"We invested in audit software, but our workpapers are still in spreadsheets and finding tracking is still in email." That sentence sounds familiar to many internal audit and compliance teams. Most of the time, the problem lies not in the software itself but in the workflow it sits in.
Gartner's assessment, published on September 16, 2026, puts numbers on this picture: 84% of audit functions use audit management software, yet satisfaction with the most commonly used capabilities varies considerably. In other words, widespread adoption does not mean the value is being realized. In this article we look at what the data says, what internal audit standards expect of technology, and a practical way to move existing processes from spreadsheets and email to a workflow.
What the data says: same software, different results
Gartner's findings are based on data collected on a rolling basis from 259 audit functions between 2024 and April 15, 2026. The number of software users who answered the capability-level satisfaction questions ranged from 134 to 143. The findings were shared at Gartner's Enterprise Risk, Audit & Compliance Conference.
The press release's most notable finding is that the difference in satisfaction does not stem from product capabilities alone. According to Gartner, audit functions that buy the same platform can end up with very different levels of value. Three factors are decisive: standardizing the methodology, integrating workflows, and reducing dependence on spreadsheets, email and disconnected processes.
The analyst view relayed in the press release points to the same conclusion: purchase decisions are often made on what a platform supports in theory, while the success of an implementation depends on how teams actually work. A feature comparison alone therefore does not show the whole picture.
The structure of the market makes the decision harder, too. Gartner notes that buyers face a complex market that stretches from specialist audit management products to broader governance, risk and compliance (GRC) platforms and enterprise software ecosystems. Its recommendation is clear: first identify the audit workflows that need improving, then, before evaluating vendors, build consensus among audit, the other assurance functions and information technology (IT).
What do the standards expect of technology?
The Institute of Internal Auditors (IIA) Global Internal Audit Standards (published January 9, 2024), the international reference framework for internal auditors, treat technology in a standard of its own. Under Standard 10.3, the chief audit executive must strive to ensure that the function has technology that supports the audit process, and must evaluate the technology in use on a regular basis. Providing auditors with appropriate training when new technology is introduced and collaborating with the organization's IT and information security functions are also among the requirements. The impact of technology shortfalls on the function's effectiveness, in turn, must be reported to the board and senior management.
The standard's implementation considerations list audit management systems, process mapping applications, data analytics tools, and communication and collaboration tools as examples of technology. The same section says that plans for introducing new technology should include auditor training and a demonstration of the benefits achieved to management, and it also recommends addressing the information security and personal data privacy risks that arise from technology use.
This framework matches Gartner's finding: acquiring the software is only the beginning; evaluation, training, collaboration with IT and demonstrating the benefit are the real work.
From spreadsheets and email to workflow: a practical path
The steps below are a general framework derived from the findings in the sources; each organization should adapt it to its own audit methodology, organizational structure and regulatory obligations.
- Map the current flow. From risk assessment to the annual plan, and from fieldwork to finding tracking, record at every step which information sits in which spreadsheet, which email chain or which folder. Without seeing "how teams actually work", there is no way to know what the software will change.
- Standardize the methodology on paper first. If the risk rating scale, workpaper template, finding write-up format and approval steps differ from team to team, unify them before moving them into the software. Otherwise the differences are simply carried over to a new screen.
- Prioritize the workflows to improve. Start with the workflows that require the most manual follow-up, generate the most reminder emails or take the most time during the reporting period. Finding and action tracking is a good candidate in most organizations.
- Align stakeholders before approaching vendors. Audit, other assurance functions such as compliance and risk management, and IT should collect their needs in one shared list from the start. This is the order Gartner recommends: consensus first, vendor evaluation second.
- Place automation in the repetitive steps. Rule-based, repetitive tasks are good candidates for robotic process automation (RPA) or the platform's own workflow engine: pulling evidence and reports from systems, sending deadline reminders to action owners, compiling status summaries. Judgment-based evaluation and the writing of conclusions should stay with the auditor. For the general framework of RPA, see our article on AI-powered RPA.
- Involve IT and information security from the very start. Access permissions, system integrations, the storage of evidence containing personal data and record-keeping rules should be settled before go-live. Standard 10.3 explicitly expects this collaboration.
- Plan the training and the transition. Spreadsheets running in parallel are the most visible sign that the software has not been adopted. Set a clear transition rule, such as conducting all new audits only in the software after a certain date, and give the team hands-on training.
- Measure and report the benefit. Track indicators that can be measured inside the organization, such as the time taken to issue a report, the age of open findings and the number of manual reminders, before and after the transition. This measurement is what makes the "demonstration of benefits" the standard expects possible.
Conclusion
Audit management software is now in place at the large majority of audit functions; what makes the difference is the workflow around it. Gartner's data shows that the same platform can deliver different results, and the IIA standards show that technology needs to be backed by regular evaluation, training and collaboration with IT. So before starting a search for new software, mapping existing processes and standardizing the methodology is, for most organizations, a more productive first step.
From Orient Global's perspective, the path to value runs not through a feature list but through redesigning and measuring a single workflow end to end.
Why logistics experience matters here. Audit follow-up and warehouse control run on the same loop: define what should be there, check it against the record, log the exceptions, name an owner and keep proof that each one was closed. Logistics has relied on that loop for decades, through cycle counts, goods-receipt checks and proof of delivery, so the eight steps above will look familiar to anyone who has run a warehouse or distribution network: map the flow before changing it, settle the standard before digitizing it, start with the queues that consume the most manual chasing, set a firm cut-over date so old and new methods do not run side by side, and judge the result by a handful of measured indicators taken before and after. One of Orient Global's consultants brings more than 30 years in operations, logistics and supply chain: at a technology distribution company of roughly one billion dollars in scale, he ran logistics, warehousing, technical service and administrative operations end to end, building and leading teams of 100+ people and delivering lasting gains in operational performance through KPI-driven programs. He has also managed nationwide warehouse and transport operations across leading retail, logistics and distribution organizations. An industrial engineer, he now brings that supply-chain discipline to SMEs through AI and automation. Meet our consultants.
#interimmanagement #forwarddeployedengineering