Internal Audit Planning and Execution Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Internal Auditors, Senior Internal Auditors and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-A-147

Before you join: Participants should understand basic accounting, business processes and internal controls, gained through finance, audit, compliance, risk or operational experience.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Internal audit teams are expected to provide timely, evidence-based assurance on risks that matter to boards and senior management. That requires more than checking compliance: auditors must translate the audit universe into a defensible plan, define engagement scope, test controls consistently, assess exceptions fairly and report findings in a form that prompts action. Weak planning, unclear criteria, incomplete working papers or poorly supported findings can reduce audit credibility and leave significant risks unresolved.

This course covers the full internal audit engagement cycle, from risk-based annual planning through fieldwork, reporting and follow-up. Participants learn to build an audit universe, assess residual risk, prepare engagement work programmes, map processes, develop risk and control matrices, select testing methods and document sufficient appropriate evidence. The course also addresses interviews, walkthroughs, sampling, data analytics, root cause analysis, issue rating, recommendations, audit committee reporting and remediation validation. Participants apply the Global Internal Audit Standards, COSO Internal Control Framework and IIA Three Lines Model to realistic assurance assignments.

Teaching combines short instructor briefings with case-based planning, group analysis, audit simulations and structured review of sample documentation. Participants work with scenarios such as procurement control failures, suspicious payment patterns, payroll exceptions, regulatory compliance gaps and overdue remediation actions. They leave with a reusable internal audit planning and execution toolkit, including templates for risk assessment, engagement planning, testing, findings and follow-up.

The course is suited to internal auditors, finance and compliance professionals, risk specialists and managers who contribute evidence or corrective actions during audits. It is particularly useful for professionals moving from operational, finance, compliance or external audit roles into internal audit responsibilities.

What you will be able to do

  • Construct a risk-based annual audit plan using an audit universe and residual risk assessment
  • Define engagement objectives, scope, criteria and materiality thresholds for internal audit assignments
  • Map business processes and develop risk and control matrices using COSO principles
  • Design audit work programmes with suitable tests of controls and substantive procedures
  • Perform walkthroughs, interviews, sampling and evidence evaluation to support audit conclusions
  • Evaluate control design and operating effectiveness using documented testing criteria
  • Draft clear audit findings, ratings, recommendations and reports supported by sufficient evidence
  • Establish follow-up procedures for validating remediation actions and escalating overdue issues

Benefits of attending

For you

  • Produce defensible audit plans linked to business risk and governance priorities
  • Conduct fieldwork with clearer tests, stronger evidence and better documented conclusions
  • Write findings that distinguish symptoms, root causes, impacts and corrective actions
  • Improve confidence when challenging control owners and discussing exceptions with management
  • Build reusable audit documentation suitable for supervisor and quality assurance review

For your organisation

  • Improves consistency between annual audit plans, engagement scopes and risk priorities
  • Reduces unsupported findings and rework caused by incomplete working papers
  • Identifies control failures earlier through structured walkthroughs, testing and exception analysis
  • Produces clearer management actions with accountable owners, dates and validation evidence
  • Strengthens audit committee reporting on significant risks, themes and overdue remediation

Course modules

10 modules over 5 days

Participants can position internal audit work within governance arrangements and apply independence, objectivity and due care requirements.

  • Internal audit mandate, authority and responsibility under the Global Internal Audit Standards
  • IIA Three Lines Model roles for governing body, management and audit
  • Independence, objectivity and conflicts assessed before accepting assurance engagements
  • Audit charter provisions for access, scope, reporting and quality assurance
  • Engagement versus advisory work: purpose, safeguards, documentation and stakeholder expectations
  • Professional scepticism, due care and evidence reliability in audit judgments

Participants can develop a risk-based audit plan that prioritises assurance work against organisational risk.

  • Enterprise risk universe structured by process, entity, product and regulation
  • Risk assessment criteria combining impact, likelihood, velocity, control maturity and change
  • Heat maps and risk scoring calibrated with management risk appetite
  • Annual audit plan prioritised through residual risk, coverage and resource analysis
  • Board and audit committee input incorporated without compromising audit independence
  • Plan revisions triggered by acquisitions, incidents, regulatory change and emerging risks

Participants can define a focused audit engagement with clear objectives, criteria, scope and work programme.

  • Engagement objectives linked to risks, controls, obligations and stakeholder decisions
  • Preliminary survey techniques: walkthroughs, interviews, documents, data and prior findings
  • Scope boundaries defined by processes, locations, periods, systems and exclusions
  • Audit criteria drawn from policies, contracts, laws, standards and control objectives
  • Materiality and significance thresholds tailored to engagement risk and decision use
  • Engagement work programmes sequenced around assertions, risks, controls and testing methods

Participants can document processes and assess whether key controls are suitably designed to address risks.

  • Process narratives distinguish activities, decision points, handoffs, systems and records
  • Flowcharts and swimlane diagrams expose control gaps and unclear ownership
  • Risk and control matrices connect objectives, risks, controls, owners and evidence
  • COSO principles used to assess control environment, activities, information and monitoring
  • Key controls identified by preventing or detecting material process failures
  • Control design evaluated for precision, frequency, competence and segregation duties

Participants can select testing methods, evaluate evidence quality and prepare review-ready audit working papers.

  • Audit evidence assessed for sufficiency, reliability, relevance and source independence
  • Sampling approaches selected: random, systematic, judgmental, attribute and monetary-unit sampling
  • Test-of-controls procedures examine performance, population completeness and operating consistency
  • Substantive procedures reconcile transactions, recompute calculations and corroborate balances
  • Data analytics tests identify duplicates, gaps, outliers, sequence breaks and exceptions
  • Working papers document procedures, evidence, conclusions, review notes and cross-references

Participants can manage fieldwork, gather evidence efficiently and document exceptions against agreed criteria.

  • Opening meetings establish objectives, logistics, contacts, records and communication protocols
  • Interview questioning separates stated procedures from actual control performance
  • Walkthroughs trace transactions from initiation through authorization, processing, recording and review
  • Observation, inspection and reperformance applied to test control operation
  • Exception logs capture condition, criteria, cause, consequence and supporting evidence
  • Supervision and review resolve evidence gaps, scope changes and quality issues

Participants can develop balanced, evidence-based findings that lead to practical management actions.

  • Five Cs structure findings: condition, criteria, cause, consequence and corrective action
  • Root cause analysis uses five whys, fishbone diagrams and process failure modes
  • Impact quantified through financial exposure, compliance breach, service disruption and fraud risk
  • Finding ratings consider likelihood, impact, control failure persistence and management response
  • Recommendations address root causes, accountable owners, milestones and measurable actions
  • Management discussions test factual accuracy without diluting independent audit conclusions

Participants can communicate audit conclusions clearly to management, senior leaders and audit committees.

  • Draft reports distinguish executive messages, scope, opinion, findings and agreed actions
  • Assurance conclusions supported by evidence, risk assessment and consistent rating criteria
  • Clear writing uses factual language, active sentences and quantified consequences
  • Exit meetings communicate significant issues, disagreements, actions and escalation routes
  • Audit committee reporting highlights themes, overdue actions, emerging risks and plan implications
  • Sensitive findings handled through confidentiality, legal consultation and documented distribution controls

Participants can verify remediation, monitor audit quality and report the status of unresolved risks.

  • Action tracking records owners, due dates, milestones, validation evidence and status
  • Follow-up testing verifies remediation design, implementation and sustained control operation
  • Overdue high-risk actions escalated through agreed management and governance channels
  • Quality assurance reviews assess conformance, supervision, documentation and report quality
  • Performance measures track plan delivery, issue aging, stakeholder feedback and resource use
  • Internal audit files retained under records policies, legal holds and confidentiality requirements

Participants can apply the complete audit method and identify improvements for their own audit assignments.

  • End-to-end engagement planning integrates risk assessment, scope, criteria, testing and reporting
  • Audit judgments documented where evidence conflicts, exceptions cluster or scope changes
  • Stakeholder communication plan sets touchpoints, escalation thresholds and decision authorities
  • Personal action plan identifies immediate improvements to planning, fieldwork and reporting
  • Reusable templates adapted for audit universe, work programmes, findings and follow-up
  • Peer review checkpoints scheduled before fieldwork, reporting and final file closure

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Risk-based annual audit plan template
  2. Audit universe and risk assessment model
  3. Engagement planning memorandum template
  4. Risk and control matrix template
  5. Audit work programme and working paper checklist
  6. Audit finding and remediation follow-up tracker

Who should attend

  • Internal Auditors — need a structured method for planning, testing and reporting engagements
  • Senior Internal Auditors — need consistent approaches for supervising fieldwork and reviewing files
  • Finance Managers — need to prepare for audits and respond effectively to control findings
  • Compliance Officers — need to assess compliance controls and document assurance evidence
  • Risk Managers — need to align risk assessments with internal audit coverage decisions
  • External Auditors Moving In-House — need to adapt assurance methods to internal control and governance work

Skills and tools covered

Risk-based audit planningControl evaluationAudit evidence testingWorking paper documentationFinding developmentRemediation follow-up

Tools and standards

Global Internal Audit Standards, COSO Internal Control—Integrated Framework, IIA Three Lines Model, ISO 31000

How the course runs

Training methodology

The course uses short instructor briefings to introduce standards, methods and documentation requirements, followed by case work based on common internal audit assignments. Participants analyse audit universes, scope engagements, map processes, assess controls, review evidence and develop findings from simulated audit files. Group exercises focus on professional judgement, issue rating and management communication. Facilitated discussions compare alternative testing approaches and reporting choices. The final application planning session helps participants adapt the methods and templates to their own audit portfolio.

Requirements and prerequisites

Participants should understand basic accounting, business processes and internal controls, gained through finance, audit, compliance, risk or operational experience. Familiarity with common documents such as policies, reconciliations, invoices, approvals and management reports is helpful. Participants should be comfortable reading process documentation and discussing risks with business stakeholders. Prior internal audit experience is useful but not essential. This course does not require a professional audit qualification, advanced statistical knowledge, programming skills or prior use of specialist audit software.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should have basic familiarity with business processes, financial records or internal controls. Previous internal audit work is helpful but not required, and no audit qualification is needed.

Participants should bring examples of their organisation's audit charter, audit plan, working papers or report formats if organisational policy permits. A laptop is useful for reviewing templates and completing application planning.

The course is designed for internal auditors, senior auditors, finance managers, compliance officers and risk professionals. It also suits external auditors moving into an internal audit role.

This course focuses on risk-based assurance over governance, risk management, operational controls and compliance processes. External audit courses focus more directly on financial statement assertions, audit opinions and statutory reporting requirements.

Participants can use the planning, risk assessment, work programme, findings and follow-up templates on current or upcoming audit assignments. The methods support both operational and financial control audits.

The course runs from 08:30 to 16:30 each day and provides about 6.5 contact hours daily. Time is allocated across planning, process and control evaluation, fieldwork, reporting, follow-up and application planning.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

More courses in Auditing

Auditing Insurance Reporting and Audit Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Internal Audit Function Management Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Internal Audit Improvement Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Internal Audit Report Writing Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Internal Audit Standards and Practice Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Internal Audit Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Internal Audit in Banking Training Course 5 days · from USD 1,100 · next 16 Nov Auditing International Standards on Auditing Application Training Course 5 days · from USD 1,100 · next 16 Nov