Quality management and code of conduct for IT audit units under RKBN 2025.
From a static checklist to a risk-driven quality management system under RKBN 2025, complemented by the NOREA code of conduct (Code of Ethics, B1). For IT audit units and REs. Reviews started on 1 July 2026. With AI built in, built and hosted in the EU.
The challenge
The RKBN 2025 transition needs more than a checklist
With RKBN 2025 (NOREA), quality control shifts from a static checklist to a risk-driven quality management system based on ISQM 1 and 2. Quality reviews started on 1 July 2026. Existing tools fall short.
A new paradigm
ISQM thinks in objectives, risks and controls, not tick-box lists. That shift is conceptually challenging and calls for a different way of recording than most IT audit units are used to.
RKBN 2025 is extensive
RKBN 2025 contains hundreds of requirements, spread across eight quality components. Tracking these manually in separate documents is error-prone and time-consuming.
Documents aren't a quality system
Word, Excel and shared folders create an unmanageable patchwork: versions get lost, evidence isn't traceable and the link between risk and control disappears.
Residual risk stays invisible
Having a control isn't the same as covering a risk. Without structured weighting, it stays unclear what the residual risk is, exactly the question ISQM puts centre stage.
The review has begun
Quality reviews under the RKBN started on 1 July 2026. Preparing without the right structure is a manual, document-heavy process that costs time and capacity.
Quality is ongoing, not a snapshot
ISQM requires continuous monitoring, remediation and an annual evaluation. A one-off self-assessment per cycle isn't enough, a living system is needed.
Standards frameworks
Two frameworks for IT audit units
NOREA AQUA covers the quality and conduct frameworks relevant to IT audit units and REs, each with the right scoring methodology.
NOREA, RKBN 2025
The quality management system for IT audit units and REs, based on ISQM 1 (the quality management system, divided into eight components) and ISQM 2 (engagement-level quality reviews). Risk-driven, with the model QMS as a starting point. Reviews started on 1 July 2026.
NOREA, Code of Ethics (B1)
The NOREA code of conduct as a scorable framework: the five fundamental principles, the conceptual framework and independence, assessed with the same scoring lenses as the quality system.
What NOREA AQUA offers
One platform for RKBN 2025 and the NOREA code of conduct
NOREA AQUA models the ISQM paradigm for RKBN 2025 and the Code of Ethics, with AI built into the design. An organisation covered by multiple frameworks doesn't fill in the same thing twice.
AI built in, not bolted on
AI helps formulate quality risks and appropriate controls based on RKBN 2025. Always as a suggestion, the reviewer decides.
Data sovereignty, built in the EU
Built and hosted in the European Union. Data is stored encrypted per organisation and strictly isolated. No US cloud, your data stays yours.
No costly implementation or licences
No tens-of-thousands-euro implementation project, no sky-high annual licence fees. Accessible to teams and units of any size.
Built from IT audit practice
Designed from the practice of quality review under NOREA standards. The official standards texts are the basis, with a visible verification status per section.
Framework selector
Choose the framework per file: NOREA-RKBN 2025 or the NOREA code of conduct (Code of Ethics, B1). Both frameworks run on the same scoring lenses.
ISQM engine and code of conduct engine
An ISQM engine (RKBN 2025: eight components mapped to objectives, risks, controls and monitoring) alongside a code of conduct engine for the Code of Ethics (B1), the five fundamental principles.
Three scoring lenses
Per control, switchable: Design/Existence/Operating effectiveness, Maturity 1 to 5, and Risk (likelihood times impact) weighted against control adequacy, down to residual risk.
Anchored in the official source
RKBN 2025 and the NOREA Code of Ethics are verified against the official NOREA source. No paraphrasing, with a visible verification status per section.
How it works
From framework to assessment file in five steps
NOREA AQUA guides you step by step, from setting up your RKBN 2025 quality management system to the file for self-assessment or external review, and assessment of your code of conduct compliance.
Choose your framework
Start a file for NOREA-RKBN 2025 or the NOREA code of conduct (Code of Ethics). RKBN 2025 follows the ISQM paradigm; the Code of Ethics assesses the five fundamental principles and the conceptual framework per auditor or unit.
Build out the eight quality components (RKBN 2025)
Record your quality objectives, the related quality risks and the controls for each component. The dashboard shows the eight ISQM components and their progress at a glance. You don't start from scratch: the model QMS gives you a curated library of starter controls that pre-populates your assessment.
Assess with the three lenses
Weight each control via Design/Existence/Operating effectiveness, a maturity level and risk adequacy. The platform calculates the residual risk and rolls it up to a component and overall rating.
Substantiate with surveys and interviews
Surveys poll leadership, management and staff; for an external review, the reviewer records observations and an impression per interview topic, linked to the ISQM objectives, in the same file.
Compile the file
One file, two perspectives: a self-assessment for your own unit, or a review file with self-assessment and review findings side by side, aligned with the external quality review. Link assessments under RKBN and Code of Ethics in one combined file. With one click, also generate the quality manual as a Word document for the review file.
The quality cycle
The ISQM paradigm, from objective to monitoring
NOREA AQUA supports the full ISQM cycle, keeping it alive with ongoing monitoring and an annual evaluation, exactly as RKBN 2025 requires.
Quality objectives
For each component, the unit records which quality objectives apply, the starting point of the system.
Quality risks
Which risks threaten those objectives? Likelihood and impact are made explicit.
Controls
The controls per risk, assessed on design, existence, operating effectiveness and adequacy → residual risk.
Monitoring & evaluation
Ongoing monitoring, remediation of deficiencies and an annual evaluation close the cycle.
External quality review
Ready for the reviewer, without folders full of evidence
RKBN 2025 and the NOREA Quality Review Regulations (RKON) require a periodic quality review of the quality management system. Reviews started on 1 July 2026. NOREA AQUA makes your file review-ready and lets the external reviewer work alongside you in the same environment, no documents emailed back and forth.
Reviewer without an account: the external assessor works via a secure link within the review file, without their own licence or installation.
Review findings alongside self-assessment: the reviewer's rating sits per component next to your own assessment, for direct comparison.
Structured interviews: question sets from leadership and management to the quality or compliance officer, with outcomes recorded in the file.
Combined file: RKBN 2025 and Code of Ethics in the same review file, so overlapping evidence is only recorded once.
Built and hosted in the EU: every unit works in its own segregated environment, with a full audit trail.
Review at a glance
Ready for RKBN 2025?
Request a demo or get in touch for more information about NOREA AQUA for your IT audit unit. An audit firm? Take a look at NBA AQUA instead.