For audit functions of a handful of people
The methodology, the quality control and the evidence that large departments have people and GRC suites for. For the chief audit executive who signs for conformance, and for the risk manager and compliance officer who face the same with their frameworks. Switched on today, without a months-long implementation project.
Choose your entry point
The same suite, three entry points. Pick one and see what the software does for that work.
The whole cycle in one place: which topics exist, which you cover this year, and whether the findings actually get resolved.
From workshop to heat map to treatment plan, linked to the controls and audits that actually address them.
Frameworks that overlap, with shared controls underneath, so you do not start over for every standard.
Software covers the routine. An external quality assessment, a demanding QAIP review or standing up an audit function calls for experience, our auditors and risk professionals deliver that themselves, in the same environment your team works in.
Most organisations keep risks, frameworks, audit plans and findings in separate tools: a risk register in Excel, a framework in its own document, an action list stuck somewhere in email. Audirium brings that together. Everything you record is linked directly to the rest, so you never have to reconstruct the connections yourself. A concrete example. Your risk manager flags an elevated risk of unauthorised access to a critical system in Risk Heat Map. That risk is already linked to the corresponding control in CRAFT, such as an access-management control from ISO 27001 or the Dutch BIO baseline. When your auditor then plans an engagement, the controls to test are already lined up, including the underlying legal articles. If a control turns out to be ineffective, the finding automatically becomes a follow-up action in Action Tracking with an owner and a deadline, and the outcome feeds back into the risk assessment at the top. The CRAFT standards library covers 38 frameworks with 1,691 controls and holds 212 direct links between legal articles and controls. That interplay is called combined assurance: risk management, compliance and audit that build on the same information instead of reporting on the same subject three times over. Every Audirium app, from CRAFT to GRIP and from AQUA to Action Tracking, grew out of real audit engagements and uses that same shared foundation. And for questions software alone cannot answer, such as an external quality assessment (EQA) or a difficult quality review, experienced auditors and risk professionals join in person.
Record it once and it stays current everywhere: risk, standard, testing and follow-up keep each other up to date.
Audirium is accredited by IIA Netherlands to assess your audit function against the Global Internal Audit Standards (GIAS 2025). Required every five years, recommended in the Dutch Corporate Governance Code. Faster and more thorough thanks to AI-enabled tooling: automated scoring, AI gap analysis and document assessment significantly reduce lead time. From baseline and Topical Requirements to the official EQA.
Articles on governance, risk management and internal audit from practice.
Fill in your organisation details and export a fully GIAS-compliant Internal Audit Charter. Includes governance model selection, live input fields and a GIAS cross-reference table.
A fully operational audit manual as a fill-in template. GIAS-compliant, covering strategy through follow-up, with phase-specific checklists and a GIAS cross-reference table.
Many organisations claim to have strategic risk management in place. In practice, that often means someone spent a great deal of time producing a polished PowerPoint presentation.
Everyone in audit talks about Agile. Few actually do anything with it. Five lessons from those who did.
"I'm busy" is the Swiss Army knife of organisations. You can use it for anything: postponing, cutting conversations short, staying polite. But is it actually honest?
The new Global Internal Audit Standards were not designed for small audit functions. Yet they still have to comply. How do you do that with one to five people?
Integrating risk management and audit sounds logical. But anyone who fails to think through the implications is quietly eroding the independence of assurance.
The interview is to audit what "busy" is to the rest of the organisation: everyone does it, no one questions it; and when you ask why, the answer doesn't hold up.
As an auditor, do you give advice; or stick to the facts? There are good reasons for both, and less good ones. An honest overview.
Only 31% of all projects are completed successfully. Internal Audit can improve that figure, provided it has a seat at the table early enough.
We take on your audit and risk challenges. And if we are not the best solution, we will tell you honestly.
Book a callI am happy to discuss what fits your situation: software, expertise or both.
Risk analysis, standards management, audit planning and follow-up: over fifteen apps sharing the same data.
No implementation project
Large GRC platforms are built for departments with a programme team alongside them: months of configuration, a price tag to match, and a way of working the package prescribes. For a function of one to five people that is the wrong size. Here the order is reversed.
Getting started
An implementation project running for months: configuration workshops, a consultant, a test environment and an acceptance phase before the first finding is even recorded.
Create an account, pick your framework, start your first file today. What needs setting up, you set up yourself: in an afternoon, without outside help.
Who adapts to whom
The package prescribes how you work. Your methodology, your templates and your terminology get bent to fit what the software allows.
Your framework, your templates, your steps. The software follows your way of working, and where it pinches we change it.
What it costs
Per-user licences, an implementation fee up front and a surcharge per module. A department's budget, even when there are three of you. Someone who uses the tool once a year needs a licence too.
One price per organisation, from € 195 a month. No implementation fee, and the price does not grow with the number of colleagues looking over your shoulder. Licences only for regular users. Auditees, board members and action owners can of course work with the tool occasionally without a licence.
When something is missing
A request becomes a change request, lands on a release calendar you have no say in, and usually carries a price of its own.
You talk to the people who build it. A missing field or a report of your own is usually a matter of days.
The left-hand column describes no vendor in particular. It is the pattern that keeps coming back in this segment. Rather see for yourself? The Diagnose tier is free: switch an app on and work in it the same day.
Pricing
Software for an audit function of a handful of people should not charge as if you were a department. You pay per organisation, and the price does not grow with the number of colleagues looking over your shoulder.
The NIS2 quick scan, the coverage check and the standards library, plus the free Academy courses. No account required.
One core app of your choice, up to five users and support by email, chat, chatbot and AI assistance.
Every app, a licence for every regular user (not the occasional ones). Everything else is tailor-made at a reasonable cost. No implementation team: a few sessions and you and your team are up and running.
Amounts are per organisation, excluding VAT. No implementation fee, no set-up costs. One-off purchases are possible too: a NIS2 report costs € 249.
All prices and termsAudirium is a Dutch software platform for internal audit, risk management and compliance: combined assurance software in which risks, frameworks, audit plans and findings stay connected, including AQUA, GRIP and Risk Heat Map. It is built for functions of one to five people and works without an implementation project. In addition, Audirium's senior auditors and risk professionals step into delivery themselves, from setting up an audit function to external quality assessment, and Audirium publishes professionally.
Yes. Alongside the platform, Audirium's senior auditors and risk professionals step in proportionally: part of the time, exactly when needed, instead of a full-time hire or an expensive consultancy engagement. They sit in delivery themselves, scalable up and down, and work in the same tooling your own function uses.
Primarily organisations with a small or newly established internal audit function, or those that temporarily need senior capacity: during a transformation, a vacancy, a quality assessment or a workload peak. An audit function of one to five people is a typical size.
No junior layers and no handovers: the senior you speak to also does the work. Engagement scales up and down without fixed overhead, and in-house tooling and AI are included. You get senior-level expertise at a fraction of the cost of a traditional firm.
There is no implementation project. You switch on an app, pick your framework and record your first file the same day. Where a large GRC package asks for months of configuration workshops, consultants, test environments and acceptance phases, here you set up what needs setting up yourself: an afternoon's work, without outside help.
A large GRC suite is built for departments with a programme team alongside them: per-user licences, an implementation fee up front, a surcharge per module and a way of working the package prescribes. Audirium is built for audit, risk and compliance functions of one to five people: one price per organisation from 195 euro a month, no implementation fee, and your own framework, templates and way of working stay leading. If something is missing you talk to the people who build it, which is usually a matter of days rather than a change request on a release calendar.
Audirium builds its own software for the full audit and risk cycle: AQUA (quality assessment for internal audit, accountants and IT auditors; QAIP/self-assessment and EQA preparation), GRIP (compliance and accountability for municipalities: ENSIA, privacy and lawfulness), Risk Heat Map, In Control, Risk Voter, CGC Assessor and more.
An EQA is a mandatory, independent assessment of an internal audit function against the IIA's Global Internal Audit Standards, at least once every five years. Audirium supports both the preparation (via AQUA) and the assessment itself, including the lighter SAIV variant: a self-assessment with independent validation.
In the European Union. The platform, the databases and the backups all run on European infrastructure, and the AI assistance goes through an EU gateway.
Every organisation gets its own database file rather than a shared table with a tenant column. The application resolves that file from the session, not from anything in the request, so access across organisations is refused at the data layer and not only in the interface.
No. The suite uses AI for scoring, summarising and drafting, but your data is never used to train models and never leaves the European Union.