A method and system for documenting processes and controls of an organization involve storing information describing the processes of the organization in a database and then accessing the database with a suitable user interface application. Preferably the user interface application is a web browser and the data in the database is provided to users as a series of web pages. Using the user interface application, users can review the documented processes, report errors, request changes, generate reports, and so forth. Users with suitable access privileges can modify the data in the database using the user interface application. An external auditor can audit the processes and controls of the organization from his own office by accessing the database over a network such as the Internet.