Artificial Intelligence in Internal Audit Training Course

Duration 10 days 20 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Internal Auditors, Audit Managers and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 9 Nov 2026 Course code SD-A-087

Before you join: Participants should have practical experience of internal audit, including risk assessment, audit planning, control evaluation, evidence collection and reporting.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Artificial intelligence is changing both the risks internal audit must assess and the methods auditors can use to provide assurance. Audit functions are being asked to review automated decision systems, generative AI use, model governance, third-party AI services, data quality and privacy controls. At the same time, audit teams need practical ways to use AI for planning, testing, evidence review and reporting without compromising independence, confidentiality or professional judgement.

This course equips internal auditors to plan and perform AI-related assurance work and to apply approved AI tools within the audit lifecycle. Participants examine AI risk scenarios, governance structures, model controls, data controls, prompt controls, human oversight and regulatory considerations. They use the IIA Global Internal Audit Standards, NIST AI Risk Management Framework, ISO/IEC 42001 and COSO principles to scope audits, assess controls, test evidence and report findings. The course also addresses continuous auditing, anomaly detection, audit analytics, vendor due diligence and responsible generative AI use.

Teaching combines short instructor briefings with banking, public-sector, NGO and corporate cases. Participants work through AI-enabled credit decisions, procurement screening, fraud monitoring, customer-service chatbots and employee analytics examples. They build audit artefacts throughout the programme, including an AI audit universe, risk assessment, audit programme, control matrix, testing plan and reporting pack. The final capstone requires participants to develop, review and present a complete AI internal audit engagement package.

The course is suited to internal auditors and assurance professionals who already understand audit planning, control testing and reporting, and who need to audit AI systems or introduce AI-supported audit methods with appropriate safeguards.

What you will be able to do

  • Assess AI use cases and risks using the NIST AI Risk Management Framework
  • Scope AI assurance engagements using risk-based internal audit planning methods
  • Design AI control matrices covering governance, data, models, prompts and human oversight
  • Test AI controls using walkthroughs, evidence inspection, reperformance and data analytics
  • Evaluate model risk, bias, explainability and performance-monitoring controls
  • Apply generative AI safely to audit planning, documentation, testing and reporting tasks
  • Report AI audit findings with clear ratings, root causes, actions and assurance conclusions
  • Produce a complete AI internal audit engagement package for senior stakeholder review

Benefits of attending

For you

  • Build confidence when scoping and leading AI-related audit engagements
  • Add AI governance and model-risk testing methods to audit practice
  • Use generative AI for defined audit tasks with confidentiality safeguards
  • Produce stronger evidence trails for AI control conclusions and findings
  • Prepare for technology audit, AI assurance and audit analytics assignments

For your organisation

  • Create a repeatable approach for auditing AI systems and AI-enabled processes
  • Improve assurance over data quality, human oversight and model governance controls
  • Identify AI-related risks before they produce conduct, privacy or operational failures
  • Increase audit testing capacity through controlled analytics and document-review methods
  • Provide audit committees with clearer reporting on AI risks, controls and remediation

Course modules

20 modules over 10 days

Participants can explain how AI changes internal audit risk assessment, assurance scope and audit evidence requirements.

  • Artificial intelligence concepts relevant to internal audit assurance assignments
  • Machine learning, generative AI and automated decision system distinctions
  • IIA Global Internal Audit Standards requirements for technology-enabled assurance engagements
  • Three Lines Model responsibilities for AI ownership and oversight
  • Audit committee questions on material AI risks and controls
  • AI use cases in banking, procurement, grants and customer service

Participants can identify AI use cases and prioritise them within a risk-based audit universe.

  • AI inventory fields covering purpose, owner, data and decisions
  • Risk taxonomy for fairness, privacy, security, reliability and accountability
  • Inherent-risk scoring using impact, likelihood, velocity and control maturity
  • Materiality thresholds for AI systems affecting customers, employees or citizens
  • Mapping AI use cases to processes, products and legal entities
  • Risk-based audit universe prioritisation using heat maps and trigger events

Participants can assess whether AI governance assigns clear accountability, approval and escalation responsibilities.

  • AI governance charters defining board, executive and management responsibilities
  • RACI matrices for model owners, data owners and control owners
  • Approval gates from business case through retirement and decommissioning
  • Policy hierarchies covering acceptable use, model development and procurement
  • Escalation criteria for incidents, performance degradation and policy breaches
  • Management information packs for AI risk committees and audit committees

Participants can apply the NIST AI Risk Management Framework to structure an AI risk assessment.

  • NIST AI RMF Govern, Map, Measure and Manage functions
  • Context mapping for intended users, affected parties and decisions
  • Impact assessment for financial, customer, societal and operational harms
  • Risk registers linking AI hazards, controls, owners and residual ratings
  • Control-gap analysis against stated risk appetite and tolerance limits
  • Documenting assumptions, limitations and uncertainty within AI risk assessments

Participants can prepare a risk-based audit plan for an AI system or AI-enabled business process.

  • Engagement objectives aligned with governance, risk, control and compliance concerns
  • Audit scope boundaries covering models, data, vendors and business processes
  • Planning memoranda documenting risks, criteria, resources and stakeholder expectations
  • Stakeholder interviews using structured questions on AI lifecycle controls
  • Process maps tracing inputs, model outputs, decisions and customer impacts
  • Audit programmes sequenced from governance testing through detailed control testing

Participants can test whether data used by AI systems is governed, reliable and fit for purpose.

  • Data lineage tracing from source systems through training and production datasets
  • Data quality dimensions: accuracy, completeness, timeliness, validity and consistency
  • Training-data selection controls addressing relevance, representativeness and provenance
  • Data access reviews using least-privilege and segregation-of-duties principles
  • Retention schedules for training data, prompts, outputs and audit logs
  • Testing data reconciliation controls between source records and AI inputs

Participants can evaluate model lifecycle controls from design approval through monitoring and retirement.

  • Model inventories recording purpose, methodology, owner, version and criticality
  • Model development documentation covering assumptions, features and performance measures
  • Independent validation roles under model risk management principles
  • Change-management controls for retraining, parameter changes and software releases
  • Performance monitoring using drift, error, stability and threshold metrics
  • Model retirement procedures preserving records, approvals and historical evidence

Participants can test controls designed to identify unfair outcomes and support explainable AI decisions.

  • Bias sources within data collection, labelling, features and model design
  • Fairness metrics including disparate impact, equal opportunity and calibration
  • Protected-group testing plans using lawful, proportionate demographic data
  • Explainability methods: feature importance, reason codes and local explanations
  • Human-review controls for adverse, high-impact or contested decisions
  • Documenting limitations where explanations cannot support audit conclusions

Participants can assess governance and control arrangements for generative AI tools and use cases.

  • Generative AI risk scenarios involving hallucination, disclosure and harmful outputs
  • Approved-tool registers distinguishing enterprise, consumer and restricted AI services
  • Prompt-management controls for sensitive data, instructions and output retention
  • Human-in-the-loop review requirements for external communications and decisions
  • Output verification procedures using source checks, recalculation and expert review
  • Usage monitoring through access logs, prompt logs and exception reports

Participants can test AI controls for privacy, cybersecurity, supplier oversight and contractual accountability.

  • Privacy impact assessments for personal data processed by AI systems
  • Security threats including prompt injection, data poisoning and model extraction
  • Vendor due diligence covering security, model governance and data processing
  • Contract clauses for audit rights, incident notice and data-use restrictions
  • Third-party assurance reports evaluated against control objectives and audit scope
  • Business continuity arrangements for unavailable AI providers and critical services

Participants can create an AI control matrix linking risks, controls, evidence and test procedures.

  • Risk-and-control matrices linking objectives, risks, controls and assertions
  • Preventive, detective and corrective controls across the AI lifecycle
  • Control design criteria: ownership, frequency, evidence, precision and escalation
  • Key control identification using risk severity and reliance decisions
  • Evidence requests matched to policies, logs, approvals and test records
  • Control matrices for AI-enabled credit, procurement and fraud processes

Participants can select and perform appropriate audit tests for AI governance and operational controls.

  • Walkthroughs tracing one AI decision from input through outcome
  • Design-effectiveness testing through policy, procedure and responsibility inspection
  • Operating-effectiveness sampling using populations, samples and selection rationale
  • Reperformance of approval, validation and exception-management control activities
  • Audit evidence evaluation for relevance, reliability, sufficiency and authenticity
  • Workpaper documentation linking tests, evidence, conclusions and reviewer sign-off

Participants can plan AI-supported analytics while preserving data controls and audit evidence quality.

  • Analytics objectives framed as audit questions, hypotheses and expected exceptions
  • Data preparation procedures for completeness, duplicates, outliers and missing values
  • Benford analysis applied carefully to transaction populations and fraud indicators
  • Anomaly-detection methods including clustering, isolation forests and threshold rules
  • False-positive review procedures supported by business evidence and auditor judgement
  • Reproducible analytics records retaining datasets, logic, parameters and outputs

Participants can use approved generative AI tools for audit tasks within defined quality and confidentiality controls.

  • Permitted audit tasks for summarisation, drafting, classification and document review
  • Prompt structures specifying role, source material, constraints and output format
  • Confidentiality safeguards before entering evidence into generative AI tools
  • Validation checklists for AI-generated audit plans, analyses and report drafts
  • Citation and source-traceability requirements for AI-assisted audit conclusions
  • Professional judgement boundaries when AI suggestions conflict with evidence

Participants can design continuous auditing approaches for selected AI risks and control indicators.

  • Continuous auditing objectives distinguished from management control monitoring
  • Key risk indicators for drift, overrides, complaints and policy exceptions
  • Automated testing schedules based on risk, data availability and control frequency
  • Alert thresholds calibrated to volume, materiality and investigation capacity
  • Exception workflows assigning triage, investigation, remediation and closure responsibilities
  • Dashboard specifications for audit management and audit committee reporting

Participants can communicate AI audit findings, ratings and remediation expectations clearly to senior stakeholders.

  • Finding statements separating condition, criteria, cause, consequence and action
  • Root-cause analysis using five whys and cause-and-effect diagrams
  • Risk ratings based on impact, likelihood, control failure and exposure
  • Management action plans defining owners, milestones, evidence and closure criteria
  • Executive reporting that explains technical AI risks in business terms
  • Audit committee papers summarising assurance conclusions, themes and unresolved exposures

Participants can map AI audit criteria to recognised standards and relevant regulatory expectations.

  • ISO/IEC 42001 management-system controls for organisational AI governance
  • COSO principles applied to AI-enabled business processes and controls
  • IIA standards applied to independence, proficiency, evidence and reporting
  • NIST AI RMF profiles tailored to specific AI use cases
  • Regulatory horizon scanning for sector-specific AI governance obligations
  • Audit criteria documents combining law, policy, standards and contracts

Participants can manage AI audit engagements with appropriate specialist input, quality review and follow-up.

  • Skills assessments identifying needs for data, security and legal specialists
  • Audit resource plans assigning responsibilities, milestones and quality-review points
  • Specialist work evaluation against scope, methods, evidence and conclusions
  • Quality assurance reviews of planning, testing, workpapers and reporting
  • Issue follow-up testing using agreed closure criteria and evidence requirements
  • Lessons-learned reviews improving future AI audit programmes and methodologies

Participants can prepare an implementation plan for introducing AI assurance methods into an internal audit function.

  • AI assurance maturity assessment across people, process, data and technology
  • Target operating model for recurring AI audit coverage and escalation
  • Methodology updates covering planning, control testing and workpaper standards
  • Training plans for auditors, specialists, audit managers and quality reviewers
  • Pilot selection criteria based on risk, feasibility and stakeholder readiness
  • Implementation roadmaps with milestones, dependencies, owners and success measures

Participants can build, review and present a complete AI internal audit engagement package for a defined business case.

  • Select an AI use case and define audit objectives
  • Prepare risk assessment, scope statement and stakeholder interview plan
  • Build an AI risk-and-control matrix with test procedures
  • Evaluate supplied evidence and document control-testing conclusions clearly
  • Draft findings, ratings, management actions and executive assurance conclusions
  • Present engagement results to a simulated audit committee review
  • Receive peer challenge on scope, evidence, ratings and recommendations

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. AI audit universe template
  2. NIST AI RMF risk assessment worksheet
  3. AI risk-and-control matrix
  4. AI audit programme template
  5. Generative AI audit-use checklist
  6. AI internal audit engagement pack

Who should attend

  • Internal Auditors — need to assess AI risks and controls within assurance engagements
  • Audit Managers — need repeatable methods for planning and supervising AI audit work
  • Technology Auditors — need to test AI governance, data, model and security controls
  • Risk Managers — need to align AI risk assessments with internal audit assurance
  • Compliance Officers — need evidence-based reviews of AI policy and regulatory obligations
  • Data Analytics Auditors — need to use AI-supported analytics without weakening audit evidence

Skills and tools covered

AI assurance planningModel risk assessmentAI control testingAudit data analyticsGenerative AI governanceAI audit reporting

Tools and standards

IIA Global Internal Audit Standards, NIST AI Risk Management Framework, ISO/IEC 42001, COSO Internal Control Framework

How the course runs

Training methodology

The course uses short technical briefings, instructor demonstrations, case analysis, group discussions, control-design workshops and audit simulations. Participants review realistic evidence such as AI policies, model inventories, process maps, vendor documents, test results and exception logs. Each module adds to a working AI audit file, allowing participants to apply frameworks before progressing to deeper assurance questions. Facilitated peer review is used to compare risk ratings, test approaches and reporting judgements. Time is also reserved for individual application planning against participants’ own audit portfolios.

Requirements and prerequisites

Participants should have practical experience of internal audit, including risk assessment, audit planning, control evaluation, evidence collection and reporting. Familiarity with technology controls, data analytics or model risk is useful but not essential. Participants should be able to read process documentation, interpret policies and discuss risks with business and technology stakeholders. Programming, data science, machine-learning development and advanced statistics are not required. The course explains relevant AI concepts from an auditor’s perspective and focuses on assurance work rather than building AI models.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

You should understand core internal audit work, including risk assessment, controls, testing and reporting. You do not need programming, data science or machine-learning development experience.

Bring a laptop for course materials and working documents if attending in person. If permitted by your employer, bring a high-level description of an AI use case, audit plan or technology risk area you want to address.

It is designed primarily for internal auditors, audit managers, technology auditors and audit analytics specialists. Risk, compliance and governance professionals responsible for AI oversight will also benefit.

This course focuses on internal audit assurance rather than building models or learning general AI concepts. It addresses audit scope, control criteria, evidence, testing, findings and audit committee reporting.

You can use the templates to inventory AI use cases, assess risk, plan an engagement and test AI controls. The materials also support discussions with technology, data, legal and business owners.

Each training day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The first part develops the audit approach and core working papers; later modules deepen control testing, analytics, reporting and implementation before the final capstone.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Auditing