160.40","name":"Control Assurance","level":2,"child_count":3},{"id":"BC-160.50","name":"Audit Quality & Independence","level":2,"child_count":4}]}