Artificial Intelligence for Internal Auditing Training Course

Participants can define an appropriate assurance role for internal audit without assuming management responsibilities.

• IIA Global Internal Audit Standards applied to AI assurance mandates
• Assurance, advisory and implementation responsibilities separated using independence safeguards
• Three Lines Model roles assigned for AI ownership and oversight
• Audit charters updated for emerging technology and algorithmic decision risks
• Engagement objectives linked to business outcomes, risks and controls
• Professional scepticism applied when management presents AI performance claims

Participants can identify and prioritise auditable AI systems across the organisation.

• AI inventory fields defined for models, tools, owners and purposes
• Business processes mapped to embedded models and automated decisions
• Risk-based prioritisation considers impact, autonomy, data sensitivity and change frequency
• Third-party AI services included within the auditable entity population
• Shadow AI usage identified through interviews, access reviews and procurement records
• Audit universe heat maps connect AI systems with assurance coverage

Participants can scope an AI audit using documented risks, objectives and materiality criteria.

• Inherent risk assessment addresses decision impact, affected populations and financial exposure
• NIST AI RMF functions structure risk identification and audit scoping
• Risk scenarios formulated using cause, event, consequence and control failure
• Materiality criteria set for financial, regulatory, reputational and customer outcomes
• Audit objectives translated into testable questions and evidence requirements
• Engagement boundaries define systems, datasets, vendors and process handoffs

Participants can evaluate whether AI governance assigns clear accountability and effective oversight.

• AI governance structures assessed through committees, mandates and escalation routes
• Accountability matrices assign business, technology, risk and compliance responsibilities
• Model approval gates reviewed for documented challenge and sign-off
• Policy requirements tested against actual system-development and deployment practices
• Management information assessed for risk indicators, incidents and performance trends
• ISO/IEC 42001 control themes connected to audit criteria and evidence

Participants can test data controls affecting AI accuracy, fairness, privacy and traceability.

• Data lineage traced from source systems through features to model outputs
• Completeness, accuracy, timeliness and validity tests applied to training data
• Data ownership and stewardship assessed through accountable control activities
• Sensitive data classification tested against permitted AI processing purposes
• Feature engineering controls reviewed for undocumented transformations and proxy variables
• Retention and deletion rules tested across datasets, prompts and generated outputs

Participants can assess controls over model development, validation, approval and release.

• Development standards reviewed for requirements, assumptions and model documentation
• Training and validation datasets separated to prevent performance overstatement
• Independent validation challenges conceptual soundness, outcomes and limitations
• Performance metrics assessed for relevance, thresholds and monitoring frequency
• Version control tested across code, datasets, parameters and documentation
• Production release approvals verified against completed validation and remediation evidence

Participants can design audit procedures for discriminatory outcomes and insufficiently explainable decisions.

• Fairness objectives defined according to policy, law and decision context
• Protected characteristics and proxy variables identified within model input data
• Disparate impact testing compared across relevant customer or employee groups
• False-positive and false-negative rates analysed by population segment
• Explainability evidence reviewed using feature importance and decision rationale
• Human review controls tested for high-impact automated decisions

Participants can test privacy, security and access controls across AI environments.

• Privacy impact assessments reviewed for AI processing and data-sharing risks
• Role-based access controls tested for datasets, models and prompt repositories
• Privileged access recertification examined for developers, administrators and vendors
• Encryption controls assessed for data at rest and in transit
• Prompt injection and data-exfiltration threats incorporated into audit test plans
• Incident response procedures evaluated for AI-specific security and privacy events

Participants can assess AI vendor arrangements, contractual controls and ongoing assurance evidence.

• Vendor due diligence evaluates model transparency, security and data practices
• Contract clauses tested for ownership, confidentiality, audit rights and notification
• Service-level measures reviewed for availability, accuracy and incident reporting
• Subprocessor arrangements traced for data transfers and accountability gaps
• SOC reports assessed for relevant control coverage and complementary user controls
• Exit plans reviewed for data return, deletion and service continuity

Participants can select and document analytics appropriate for audit objectives and available data.

• Audit questions converted into data fields, populations and test criteria
• Data extraction procedures preserve source, timing and transformation evidence
• Population reconciliation confirms record counts, totals and completeness before testing
• Descriptive analytics identify distributions, trends, outliers and unexpected relationships
• Benford analysis applied cautiously to relevant transaction populations
• Analytics workpapers document logic, parameters, results and reviewer conclusions

Participants can use anomaly-detection methods to identify transactions requiring audit investigation.

• Outlier detection methods selected using risk hypotheses and data characteristics
• Z-scores flag unusually high or low continuous transaction values
• Isolation Forest concepts applied to multi-variable unusual transaction patterns
• Peer-group comparisons identify exceptions within branches, vendors or cost centres
• Duplicate-payment tests match supplier, invoice, date and amount attributes
• Exception populations prioritised using financial exposure and control-risk indicators

Participants can use generative AI for bounded audit tasks while retaining professional judgement.

• Permitted audit use cases defined through confidentiality and quality criteria
• Prompt structures specify role, task, context, constraints and output format
• Source-grounded prompting reduces unsupported statements in generated audit drafts
• AI-generated summaries verified against original documents and audit evidence
• Sensitive information removed before using approved external AI services
• Human review records document prompt use, validation and final accountability

Participants can obtain sufficient evidence and document AI audit conclusions defensibly.

• Audit evidence evaluated for relevance, reliability, sufficiency and traceability
• System-generated evidence corroborated through configuration, logs and independent sources
• Sampling approaches selected using population risk, control frequency and audit objectives
• Reperformance tests validate automated decisions against approved business rules
• Audit trails reviewed for input changes, model versions and decision overrides
• Workpapers link risks, procedures, evidence, findings and conclusions clearly

Participants can test end-to-end controls in business processes supported by AI decisions.

• Process walkthroughs trace AI decisions from trigger through downstream action
• Preventive controls assessed before automated approvals or customer communications
• Detective controls reviewed for exceptions, drift and adverse outcome monitoring
• Override controls tested for authority, rationale and post-event review
• Credit-decision models examined for approval thresholds and manual escalation
• Procurement monitoring models tested for flagged payments and investigation closure

Participants can assess whether deployed AI systems remain controlled as data and conditions change.

• Model drift indicators reviewed against approved thresholds and escalation triggers
• Data drift monitoring tested for changing input distributions and missing values
• Outcome monitoring compares actual results with expected model performance
• Change requests assessed for impact analysis, testing and formal approval
• Emergency changes traced through retrospective review and remediation controls
• Periodic model reviews evaluated for continued suitability and retirement decisions

Participants can write and present AI audit findings that support management action.

• Findings written with condition, criteria, cause, consequence and recommendation
• Risk ratings calibrated using impact, likelihood, control maturity and exposure
• Technical issues translated into business, regulatory and customer consequences
• Root-cause analysis distinguishes governance failures from isolated operating errors
• Management action plans specify owners, milestones, evidence and closure criteria
• Audit committee reporting highlights significant AI risks and assurance limitations

Participants can apply quality review procedures to AI audit planning, testing and reporting.

• Engagement supervision checkpoints assess scope, evidence, judgement and documentation quality
• Quality reviews test consistency between risk assessment and audit procedures
• Reviewer challenge focuses on assumptions, exceptions and unsupported conclusions
• Working papers assessed against internal methodology and retention requirements
• Lessons learned capture recurring control issues and audit-method improvements
• Performance measures track AI audit coverage, findings and remediation progress

Participants can create a reusable audit programme for a selected AI risk area.

• Audit programme objectives aligned with prioritised AI risk scenarios
• Control matrices connect risks, controls, evidence sources and test procedures
• Testing steps distinguish design effectiveness from operating effectiveness conclusions
• Data requests specify fields, owners, periods and extraction validation methods
• Interview guides target accountable owners, developers, validators and users
• Reporting criteria define escalation thresholds for significant control failures

Participants can build, review and present a complete AI internal audit engagement package for a defined business case.

• Business case analysed to identify AI decisions, stakeholders and process dependencies
• Audit scope, objectives and risk assessment documented for the selected system
• Control matrix developed for governance, data, model, security and oversight
• Testing procedures drafted with evidence requirements, samples and evaluation criteria
• Findings report prepared with ratings, root causes and management actions
• Audit committee presentation delivered with conclusions, limitations and follow-up priorities