Public Sector Internal Controls and Audit Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Internal Auditors, Audit Managers and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-GPS-093

Before you join: Participants should understand the basic purpose of public-sector financial management, procurement, programme delivery or audit.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Public bodies, development programmes and humanitarian operations manage public funds, donor resources, procurement commitments and service-delivery obligations under close scrutiny. Weak controls can result in ineligible expenditure, fraud, delayed projects, unreliable reporting, audit qualifications and loss of stakeholder trust. Internal auditors and control owners need a practical way to assess whether controls are properly designed, operating as intended and producing evidence that can withstand audit and oversight review.

This course applies the COSO Internal Control—Integrated Framework to public-sector governance, financial management, procurement, grants, payroll, assets, information systems and programme delivery. Participants examine the five COSO components, the Three Lines Model, risk-based audit planning, control design, walkthroughs, testing, sampling, evidence evaluation and audit reporting. They learn to distinguish control deficiencies from root causes, assess residual risk, develop practical recommendations and monitor management action plans. Public-sector cases address areas such as emergency procurement, social protection payments, donor-funded projects and revenue collection.

Teaching combines focused instructor briefings with guided case analysis, group control mapping, audit-file review, sampling decisions and report-writing practice. Participants apply course methods to a selected process from their own institution or programme. They leave with a reusable internal control assessment pack containing a process risk-and-control matrix, walkthrough checklist, audit test plan, deficiency-rating model and management action tracker. The course is suited to professionals who must provide assurance, own key controls or respond effectively to internal and external audit findings.

What you will be able to do

  • Apply the COSO Internal Control—Integrated Framework to public-sector processes
  • Map process risks, control objectives and control activities in a risk-and-control matrix
  • Assess control design and operating effectiveness using walkthroughs and evidence testing
  • Develop risk-based internal audit plans aligned with organisational objectives and risk appetite
  • Select audit samples using judgemental, random and systematic sampling approaches
  • Classify control deficiencies using likelihood, impact, root-cause and residual-risk analysis
  • Draft evidence-based audit findings, recommendations and management action plans
  • Monitor corrective actions through ownership, milestones, validation and escalation procedures

Benefits of attending

For you

  • Assess control weaknesses with a recognised COSO-based method
  • Produce clearer audit working papers and evidence trails
  • Challenge ineffective controls without confusing control ownership and audit independence
  • Write findings that identify root causes and practical corrective actions
  • Contribute credibly to audit committees, management reviews and donor assurance discussions

For your organisation

  • Improves consistency of internal control reviews across departments and programmes
  • Reduces exposure to ineligible expenditure, fraud and procurement irregularities
  • Strengthens evidence available for external audit, donor and oversight reviews
  • Produces more targeted audit plans focused on material public-sector risks
  • Improves closure rates and accountability for agreed audit actions

Course modules

10 modules over 5 days

Participants can explain how COSO principles support accountability, governance and internal control in public institutions.

  • Public accountability, stewardship and value-for-money obligations driving control design
  • COSO Internal Control—Integrated Framework principles interpreted for public authorities
  • Distinguishing governance, management controls, risk management and internal audit roles
  • Three Lines Model responsibilities for governing bodies and assurance providers
  • Mandates, delegations and regulations translated into control objectives
  • Public financial management cycles from budget approval through reporting
  • Ethics, integrity and public-interest requirements within control environments

Participants can assess whether governance structures and control environments support effective accountability.

  • Control environment factors: integrity, competence, authority and accountability
  • Audit committee mandates, composition, meeting agendas and information requirements
  • Delegation-of-authority matrices for commitments, payments and contract approvals
  • Segregation-of-duties analysis across initiation, approval, custody and recording
  • Conflict-of-interest declarations and related-party transaction control requirements
  • Whistleblowing channels, investigation protocols and protection against retaliation
  • Policy hierarchies linking legislation, regulations, procedures and operating instructions

Participants can identify, assess and prioritise risks before selecting proportionate controls.

  • Risk appetite statements connected to service delivery and fiduciary objectives
  • Risk-and-control matrices linking objectives, risks, controls and evidence
  • Inherent-risk assessment using likelihood, impact, velocity and vulnerability criteria
  • Residual-risk ratings after considering preventive, detective and corrective controls
  • Fraud risk assessment covering incentives, opportunities, rationalisation and concealment
  • Scenario analysis for funding cuts, emergencies, political interference and supply disruption
  • Control objectives for completeness, accuracy, validity, timeliness and safeguarding

Participants can evaluate financial controls across budgeting, expenditure, payroll and asset management.

  • Budget controls linking appropriations, commitments, obligations and cash releases
  • Payment controls using three-way matching, approval limits and supplier verification
  • Payroll reconciliations identifying ghost workers, duplicate records and unauthorised changes
  • Bank reconciliation procedures addressing timing differences, suspense items and exceptions
  • Fixed-asset registers supported by tagging, verification and disposal authorisation
  • Journal-entry controls addressing unusual postings, overrides and period-end adjustments
  • Revenue collection controls for billing, receipting, reconciliation and arrears monitoring

Participants can assess controls over purchasing, contracting, grants and implementing partners.

  • Procurement planning linked to approved budgets, specifications and market analysis
  • Tender evaluation controls protecting fairness, confidentiality and documented decisions
  • Emergency procurement exceptions supported by justification, approvals and retrospective review
  • Contract management controls for deliverables, variations, milestones and payment certification
  • Grant agreements defining eligibility, reporting, audit rights and recovery clauses
  • Implementing-partner due diligence covering capacity, sanctions and fiduciary controls
  • Donor compliance matrices tracking conditions, deadlines, evidence and responsible owners

Participants can assess information quality, reporting flows and key digital control points.

  • Information quality criteria: completeness, accuracy, timeliness, relevance and accessibility
  • Management reporting packs linking operational indicators, financial data and risk exceptions
  • User-access reviews applying least privilege, role profiles and periodic recertification
  • Change-management controls covering testing, approval, release and post-implementation review
  • Interface reconciliations between financial, payroll, procurement and programme systems
  • Data analytics flags for duplicates, split purchases, unusual vendors and override activity
  • Information escalation protocols for control breaches, fraud allegations and material losses

Participants can develop a risk-based audit plan and define auditable assignments.

  • Audit universe construction across entities, programmes, processes, systems and projects
  • Risk-based audit planning using impact, likelihood, control maturity and audit history
  • Annual audit plan prioritisation against strategic objectives and available resources
  • Engagement scoping through objectives, criteria, boundaries, timing and stakeholders
  • IIA Global Internal Audit Standards applied to independence and quality requirements
  • Audit programmes translating risks into procedures, evidence sources and test criteria
  • Fraud-sensitive audit planning for high-risk payments, procurement and beneficiary records

Participants can perform walkthroughs and test whether controls are designed and operating effectively.

  • Walkthroughs tracing one transaction from initiation through recording and reporting
  • Narrative process documentation identifying handoffs, systems, approvals and exceptions
  • Control design testing against stated risks, objectives and required evidence
  • Operating-effectiveness testing using inspection, observation, inquiry and reperformance
  • Audit evidence reliability assessed by source, independence, timeliness and corroboration
  • Test-of-one procedures confirming control operation before broader sample selection
  • Workpaper documentation linking procedures, evidence, conclusions and reviewer sign-off

Participants can select samples, evaluate exceptions and communicate well-supported audit findings.

  • Population definition, sampling units and completeness checks before sample selection
  • Judgemental sampling for high-value, unusual, sensitive and high-risk transactions
  • Random and systematic sampling methods for representative compliance testing
  • Exception evaluation distinguishing isolated errors, systemic failures and suspected fraud
  • Root-cause analysis using Five Whys, fishbone diagrams and process evidence
  • Finding structure: criteria, condition, cause, consequence and recommendation
  • Deficiency ratings based on residual risk, materiality, urgency and control failure
  • Exit-meeting techniques for agreeing facts, ownership and management responses

Participants can track audit actions, validate closure and plan improvements to their control assurance work.

  • Management action plans specifying owners, milestones, resources and target dates
  • Corrective-action tracking using status definitions, ageing analysis and escalation thresholds
  • Closure validation through evidence review, retesting and risk reassessment
  • Quality assurance reviews for audit files, supervision and reporting consistency
  • Repeat-finding analysis identifying persistent root causes and accountability failures
  • Audit committee reporting on significant deficiencies, overdue actions and thematic risks
  • Personal application plans for priority controls, audit assignments and stakeholder engagement

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. COSO-based public-sector control assessment template
  2. Process risk-and-control matrix
  3. Internal audit planning template
  4. Walkthrough and control-testing checklist
  5. Audit finding and deficiency-rating model
  6. Management action tracking dashboard

Who should attend

  • Internal Auditors — assess public-sector controls and report defensible findings
  • Audit Managers — supervise risk-based audits and assure audit quality
  • Finance Managers — strengthen budget, payment, reporting and asset controls
  • Programme Managers — manage delivery, donor compliance and implementing-partner risks
  • Procurement Officers — test tender, contract and emergency purchasing controls
  • Risk and Compliance Officers — coordinate control assurance and remedial action tracking

Skills and tools covered

COSO control assessmentRisk-based audit planningControl testingAudit evidence evaluationDeficiency reportingCorrective action monitoring

Tools and standards

COSO Internal Control—Integrated Framework, IIA Global Internal Audit Standards, IIA Three Lines Model, INTOSAI Framework of Professional Pronouncements

How the course runs

Training methodology

The course uses short instructor briefings to establish COSO concepts, public-sector accountability requirements and audit techniques. Participants work through public-sector cases involving procurement, payments, grants and programme controls. Small-group activities include process mapping, risk-and-control analysis, walkthrough planning, audit sampling, evidence evaluation and finding development. Simulated audit discussions test how conclusions are defended with management. Individual application planning helps participants adapt the templates to a priority process, audit universe or outstanding recommendation in their own organisation.

Requirements and prerequisites

Participants should understand the basic purpose of public-sector financial management, procurement, programme delivery or audit. Experience working with budgets, payments, contracts, grants, operational procedures, compliance reviews or audit recommendations is useful. Participants should be able to read process documents, financial reports and policy requirements, and should bring awareness of their institution's mandate and accountability arrangements. Prior knowledge of COSO, formal internal audit qualifications, statistical sampling, accounting standards or audit software is not required. The course introduces the relevant concepts before applying them to public-sector cases.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants need basic familiarity with public-sector operations, financial processes, procurement, programme delivery or assurance work. Prior COSO knowledge, audit certification and statistical sampling experience are not required.

Bring a current policy, process map, audit finding or control issue if organisational policy permits. Participants can use these materials during application planning, but confidential records should not be shared in class.

The course suits internal auditors, finance managers, procurement staff, programme managers, risk officers and compliance professionals in public bodies, development agencies and humanitarian organisations. It is intended for professionals with some workplace experience rather than new entrants.

This course concentrates on the COSO framework and public-sector control problems, including appropriations, grants, donor conditions, public procurement and accountability to oversight bodies. General audit concepts are taught only where they support control assessment and audit testing.

Participants can use the templates to assess a process, refresh an audit programme, test a key control or improve management action follow-up. The methods are applicable to financial, operational, procurement, grant and programme processes.

Each training day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The five days cover ten teaching modules, with time allocated to briefings, case work, group analysis, simulations and individual application planning.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

More courses in Government & Public Sector

Government & Public Sector Public Sector Governance and Budget Reform Training Course 10 days · from USD 2,200 · next 16 Nov Government & Public Sector Public Sector Governance and Fiscal Sustainability Training Course 5 days · from USD 1,100 · next 16 Nov Government & Public Sector Public Sector Governance and Risk Management Training Course 10 days · from USD 2,200 · next 16 Nov Government & Public Sector Public Sector Innovation and Smart Cities Training Course 10 days · from USD 2,200 · next 16 Nov Government & Public Sector Public Sector Performance Management Training Course 10 days · from USD 2,200 · next 16 Nov Government & Public Sector Public Sector Strategic Foresight Training Course 5 days · from USD 1,100 · next 16 Nov Government & Public Sector Public Sector Strategy Management Training Course 10 days · from USD 2,200 · next 16 Nov Government & Public Sector Public Trust and Accountability Training Course 5 days · from USD 1,100 · next 16 Nov