Certificate Course in Internal Auditing

Duration 10 days 20 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Internal Auditors, Senior Internal Auditors and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-A-101

Before you join: Participants should have basic familiarity with organisational processes, financial records, internal controls, risk registers or compliance requirements.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Internal audit functions are expected to provide independent assurance while helping boards and executives see whether risks, controls and governance arrangements are working as intended. Auditors must assess financial, operational, technology, compliance and conduct risks; plan work from reliable risk evidence; test controls efficiently; and report findings that prompt accountable action. Weak scoping, poorly documented evidence and vague recommendations can undermine confidence in the audit function.

This certificate course develops the full internal audit process, from mandate and independence through risk assessment, annual planning, engagement planning, fieldwork, reporting and follow-up. Participants apply the Global Internal Audit Standards, COSO Internal Control, COSO ERM and ISO 31000 to realistic audit assignments. They learn to construct risk and control matrices, map processes, select samples, test design and operating effectiveness, evaluate root causes, rate findings, write practical recommendations and communicate with auditees, management and audit committees.

Teaching combines focused instructor briefings with financial services, public-sector, NGO, manufacturing and corporate cases. Participants work through audit evidence, process narratives, control failures, data extracts and management responses, then apply methods to an audit area relevant to their own role. They leave with a reusable internal audit toolkit and a completed audit file containing a risk assessment, engagement plan, workpapers, findings and an audit report.

The programme suits internal auditors and assurance professionals who already work with organisational processes, financial records, controls or risk information and need a disciplined method for delivering defensible audits.

What you will be able to do

  • Apply the Global Internal Audit Standards to internal audit mandates, engagements and quality requirements
  • Develop a risk-based annual audit plan using enterprise risk, control and assurance information
  • Construct process maps and risk and control matrices for auditable business processes
  • Design audit programmes that test control design and operating effectiveness
  • Evaluate audit evidence using sampling, walkthroughs, inspection, observation and inquiry
  • Draft findings with root-cause analysis, risk ratings, recommendations and management actions
  • Present audit results to management and audit committees using clear assurance reporting
  • Complete a documented end-to-end internal audit engagement file

Benefits of attending

For you

  • Produce audit workpapers that withstand manager and quality-assurance review
  • Plan risk-based audits rather than relying on inherited checklists
  • Identify control gaps and distinguish design failure from operating failure
  • Write findings that secure clear management ownership and due dates
  • Prepare evidence for Internal Audit Practitioner or CIA study pathways

For your organisation

  • Improve consistency of audit planning, testing documentation and reporting
  • Focus audit resources on material risks and weak control areas
  • Produce findings with clearer causes, accountable owners and corrective actions
  • Strengthen audit committee confidence in assurance coverage and evidence quality
  • Reduce repeat findings through structured follow-up and remediation validation

Course modules

20 modules over 10 days

Participants can position internal audit within governance arrangements and apply its core professional requirements.

  • Internal audit purpose, authority and accountability within organisational governance arrangements
  • Global Internal Audit Standards structure, principles and mandatory requirements
  • Board, audit committee, management and internal audit responsibilities
  • Internal audit charter provisions covering mandate, access, scope and reporting
  • Independence threats, objectivity impairments and appropriate safeguard decisions
  • Three Lines Model roles for management, risk and assurance

Participants can assess ethical obligations, governance arrangements and quality requirements affecting audit work.

  • Ethical principles: integrity, objectivity, competency, confidentiality and professional care
  • Conflicts of interest identified, declared and managed before engagements
  • Governance structures assessed through oversight, decision rights and reporting
  • Quality assurance and improvement programme requirements under IIA Standards
  • Engagement supervision, review notes and workpaper quality control
  • Confidential information handling, retention schedules and secure audit files

Participants can evaluate how risk management information should inform audit priorities and scope.

  • ISO 31000 principles, framework and risk management process
  • Risk appetite, tolerance and capacity distinguished for audit planning
  • Inherent risk, residual risk and control effectiveness relationships
  • Risk registers challenged for completeness, ownership and assessment quality
  • Emerging risk indicators sourced from operations, finance and external developments
  • COSO ERM components linked to governance and performance objectives

Participants can develop a defensible annual audit plan from a structured audit universe and risk assessment.

  • Audit universe construction using entities, processes, systems and obligations
  • Risk assessment criteria weighted for impact, likelihood and control maturity
  • Assurance mapping identifies duplication, gaps and reliance opportunities
  • Annual audit plan prioritises engagements, resources, timing and contingencies
  • Audit plan proposals align with board priorities and risk appetite
  • Plan revisions documented when strategic, regulatory or operational risks change

Participants can define clear engagement objectives, scope boundaries, criteria and resource requirements.

  • Engagement objectives framed around risks, controls and assurance questions
  • Scope boundaries define entities, periods, locations, systems and exclusions
  • Audit criteria drawn from policy, regulation, contracts and performance targets
  • Preliminary risk assessment informs engagement priorities and resource estimates
  • Terms of reference document objectives, scope, timing and reporting arrangements
  • Stakeholder expectations tested without compromising auditor independence or objectivity

Participants can document end-to-end processes and identify risk points, controls and handoffs.

  • Process narratives capture triggers, activities, decisions, outputs and exceptions
  • Swimlane flowcharts show ownership, segregation and cross-functional handoffs
  • Walkthroughs trace transactions from initiation through recording and approval
  • Key systems, interfaces and manual workarounds documented during process analysis
  • Control points identified at authorisation, processing, reconciliation and review stages
  • Process maps validated with process owners before detailed testing

Participants can build risk and control matrices that connect objectives, risks, controls and tests.

  • Process objectives translated into specific risks of failure or loss
  • Risk and control matrix fields: objective, risk, control, owner, frequency
  • Preventive, detective, corrective and compensating controls classified accurately
  • Manual, automated and information technology dependent controls distinguished clearly
  • Control objectives linked to financial, operational, compliance and safeguarding risks
  • Test procedures specified against each key control and audit assertion

Participants can assess whether control designs address identified risks using recognised control frameworks.

  • COSO Internal Control components applied to a business process
  • Control environment indicators include accountability, competence and ethical conduct
  • Risk assessment controls address changes, fraud and objective-setting processes
  • Control activities assessed for precision, timeliness and segregation of duties
  • Information and communication channels tested for escalation and reporting
  • Monitoring activities evaluated through review, remediation and control self-assessment

Participants can obtain, evaluate and document sufficient, reliable and relevant audit evidence.

  • Sufficiency, reliability, relevance and usefulness assessed for audit evidence
  • Inspection, observation, inquiry, confirmation, recalculation and reperformance compared
  • Corroborating evidence obtained when management explanations lack support
  • Workpapers document procedures performed, evidence obtained and conclusions reached
  • Indexing, cross-referencing and sign-off conventions support file review
  • Evidence limitations, exceptions and unresolved matters recorded transparently

Participants can select appropriate samples and use data analysis to target audit testing.

  • Population definition establishes complete records for sampling and analysis
  • Judgemental, random, systematic and stratified sampling methods compared
  • Sample size considers risk, population variability and expected deviation rate
  • Attribute sampling tests control performance across selected transactions
  • Data analytics identifies duplicates, gaps, outliers and unusual trend patterns
  • Sampling conclusions distinguish observed exceptions from population-wide assertions

Participants can determine whether a control is suitably designed to prevent or detect a risk.

  • Design effectiveness asks whether controls address specified risks adequately
  • Walkthrough evidence confirms control steps, ownership and information inputs
  • Control precision assessed through thresholds, criteria and reviewer competence
  • Segregation of duties conflicts identified through role and access analysis
  • Key reports tested for completeness, accuracy and appropriate review
  • Design gaps documented with affected objectives, risks and consequences

Participants can test whether key controls operated consistently during the audit period.

  • Operating effectiveness testing examines consistent performance during defined periods
  • Test attributes specify expected evidence, timing, approval and exception handling
  • Transaction samples traced to source documents, system records and reviews
  • Exceptions evaluated for frequency, cause, severity and control implications
  • Reperformance verifies calculations, reconciliations and supervisory review evidence
  • Control testing conclusions distinguish isolated errors from systemic failure

Participants can audit key financial controls and assess indicators of fraud risk.

  • Revenue, expenditure, payroll and treasury control objectives mapped
  • Bank reconciliations tested for timeliness, review and unreconciled items
  • Delegated authority controls examined against approval limits and evidence
  • Procurement fraud indicators include split purchases, conflicts and vendor anomalies
  • Fraud risk assessment considers incentive, opportunity, rationalisation and capability
  • Management override risks tested through journal entries and unusual adjustments

Participants can identify core technology control risks and incorporate them into audit engagements.

  • General IT controls cover access, change management, operations and backups
  • User access reviews test provisioning, privilege, recertification and termination
  • Password, multifactor authentication and privileged access controls evaluated
  • System change controls trace requests, testing, approval and deployment
  • Interface failures assessed through reconciliations, error logs and exception reports
  • Cyber incident response controls reviewed for detection, escalation and recovery

Participants can adapt audit methods to regulatory, third-party and programme assurance assignments.

  • Compliance obligations converted into auditable criteria and control requirements
  • Third-party due diligence tests ownership, sanctions, integrity and capability
  • Contract management controls cover deliverables, invoices, variations and renewals
  • Grant-funded programme audits test eligibility, procurement and reporting conditions
  • Site verification procedures confirm assets, services and beneficiary records
  • Regulatory breaches escalated using defined materiality and reporting protocols

Participants can turn audit exceptions into evidence-based findings with meaningful causes and consequences.

  • Condition, criteria, cause, consequence and recommendation structure each finding
  • Five Whys analysis separates underlying causes from immediate errors
  • Fishbone diagrams classify people, process, technology and governance causes
  • Risk ratings consider impact, likelihood, velocity and control environment
  • Finding aggregation identifies recurring themes across transactions and locations
  • Recommendations address root causes with practical control improvements

Participants can write and present audit reports that support informed management action.

  • Executive summaries communicate assurance opinions, themes and priority actions
  • Audit reports distinguish facts, analysis, judgement and management commitments
  • Clear finding language avoids ambiguity, unsupported claims and blame
  • Closing meetings resolve factual accuracy before issuing final reports
  • Management action plans specify owners, milestones, resources and target dates
  • Audit committee reporting highlights significant risks, overdue actions and trends

Participants can monitor corrective actions and improve audit performance through structured quality review.

  • Follow-up procedures validate implementation and effectiveness of agreed actions
  • Overdue actions escalated according to risk, ownership and governance protocols
  • Continuous auditing uses automated tests for recurring control indicators
  • Key risk indicators and key control indicators monitored over time
  • Engagement quality reviews assess planning, evidence, conclusions and reporting
  • Audit performance measures cover plan delivery, findings and stakeholder feedback

Participants can provide advisory support without assuming management responsibility or compromising assurance independence.

  • Assurance and advisory engagements distinguished by purpose, scope and reporting
  • Advisory roles avoid designing, operating or approving management controls
  • Independence safeguards documented when advisory work affects future assurance
  • Facilitation methods support risk workshops without directing management decisions
  • Control advice framed as options, risks and decision considerations
  • Consulting engagement records document agreed objectives, boundaries and deliverables

Participants can build, review and present a complete internal audit engagement file from planning through final reporting.

  • Audit universe information assessed to select a priority engagement
  • Engagement scope, objectives, criteria and risk assessment documented clearly
  • Process map and risk control matrix prepared for review
  • Audit programme, samples and evidence requirements defined against key controls
  • Testing results evaluated, findings drafted and root causes supported
  • Final report and management action plan presented to a review panel

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Risk-based annual audit plan template
  2. Audit universe and assurance map
  3. Process map and risk control matrix
  4. Control testing workpaper pack
  5. Audit finding and action-plan template
  6. Completed capstone audit engagement file

Who should attend

  • Internal Auditors — build consistent methods for planning, testing and reporting engagements
  • Senior Internal Auditors — strengthen review judgement and risk-based audit leadership
  • Risk and Compliance Officers — assess controls and coordinate assurance work effectively
  • Finance Managers — prepare for audits and improve financial control assurance
  • Operational Managers — understand audit evidence, findings and corrective-action expectations
  • External Auditors Moving In-house — adapt financial audit skills to broader assurance assignments

Skills and tools covered

Risk-based audit planningControl design testingAudit evidence evaluationAudit sampling methodsFinding report writingAudit committee reporting

Tools and standards

Global Internal Audit Standards, COSO Internal Control Framework, COSO Enterprise Risk Management Framework, ISO 31000

How the course runs

Training methodology

Instructor briefings introduce standards, methods and decision criteria before each application stage. Cases use audit files, process narratives, policies, risk registers, control evidence and management responses from common organisational settings. Participants analyse risks, draft workpapers, test controls, discuss judgement calls and present conclusions in small groups. Simulated meetings build confidence in interviews, challenge and closing discussions. Individual application planning links course tools to a current or planned audit assignment.

Requirements and prerequisites

Participants should have basic familiarity with organisational processes, financial records, internal controls, risk registers or compliance requirements. One to two years of experience in audit, finance, risk, compliance, operations, procurement, information technology or programme management is helpful. Participants should be comfortable reading policies, procedures, reports and spreadsheet-based data. Prior internal audit training, professional audit certification and detailed knowledge of auditing standards are not required. The course explains core frameworks before applying them to progressively more demanding audit assignments.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants need basic familiarity with business processes, financial records, controls, risk or compliance work. Prior internal audit certification is not required, but the course moves quickly into applied audit documentation and testing.

Bring a laptop for working with templates, data extracts and audit documentation. If permitted by your employer, bring a sanitised process map, risk register or audit assignment that can inform your application plan.

It is designed for internal auditors, senior auditors, risk and compliance staff, finance professionals and operational managers with audit responsibilities. It is particularly useful for professionals moving from external audit, compliance or finance into internal audit.

External audit courses concentrate on financial statement assertions and audit opinions. This programme covers the wider internal audit mandate, including governance, operational processes, risk management, compliance, technology controls, advisory boundaries and audit committee reporting.

Participants use reusable templates for risk assessment, process mapping, control testing, findings and follow-up. The capstone structure can be adapted to a live audit of procurement, payroll, grants, revenue, information technology or another business process.

The first week establishes standards, risk-based planning, process analysis, control frameworks and evidence methods. The second week develops testing, reporting, follow-up, advisory work and a full capstone engagement, with approximately 6.5 contact hours each day.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

More courses in Auditing

Auditing Audit Analytics with Power BI Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Audit Report Writing and Compliance Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Audit Sampling Training Course 10 days · from USD 2,200 · next 16 Nov Auditing Central Bank Internal Controls and Audit Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Data Analytics for Internal Auditors Training Course 10 days · from USD 2,200 · next 16 Nov Auditing Donor-Funded Project Auditing Training Course 10 days · from USD 2,200 · next 16 Nov Auditing Excel for Auditing and Fraud Examination Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Forensic Auditing and Fraud Detection Training Course 10 days · from USD 2,200 · next 16 Nov