Legal Compliance Auditing Training Course

Duration 10 days 18 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Compliance Managers, Internal Auditors and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 9 Nov 2026 Course code SD-L-034

Before you join: Participants should have practical familiarity with organisational policies, legal obligations, regulatory requirements, internal controls, risk registers, or assurance activities.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Legal compliance failures often arise from fragmented obligation registers, unclear ownership, weak evidence, and audit programmes that test policies rather than actual conduct. A legal compliance audit provides decision-makers with a disciplined assessment of whether applicable laws, licences, contractual duties, and regulatory requirements have been identified, assigned, controlled, monitored, and evidenced. It also distinguishes isolated control failures from systemic weaknesses requiring management action.

This course teaches participants to plan and conduct legal and regulatory compliance assessments using risk-based audit principles. Participants map legal obligations, define audit scope, assess compliance risks, test controls, collect defensible evidence, interview control owners, rate findings, and report conclusions. The programme addresses audit planning, sampling, document review, site inspection, management interviews, root-cause analysis, corrective action tracking, and follow-up assurance. It uses ISO 37301, ISO 19011, the COSO Internal Control Framework, and the Three Lines Model as practical reference points.

Teaching combines focused instructor briefings with realistic cases involving regulated financial services, public procurement, environmental permits, data protection, labour obligations, and anti-bribery controls. Participants progressively build an audit file during the first week, then deepen testing, reporting, remediation, and governance work during the second week. They leave with a reusable legal compliance audit package: scope statement, obligation register, risk assessment, audit programme, evidence plan, findings report, and corrective action tracker.

The course suits legal, compliance, internal audit, risk, governance, operational assurance, and regulatory affairs professionals who already work with policies, controls, legal obligations, or assurance reviews. It is particularly relevant for staff expected to assess compliance independently, support external inspections, or improve the quality of internal compliance reporting.

What you will be able to do

  • Define a risk-based legal compliance audit scope, mandate and audit criteria
  • Build an obligation register linking laws, regulations, licences and contractual duties to owners
  • Assess compliance risks using inherent risk, control effectiveness and residual risk ratings
  • Design an audit programme using control objectives, test procedures, sampling and evidence requirements
  • Conduct document reviews, interviews, walkthroughs and site inspections against defined audit criteria
  • Evaluate control design and operating effectiveness using evidence-based testing methods
  • Write graded audit findings with root causes, consequences, recommendations and management actions
  • Present a complete legal compliance audit report and corrective action follow-up plan

Benefits of attending

For you

  • Confidence to plan and lead risk-based legal compliance audits
  • A repeatable method for converting legal duties into audit tests
  • Stronger evidence collection and interview skills during compliance reviews
  • Clearer audit reporting for senior management, boards and regulators
  • A completed legal compliance audit file for workplace adaptation

For your organisation

  • Earlier identification of unowned legal and regulatory obligations
  • More consistent testing of compliance controls across business units
  • Better evidence for regulatory inspections, licence reviews and board reporting
  • Clearer remediation priorities based on risk, root cause and accountability
  • Reduced duplication between legal, compliance, risk and internal audit teams

Course modules

18 modules over 10 days

Participants can define the purpose, authority, scope and assurance boundaries of a legal compliance audit.

  • Purpose, authority and boundaries of a legal compliance audit
  • Distinguishing legal compliance audits from financial, operational and certification audits
  • Assurance objectives framed through obligations, controls, evidence and conclusions
  • Independence, objectivity, confidentiality and professional scepticism in audit assignments
  • Audit charters defining mandate, reporting lines, access rights and escalation
  • Risk appetite statements translated into audit priorities and tolerable exposure

Participants can build an auditable register of applicable legal and regulatory obligations.

  • Sources of obligations: statutes, regulations, licences, contracts and codes
  • Legal horizon scanning for proposed rules and emerging obligations
  • Obligation registers linking requirements, owners, controls, evidence and review dates
  • Applicability assessments for entities, sites, products, activities and jurisdictions
  • Primary legal duties separated from voluntary commitments and internal policies
  • Version control for legislation, permits, regulatory guidance and contractual clauses

Participants can assess whether governance arrangements assign and oversee legal compliance responsibilities.

  • Board oversight responsibilities for legal compliance, conduct and regulatory exposure
  • Three Lines Model roles across management, compliance and internal audit
  • RACI matrices assigning obligation ownership, monitoring and escalation duties
  • Delegations of authority tested against statutory and regulatory accountabilities
  • Compliance committee terms of reference, agendas, minutes and action tracking
  • Escalation thresholds for breaches, incidents, investigations and regulator notifications

Participants can assess inherent, control and residual compliance risks using consistent criteria.

  • Inherent risk ratings based on legal exposure, impact and likelihood
  • Control effectiveness assessments separating design adequacy from operating performance
  • Residual risk calculations using documented rating criteria and management judgment
  • Risk and control matrices linking obligations, risks, controls and evidence
  • Materiality thresholds for prioritising audit coverage and reporting significant findings
  • Compliance risk indicators drawn from incidents, complaints, breaches and exceptions

Participants can establish precise audit scopes, criteria, exclusions and reporting expectations.

  • Scope statements defining entities, processes, locations, periods and legal domains
  • Audit criteria drawn from legal requirements, licences, contracts and policies
  • Exclusions documented with rationale, residual exposure and approval authority
  • Scoping interviews identifying significant changes, incidents and regulatory attention
  • Process maps tracing obligations through activities, decisions, records and approvals
  • Material compliance themes converted into focused audit objectives and questions

Participants can prepare a risk-based audit plan with objectives, resources, milestones and evidence needs.

  • Annual audit plans prioritised through residual risk and assurance coverage
  • Engagement planning memoranda documenting objectives, scope, criteria and resources
  • Audit budgets estimating hours for planning, fieldwork, reporting and follow-up
  • Milestone plans scheduling document requests, interviews, testing and closing meetings
  • Preliminary analytics identifying high-risk populations and unusual compliance patterns
  • Stakeholder communication plans managing access, expectations, confidentiality and escalation

Participants can design audit programmes that test legal compliance controls against stated criteria.

  • Control objectives expressed as measurable conditions for legal compliance
  • Test procedures specifying population, sample, evidence, evaluator and conclusion
  • Design-effectiveness testing for policy requirements, approvals and segregation controls
  • Operating-effectiveness testing through transactions, records, observations and reperformance
  • Positive and negative testing for mandatory actions and prohibited conduct
  • Audit programme steps linked directly to risks, controls and legal criteria

Participants can collect, evaluate and document sufficient appropriate audit evidence.

  • Evidence reliability assessed by source independence, relevance, timeliness and authenticity
  • Working papers documenting procedures performed, evidence reviewed and conclusions reached
  • Document requests structured by audit objective, owner, format and deadline
  • Chain of custody practices for sensitive records, screenshots and investigation materials
  • Corroboration techniques comparing records, interviews, observations and system extracts
  • Evidence gaps escalated through additional testing, management representation or limitation statements

Participants can obtain reliable evidence through interviews, process walkthroughs and physical inspections.

  • Interview plans separating factual inquiry, control challenge and corroboration questions
  • Open, probing and closed questions used to test control operation
  • Walkthroughs tracing a compliance obligation from trigger through retained evidence
  • Site inspections checking permits, notices, records, storage and operational conditions
  • Interview notes recording statements, documents cited, exceptions and follow-up actions
  • Contradictory evidence resolved through corroboration, retesting and documented professional judgment

Participants can select defensible samples and use data analysis to target compliance testing.

  • Population definition before selecting samples for legal compliance testing
  • Judgmental sampling based on risk, value, exception history and change
  • Random and systematic sampling methods for repeatable transaction testing
  • Attribute sampling for testing control operation across defined populations
  • Data analytics identifying missing approvals, expired licences and unusual patterns
  • Sample results evaluated against tolerable deviation rates and audit objectives

Participants can determine whether controls are suitably designed and operating as intended.

  • Control design assessed against obligation requirements, risks and failure modes
  • Preventive, detective and corrective controls classified within compliance processes
  • Control dependency analysis identifying systems, people, approvals and external providers
  • Compensating controls evaluated for reliability, timeliness and documented operation
  • Exceptions aggregated to determine isolated errors or systemic control failure
  • Audit conclusions aligned with tested criteria, evidence quality and residual risk

Participants can adapt audit methods to common high-risk legal and regulatory subject areas.

  • Anti-bribery controls tested against gifts, intermediaries, approvals and due diligence
  • Data protection obligations tested through lawful basis, retention and breach handling
  • Labour compliance reviews covering working time, payroll records and worker status
  • Environmental permit audits examining conditions, monitoring records and incident reporting
  • Public procurement reviews testing competition, conflicts, evaluation and contract variations
  • Financial crime controls assessed through customer due diligence and suspicious activity escalation

Participants can classify compliance failures and identify causes requiring corrective action.

  • Nonconformities classified by legal breach, control failure, evidence gap or improvement opportunity
  • Five Whys analysis tracing immediate failures to underlying process causes
  • Fishbone diagrams examining people, process, technology, governance and external factors
  • Repeat findings analysed for ineffective remediation, ownership gaps and weak monitoring
  • Breach significance assessed through legal consequences, customer impact and regulatory exposure
  • Incident reporting duties distinguished from internal escalation and voluntary disclosure decisions

Participants can write clear, evidence-based findings and proportionate recommendations.

  • Finding statements structured through criteria, condition, cause, consequence and recommendation
  • Criteria cited precisely from laws, licences, contracts, policies and procedures
  • Condition evidence quantified through samples, dates, records and observed exceptions
  • Root causes distinguished from symptoms, contributing factors and management assertions
  • Recommendations matched to control failures, ownership, deadlines and required resources
  • Finding ratings calibrated through consequence, likelihood, legal urgency and recurrence

Participants can prepare audit reports that support informed management and board decisions.

  • Executive summaries presenting assurance conclusions, major risks and required decisions
  • Audit reports separating scope limitations, findings, recommendations and agreed actions
  • Heat maps displaying residual risk, finding ratings and remediation status
  • Management responses assessed for ownership, feasibility, timing and risk acceptance
  • Board reporting focused on significant exposures, trends and overdue actions
  • Closing meetings confirming factual accuracy, disputed points and next steps

Participants can track corrective actions and verify whether remediation has addressed identified risks.

  • Corrective action plans assigning actions, owners, milestones and evidence requirements
  • SMART actions written with specific outcomes, deadlines and accountable executives
  • Remediation risk assessments identifying temporary controls and residual exposure
  • Follow-up testing verifying implementation, operating effectiveness and sustained compliance
  • Overdue actions escalated through governance forums and documented risk acceptance
  • Closure criteria requiring evidence, retesting results and management confirmation

Participants can assess and improve the quality, consistency and defensibility of audit work.

  • ISO 19011 principles applied to audit planning, evidence and reporting
  • Quality reviews checking scope alignment, evidence sufficiency and conclusion logic
  • Working paper review notes documenting challenge, correction and approval
  • Audit file retention schedules addressing legal privilege, confidentiality and records requirements
  • Post-audit reviews capturing lessons, methodology changes and recurring control themes
  • Performance measures tracking cycle time, finding quality and action closure

Participants can build, review and present a complete risk-based legal compliance audit file for a defined business area.

  • Audit scope and criteria finalised from a defined regulatory scenario
  • Obligation register completed with owners, controls, evidence and review dates
  • Risk and control matrix prioritising material legal compliance exposures
  • Audit programme designed with test steps, sampling and evidence requirements
  • Findings report drafted using criteria, condition, cause, consequence and recommendations
  • Corrective action tracker presented with owners, deadlines, verification and escalation
  • Peer review challenges evidence sufficiency, ratings, conclusions and management messaging

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Legal obligation register template
  2. Risk and control matrix
  3. Risk-based audit programme template
  4. Compliance audit working paper pack
  5. Audit finding and report template
  6. Corrective action follow-up tracker

Who should attend

  • Compliance Managers — responsible for monitoring legal and regulatory obligations
  • Internal Auditors — conducting assurance reviews of compliance controls
  • Legal Counsel — translating legal duties into measurable control requirements
  • Risk Managers — assessing regulatory exposure and control weaknesses
  • Governance Officers — supporting board oversight and compliance reporting
  • Operational Managers — accountable for implementing legal and licence requirements

Skills and tools covered

Legal obligation mappingRisk-based auditingControl testingAudit evidence evaluationFindings reportingCorrective action tracking

Tools and standards

ISO 37301 Compliance Management Systems, ISO 19011 Guidelines for Auditing Management Systems, COSO Internal Control Framework, Three Lines Model

How the course runs

Training methodology

The programme uses short instructor briefings followed by structured case work, group exercises, audit simulations, and individual application planning. Participants work through a continuing compliance audit case, moving from scope and obligation mapping to testing, findings, remediation, and reporting. They review sample policies, registers, permits, contracts, interview notes, and control evidence. Facilitated peer review helps participants compare audit judgments, evidence sufficiency, risk ratings, and report wording before adapting the methods to their own workplace.

Requirements and prerequisites

Participants should have practical familiarity with organisational policies, legal obligations, regulatory requirements, internal controls, risk registers, or assurance activities. Experience in compliance, legal, internal audit, risk, governance, quality, operations, or regulatory affairs is useful. Participants should be able to read policies, procedures, contracts, regulations, and management reports critically. Prior audit qualifications, legal degrees, accounting expertise, or knowledge of a particular jurisdiction are not required. The course explains core audit concepts before applying them to legal compliance assessments.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

You should understand how policies, procedures, legal duties, controls, or risk registers are used at work. Previous audit training or a law degree is not required.

Bring a laptop if possible and, where confidentiality permits, a redacted policy, compliance register, audit report, or control issue from your organisation. Course materials and case documents are provided.

It is designed for compliance, legal, internal audit, risk, governance, regulatory affairs, and operational assurance professionals. Managers responsible for permits, regulated processes, or corrective actions will also benefit.

General internal audit courses cover broad assurance methods across financial, operational, and strategic areas. This course applies those methods specifically to laws, regulations, licences, contractual duties, legal evidence, and regulatory reporting.

Participants build a reusable audit package containing an obligation register, risk assessment, audit programme, evidence plan, findings format, and action tracker. These can be adapted for a live compliance review after the course.

Each day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The first week builds audit planning, obligation mapping, risk assessment, and testing methods; the second week focuses on findings, reporting, remediation, quality review, and the capstone audit file.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Legal