Risk-Based Internal Audit in Banking Training Course

Participants can construct an audit universe that captures material banking activities, risks and control domains.

• Audit universe structure by legal entity, business line and process
• Map retail, corporate, treasury and digital banking activities
• Include support functions, shared services and outsourced arrangements
• Link products, processes, systems and data to risk owners
• Define auditable entities at suitable planning and reporting levels
• Maintain audit universe changes following acquisitions, launches and restructures

Participants can assess and rank auditable entities using documented inherent and residual risk criteria.

• Inherent risk scoring before considering preventive and detective controls
• Residual risk assessment using control design and performance evidence
• Likelihood and impact scales for capital, earnings and customer harm
• COSO ERM risk appetite statements and audit prioritisation
• Risk indicators, loss events and regulatory findings as inputs
• Weight audit scores using judgement, data quality and management concerns

Participants can prepare a multi-year and annual audit plan supported by risk assessment results.

• Translate risk rankings into multi-year audit coverage requirements
• Set annual audit priorities using risk appetite and change programmes
• Determine audit frequency from residual risk and assurance reliance
• Allocate audit hours, specialist skills and contingency capacity
• Coordinate assurance maps with compliance, risk and external audit
• Document plan rationale for audit committee approval

Participants can define audit objectives, scope, criteria and work programmes for banking engagements.

• Engagement planning memorandum defining objectives, scope, timing and resources
• Process walkthroughs identifying risks, controls, systems and handoffs
• Risk-control matrices connecting objectives, risks, controls and tests
• Scope credit approval, collateral management and impairment governance
• Set audit criteria from policies, regulation and approved risk appetite
• Identify exclusions, dependencies and specialist review requirements

Participants can design and document proportionate tests of banking control design and operating effectiveness.

• Distinguish preventive, detective, corrective and compensating control types
• Test control design against stated risk and control objectives
• Select samples using population definition, risk factors and exceptions
• Inspect approvals, reconciliations, system logs and management information
• Reperform key controls to validate evidence and execution quality
• Document test procedures, evidence references and conclusions clearly

Participants can identify audit objectives and key controls for major banking risk domains.

• Credit underwriting controls, delegated authorities and covenant monitoring
• Treasury dealing limits, independent valuation and trade confirmation
• Liquidity risk reporting, stress testing and contingency funding controls
• Operational risk event capture, loss data and control self-assessments
• Conduct risk controls for product governance, sales and complaints
• Model risk governance covering validation, change control and use

Participants can plan assurance work over financial crime, regulatory compliance and technology-dependent controls.

• Customer due diligence, beneficial ownership and periodic review controls
• Sanctions screening alert disposition, escalation and quality assurance
• Transaction monitoring scenarios, investigations and suspicious activity reporting
• Regulatory reporting controls for accuracy, completeness and timely submission
• Access management, privileged accounts and segregation of duties
• Third-party risk assessments, service-level monitoring and exit arrangements

Participants can evaluate audit evidence and produce clear findings, ratings and assurance reports.

• Assess sufficiency, reliability, relevance and usefulness of audit evidence
• Differentiate isolated errors from systemic control deficiencies
• Root cause analysis using five whys and cause-and-effect diagrams
• Rate findings by impact, likelihood, regulatory exposure and control failure
• Write observations, risks, causes, actions and accountable owners
• Report balanced assurance conclusions without diluting material issues

Participants can monitor remediation, support audit quality and apply professional judgement consistently.

• Validate management action completion through evidence-based follow-up testing
• Escalate overdue high-risk actions through agreed governance routes
• Quality assurance reviews against IIA standards and audit methodology
• Challenge management representations while maintaining constructive professional relationships
• Use audit analytics carefully when data completeness remains uncertain
• Create a personal application plan for upcoming banking audit assignments