Modern Internal Auditing Practices Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Internal Auditors, Senior Internal Auditors and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-A-126

Before you join: Participants should have basic familiarity with business processes, internal controls, financial reporting or risk management.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Internal audit functions are expected to provide independent assurance while helping boards and management understand whether material risks, controls and governance arrangements are working. That requires more than checking compliance or producing long issue lists. Auditors must plan from risk appetite and strategic objectives, assess control design and operating effectiveness, use reliable evidence, communicate findings proportionately, and follow corrective action through to closure. They must also address technology, fraud, third-party and change risks without taking management responsibility.

This course develops the methods used to run and deliver modern, risk-based internal audits. Participants work through the International Professional Practices Framework, the IIA Global Internal Audit Standards, the Three Lines Model, COSO frameworks and practical engagement techniques. They learn to build an audit universe, prepare risk assessments and audit plans, scope engagements, test controls, document evidence, use data analytics, report findings and maintain quality assurance. Attention is given to assurance over governance, risk management, financial controls, operational processes, information systems and outsourced activities.

Teaching combines concise instructor briefings with sector-based cases, team analysis, audit simulations and structured peer review. Cases can be adapted to banking, public sector, NGO, manufacturing, energy or multinational corporate contexts. Participants leave with a reusable internal audit toolkit including an audit universe model, risk assessment matrix, engagement planning documents, testing templates, finding-rating criteria and a personal implementation plan. The five-day instructor-led course is available in classrooms in more than 50 cities or live online, runs from 08:30 to 16:30 each day, and includes a certificate of completion.

The course is intended for internal auditors and assurance professionals who already understand basic business processes and now need a disciplined, standards-aligned approach to planning and conducting risk-based audits.

What you will be able to do

  • Apply the IIA Global Internal Audit Standards to audit planning and engagement delivery
  • Construct a risk-based audit universe and annual audit plan
  • Assess governance, risk management and internal control using COSO criteria
  • Define audit scopes, objectives and test procedures from risk statements
  • Evaluate control design and operating effectiveness using documented evidence
  • Perform basic audit data analytics to identify exceptions and unusual transactions
  • Write risk-rated audit findings with practical root-cause and action analysis
  • Develop a quality assurance and improvement plan for internal audit work

Benefits of attending

For you

  • Produce defensible risk-based audit plans and engagement scopes
  • Test controls with clearer criteria, evidence and workpaper documentation
  • Write concise findings that prompt accountable management action
  • Use audit analytics to investigate exceptions beyond sample-based testing
  • Prepare for expanded internal audit responsibilities and supervisory assignments

For your organisation

  • Improves alignment between audit coverage, strategic risks and board priorities
  • Produces more consistent control testing and evidence retention
  • Raises the quality and actionability of audit reports
  • Identifies control failures, fraud indicators and process inefficiencies earlier
  • Supports a documented quality assurance and improvement programme

Course modules

10 modules over 5 days

Participants can position internal audit responsibilities, authority and independence against recognised professional standards.

  • IIA Global Internal Audit Standards structure, purpose and mandatory requirements
  • Internal audit charter provisions for purpose, authority and responsibility
  • Board, audit committee and chief audit executive accountabilities
  • Three Lines Model roles between management, risk and assurance
  • Independence threats arising from consulting, reporting lines and conflicted work
  • Objectivity safeguards, disclosure requirements and engagement acceptance decisions

Participants can build a defensible audit universe and prioritised annual audit plan.

  • Audit universe construction from entities, processes, systems and strategic programmes
  • Risk appetite statements translated into auditable risk themes
  • Inherent and residual risk scoring using defined assessment criteria
  • COSO ERM components connected to audit planning decisions
  • Assurance mapping identifies overlaps, gaps and reliance opportunities
  • Annual audit plan balances risk coverage, resources and mandated reviews

Participants can assess governance, risk management and control arrangements using structured criteria.

  • COSO Internal Control components assessed through process-level control attributes
  • Governance arrangements tested against oversight, accountability and escalation criteria
  • Risk management maturity assessed through identification, ownership and monitoring
  • Control objectives linked directly to material risk statements
  • Preventive, detective, corrective and directive controls distinguished accurately
  • Entity-level controls considered before detailed process testing

Participants can translate risk assessments into focused audit objectives, scope and test programmes.

  • Preliminary surveys gather process context, stakeholders and known risk events
  • Audit objectives framed around risks, controls and assurance questions
  • Scope boundaries define locations, periods, systems and exclusions
  • Criteria sources include policies, regulations, contracts and performance targets
  • Risk-control matrices connect risks, control objectives and testing procedures
  • Sampling approaches selected for population characteristics and assurance needs

Participants can obtain, evaluate and document sufficient evidence for audit conclusions.

  • Evidence reliability assessed by source, timeliness, completeness and corroboration
  • Walkthroughs confirm process understanding and identify key control points
  • Design effectiveness testing examines whether controls address stated risks
  • Operating effectiveness testing verifies consistent control performance over time
  • Inspection, observation, inquiry and reperformance applied appropriately
  • Workpapers document procedures, populations, samples, evidence and conclusions

Participants can specify and interpret basic audit analytics for risk-focused testing.

  • Data request specifications define fields, periods, sources and ownership
  • Completeness checks reconcile source extracts to control totals
  • Duplicate payment tests identify repeated suppliers, invoices and amounts
  • Exception analysis flags unusual journals, threshold breaches and weekend transactions
  • Benford's Law used cautiously as an initial anomaly indicator
  • Visualisations communicate trends, outliers and control-break patterns clearly

Participants can develop evidence-based findings and reports that support timely management action.

  • Condition, criteria, cause, consequence and action structure audit findings
  • Five Whys analysis distinguishes root causes from immediate errors
  • Finding ratings reflect impact, likelihood, control failure and urgency
  • Management responses tested for ownership, feasibility and target dates
  • Executive summaries present material messages without operational detail overload
  • Closing meetings validate facts while preserving auditor independence

Participants can incorporate specialist risk considerations into routine internal audit engagements.

  • Fraud risk indicators assessed through incentives, opportunities and rationalisation
  • Segregation-of-duties conflicts identified within finance and procurement workflows
  • IT general controls cover access, change management, operations and backups
  • Cybersecurity assurance considers identity controls, monitoring and incident response
  • Third-party due diligence reviews ownership, sanctions, performance and data protection
  • Business continuity controls tested against recovery objectives and crisis roles

Participants can establish quality controls and follow-up processes for sustained audit performance.

  • Quality assurance and improvement programme requirements under IIA Standards
  • Engagement supervision reviews planning, evidence, judgement and reporting quality
  • Internal assessments use file reviews, performance metrics and stakeholder feedback
  • External quality assessments consider conformance and improvement recommendations
  • Issue follow-up verifies action completion and residual risk acceptance
  • Audit committee reporting tracks themes, overdue actions and plan delivery

Participants can prepare a practical plan for improving their next audit engagement.

  • Current audit practices benchmarked against priority standards and risk needs
  • Stakeholder mapping clarifies expectations from boards, management and regulators
  • Engagement planning decisions documented for a selected audit area
  • Control-testing improvements prioritised by risk, effort and evidence quality
  • Reporting changes targeted at clearer accountability and faster remediation
  • Ninety-day application plan assigns actions, milestones and review points

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Risk-based audit universe template
  2. Annual audit planning matrix
  3. Risk-control matrix template
  4. Control testing workpaper checklist
  5. Audit finding and rating model
  6. Ninety-day internal audit application plan

Who should attend

  • Internal Auditors — to plan and deliver risk-based assurance engagements
  • Senior Internal Auditors — to lead engagements and review audit workpapers
  • Internal Audit Managers — to strengthen planning, reporting and quality processes
  • Risk and Compliance Officers — to coordinate assurance activities without compromising independence
  • Finance Controllers — to understand audit expectations for financial and operational controls
  • External Audit Professionals — to broaden assurance skills for internal audit assignments

Skills and tools covered

Risk-based audit planningControl effectiveness testingAudit evidence evaluationData analyticsAudit report writingQuality assurance

Tools and standards

IIA Global Internal Audit Standards, IIA Three Lines Model, COSO Internal Control—Integrated Framework, COSO Enterprise Risk Management Framework

How the course runs

Training methodology

The course uses short briefings to establish standards, frameworks and audit terminology, followed by facilitated case work based on realistic audit assignments. Participants analyse risk registers, process maps, control evidence, transaction data and draft audit reports in small groups. Simulations cover planning meetings, control testing, issue validation and closing discussions with management. Instructor feedback focuses on judgement, documentation quality, independence and proportionality. Each participant completes structured application planning for their own audit portfolio or upcoming engagement.

Requirements and prerequisites

Participants should have basic familiarity with business processes, internal controls, financial reporting or risk management. Six months or more of experience in internal audit, external audit, compliance, finance, operations or assurance is useful. Participants should be able to read process documents, follow a simple risk assessment and interpret basic financial or operational data. Prior knowledge of the IIA Global Internal Audit Standards, COSO frameworks, audit software or data analytics is not required. This course does not assume an accounting qualification or advanced statistical skills.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should understand basic business processes, controls, risks or financial information. Prior internal audit experience is helpful but not essential; no audit certification or advanced analytics background is required.

Bring a laptop for live online delivery and, where permitted, an anonymised example of an upcoming audit area, risk register or process map. Course materials and templates are provided.

The course is designed for internal auditors, audit managers, compliance professionals, risk specialists and finance staff with assurance responsibilities. It is particularly useful for people moving from checklist-led reviews to risk-based auditing.

External audit training focuses on audit opinions over financial statements and applicable auditing standards. This course focuses on internal audit's broader assurance remit across governance, risk management, operations, controls, technology and corrective action.

Participants can use the provided templates to revise an audit universe, scope a planned engagement, document control testing or improve audit finding reports. The final application plan identifies actions for the first 90 days after the course.

Each day runs from 08:30 to 16:30 and provides about 6.5 contact hours. Time is divided between instructor input, case analysis, group work, audit simulations, feedback and application planning.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

More courses in Auditing

Auditing Internal Audit Report Writing Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Internal Audit Standards and Practice Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Internal Audit Training Course 5 days · from USD 1,100 · next 16 Nov Auditing International Standards on Auditing Application Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Oil and Gas Revenue Auditing Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Organisational Culture Auditing Training Course 5 days · from USD 1,100 · next 16 Nov Auditing Pension Fund Auditing and Compliance Training Course 10 days · from USD 2,200 · next 16 Nov Auditing Risk-Based Internal Audit in Banking Training Course 5 days · from USD 1,100 · next 16 Nov