Working notes on modern internal auditing: agent-native assurance, SOX testing, control frameworks and the vendor landscape.https://modernauditing.com/enhttps://modernauditing.com/notes/904-controls-280-obligations/https://modernauditing.com/notes/904-controls-280-obligations/We mapped 22 frameworks control by control. They collapse into 280 unified controls — a 3.2-to-1 reduction. That ratio is the whole argument for how compliance programmes should be structured, and most of them are structured the other way.Wed, 29 Jul 2026 00:00:00 GMTframeworkscontrolscomplianceRich Penfilhttps://modernauditing.com/notes/agent-native-or-agent-added/https://modernauditing.com/notes/agent-native-or-agent-added/Every incumbent now has an AI assistant in the corner of the screen. Almost none of them can let an agent complete a control test, because their data model stores documents for humans rather than work for machines. Here is the test that separates the two.Fri, 24 Jul 2026 00:00:00 GMTagentsvendorsagent-nativeRich Penfilhttps://modernauditing.com/notes/the-sample-of-25/https://modernauditing.com/notes/the-sample-of-25/Conventional sample sizes are a customary quantity of work, not a statistical conclusion. That was a reasonable trade when opening 25 files took a day. It is now a choice to test less than you could — and it is increasingly a choice you will be asked to defend.Fri, 17 Jul 2026 00:00:00 GMTtestingsamplingpracticeRich Penfil