Internal Audit Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Internal Auditors, Senior Internal Auditors and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-A-107

Before you join: Participants should understand basic business processes, financial records and internal control concepts, gained through work in audit, finance, risk, compliance, operations or information technology.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Internal audit provides independent assurance that governance, risk management and internal controls are working as intended. The work is demanding because auditors must convert broad business risks into clear engagement objectives, test controls using reliable evidence, assess exceptions fairly and communicate findings that senior management and audit committees can act on. Weak planning, poorly documented testing or vague recommendations can reduce confidence in the audit function and leave significant risks unresolved.

This course develops the practical methods used to plan and deliver risk-based internal audit engagements. Participants work through the Global Internal Audit Standards, the Three Lines Model, COSO Internal Control and COSO ERM. They learn to build an audit universe, assess risks, prepare risk and control matrices, document walkthroughs, evaluate control design and operating effectiveness, select samples, assess evidence, investigate exceptions and write well-supported findings. The course also covers fraud indicators, data analytics tests, audit reporting, action tracking and quality assurance.

Teaching combines concise instructor briefings with realistic cases from finance, procurement, payroll, information technology and operational processes. Participants analyse audit documentation, make evidence and sampling decisions, discuss findings with simulated process owners and prepare report content for executive audiences. They leave with a reusable internal audit engagement pack containing planning, testing, reporting and follow-up templates that can be adapted to their own audit methodology.

The course is suited to auditors who already understand business processes and need a structured approach to conducting assignments from scoping through follow-up. It is also relevant to risk, compliance, finance and control professionals who contribute to assurance work or respond to internal audit reviews.

What you will be able to do

  • Apply the Global Internal Audit Standards to audit mandates, independence and engagement delivery
  • Construct a risk-based audit universe and annual audit plan
  • Develop risk and control matrices from process objectives, risks and controls
  • Evaluate control design and operating effectiveness through walkthroughs and testing
  • Select and document evidence using inspection, inquiry, observation and sampling methods
  • Assess audit exceptions using root cause analysis and consistent risk ratings
  • Draft audit findings, recommendations and executive reports supported by evidence
  • Design action follow-up and quality assurance procedures for completed engagements

Benefits of attending

For you

  • Produce defensible audit workpapers with clear evidence and review trails
  • Scope assignments using risk assessments rather than broad process checklists
  • Identify control weaknesses and distinguish design failures from operating failures
  • Write findings that explain risk, root cause, accountability and corrective action
  • Contribute more effectively to audit committee and management reporting

For your organisation

  • Improves consistency of audit planning, fieldwork documentation and reporting
  • Focuses audit resources on material risks and inadequate control coverage
  • Produces clearer recommendations with accountable owners and target dates
  • Strengthens follow-up on overdue actions and recurring control failures
  • Supports audit quality assurance against recognised internal audit standards

Course modules

10 modules over 5 days

Participants can define internal audit authority, independence and responsibilities under recognised professional standards.

  • Purpose, authority and independence under the Global Internal Audit Standards
  • Three Lines Model roles for governing bodies, management and internal audit
  • Internal audit charter contents: mandate, access rights, accountability and quality commitments
  • Code of Ethics principles: integrity, objectivity, competency, confidentiality and due professional care
  • Assurance and advisory assignments distinguished without assuming management responsibility
  • Board, audit committee and executive management reporting relationships defined

Participants can create a risk-based audit plan that prioritises assurance work against organisational objectives.

  • Enterprise objectives translated into auditable entities, processes, systems and projects
  • Risk universe construction using COSO ERM categories and business drivers
  • Inherent risk, residual risk and control maturity scored consistently
  • Annual audit plan prioritised through impact, likelihood, velocity and assurance coverage
  • Engagement objectives aligned with strategic risks, regulations and stakeholder concerns
  • Audit committee approval, plan communication and resource assumptions documented

Participants can scope an audit engagement and prepare a risk-based work programme.

  • Preliminary survey methods: document review, walkthroughs, interviews and process observation
  • Scope boundaries, audit criteria and period coverage specified precisely
  • Process maps identify handoffs, systems, records and control points
  • Risk and control matrix links objectives, risks, controls and tests
  • Fraud risks assessed using incentive, opportunity and rationalisation indicators
  • Engagement work programme sequences procedures, owners, timing and review points

Participants can assess whether key controls are suitably designed to address identified risks.

  • Preventive, detective and corrective controls matched to stated risks
  • Control design assessed against COSO principles and process objectives
  • Walkthroughs trace transactions from initiation through recording, approval and reporting
  • Segregation of duties conflicts identified using role and access matrices
  • Information technology general controls cover access, changes, operations and recovery
  • Key controls distinguished from supporting activities using failure consequences

Participants can collect, evaluate and document sufficient audit evidence using appropriate test methods.

  • Audit evidence evaluated for sufficiency, reliability, relevance and source independence
  • Inspection, observation, inquiry, confirmation and recalculation applied appropriately
  • Attribute sampling plans define population, deviation rate and sample size
  • Judgmental sampling targets unusual, high value and high risk items
  • Working papers record procedures, evidence, exceptions, conclusions and reviewer sign off
  • Electronic audit files preserve traceability, version control and retention requirements

Participants can use audit analytics and fraud indicators to target testing and investigate exceptions.

  • Data analytics tests identify duplicates, gaps, outliers and threshold splitting
  • Benford's Law used cautiously to screen large transactional populations
  • Continuous auditing indicators monitor recurring control failures and emerging risks
  • Fraud red flags assessed across procurement, payroll, expenses and revenue
  • Exception investigation separates data errors, control breaches and suspected misconduct
  • Digital evidence handling preserves access logs, metadata and chain of custody

Participants can develop evidence-based findings and practical recommendations that address root causes.

  • Condition, criteria, cause, consequence and corrective action structure findings
  • Root cause analysis uses five whys, fishbone diagrams and process evidence
  • Risk ratings combine impact, likelihood, control failure and urgency
  • Recommendations address root causes with accountable owners and due dates
  • Management responses tested for feasibility, ownership and residual risk acceptance
  • Finding language distinguishes facts, professional judgement and unverified allegations

Participants can prepare concise audit reports and communicate material issues to senior stakeholders.

  • Audit reports communicate objectives, scope, opinion, findings and agreed actions
  • Executive summaries prioritise material risks, themes and required decisions
  • Rating scales applied consistently with documented thresholds and escalation rules
  • Closing meetings resolve factual accuracy, action ownership and target dates
  • Audit committee reporting highlights thematic issues, overdue actions and emerging risks
  • Clear writing techniques remove ambiguity, unsupported claims and unnecessary detail

Participants can monitor corrective actions and apply quality controls to internal audit work.

  • Action tracking validates implementation, evidence quality and effective risk reduction
  • Follow up testing distinguishes completed actions from operating controls
  • Quality assurance improvement programme covers internal assessments and external assessments
  • Engagement supervision documents review notes, coaching and issue resolution
  • Performance measures track plan delivery, cycle time, findings and stakeholder feedback
  • Independence safeguards applied when auditors review prior advisory work

Participants can organise a complete audit workflow and prepare an application plan for their work.

  • End to end audit workflow connects planning, testing, reporting and follow up
  • Stakeholder communications tailored for audit committees, executives and process owners
  • Resource budgets estimate hours, specialist needs, travel and technology costs
  • Audit file review identifies gaps before report issuance and quality signoff
  • Personal application plan defines priority audits, stakeholders and first actions
  • Professional judgement documented when evidence is incomplete or conclusions contested

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Risk-based annual audit plan template
  2. Audit universe and risk scoring model
  3. Risk and control matrix template
  4. Audit work programme and workpaper checklist
  5. Finding and recommendation writing template
  6. Corrective action follow-up tracker

Who should attend

  • Internal Auditors — need consistent methods for planning, testing and reporting engagements
  • Senior Internal Auditors — need stronger judgement for complex findings and engagement supervision
  • Risk Managers — need to align risk registers and assurance priorities
  • Compliance Officers — need to assess control evidence and respond to audit reviews
  • Finance Managers — need to understand audit testing of financial and operational controls
  • Operational Control Owners — need to prepare for audits and address corrective actions

Skills and tools covered

Risk-based audit planningControl testingAudit evidence evaluationSampling methodologyAudit report writingAction follow-up

Tools and standards

Global Internal Audit Standards, IIA Three Lines Model, COSO Internal Control—Integrated Framework, COSO Enterprise Risk Management Framework

How the course runs

Training methodology

The instructor uses short briefings to introduce standards, methods and decision criteria, followed by case work based on common audit assignments. Participants analyse process maps, risk registers, control evidence, exception reports and draft findings in small groups. Simulated discussions with process owners develop interviewing, challenge and closing-meeting skills. Facilitated reviews compare alternative audit judgements and reporting approaches. Each participant develops an application plan and adapts course templates to a current or planned audit assignment.

Requirements and prerequisites

Participants should understand basic business processes, financial records and internal control concepts, gained through work in audit, finance, risk, compliance, operations or information technology. Experience of supporting an audit, preparing control evidence or responding to audit requests is helpful. Participants should be comfortable reading policies, process documents and transaction reports. Prior internal audit certification, formal accounting qualifications, advanced statistical knowledge and previous use of audit management software are not required. The course does not assume expertise in a particular industry.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

You should understand basic business processes, records and internal controls, preferably through audit, finance, risk, compliance or operational work. Previous internal audit training or a professional qualification is not required.

Bring a laptop if possible, as this will help you adapt planning and reporting templates. You may also bring a current audit charter, risk register or anonymised audit documentation for use during application planning.

It is designed for internal auditors and senior auditors who conduct or support assurance engagements. Risk, compliance, finance and operational control professionals will also benefit if they work closely with internal audit.

External audit focuses primarily on financial statement assurance, while this course addresses governance, risk management and controls across financial, operational and technology processes. It concentrates on the internal audit engagement lifecycle, from planning through corrective-action follow-up.

You can use the risk scoring model, risk and control matrix, work programme, finding template and action tracker on current assignments. The methods also help process owners prepare stronger evidence and corrective action responses.

Each day runs from 08:30 to 16:30 and provides about 6.5 contact hours. Time is divided among instructor briefings, case analysis, group work, simulated audit discussions and application planning across the ten modules.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

More courses in Auditing

Auditing Internal Audit Planning and Execution Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Internal Audit Report Writing Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Internal Audit Standards and Practice Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Internal Audit in Banking Training Course 5 days · from USD 1,100 · next 16 Nov Auditing International Standards on Auditing Application Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Modern Internal Auditing Practices Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Oil and Gas Revenue Auditing Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Organisational Culture Auditing Training Course 5 days · from USD 1,100 · next 16 Nov