Risk-Based Internal Auditing Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Internal Auditors, Senior Internal Auditors and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 9 Nov 2026 Course code SD-A-083

Before you join: Participants should understand basic internal control concepts, business processes and the purpose of internal audit.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Risk-based internal auditing helps audit functions direct limited time and specialist resources toward the matters most likely to affect objectives, financial reporting, service delivery, regulatory compliance and stakeholder trust. A traditional cyclical audit plan can leave material risks insufficiently examined while low-value work absorbs the audit budget. Internal auditors need a repeatable basis for defining the audit universe, assessing inherent and residual risk, selecting engagements and reporting issues in terms decision-makers can act on.

This course develops the methods used to plan and deliver risk-based assurance work. Participants apply the IIA Global Internal Audit Standards, ISO 31000, COSO ERM and the COSO Internal Control—Integrated Framework to audit planning and individual engagements. They learn to build a risk universe, score and prioritise risks, develop a risk-based audit plan, define objectives and scope, prepare risk and control matrices, test controls, evaluate evidence, identify root causes and frame practical recommendations. The course also addresses fraud, third-party, technology and regulatory risks that commonly affect finance and operational processes.

Instruction combines focused briefings with case work, facilitated group analysis, audit-planning simulations and structured application planning. Cases reflect the types of decisions faced by audit teams in banks, government bodies, NGOs and multinational businesses. Participants leave with a practical risk-based audit toolkit containing reusable planning, assessment, testing and reporting templates. The course is delivered over five days in a classroom in 50+ cities or live online, with each participant receiving a certificate of completion.

It is particularly suited to internal auditors and audit managers who need to strengthen the link between enterprise risks, audit coverage and engagement-level work.

What you will be able to do

  • Construct an audit universe and risk assessment model for annual planning
  • Assess inherent and residual risks using defined likelihood and impact criteria
  • Develop a risk-based audit plan aligned with strategic objectives and risk appetite
  • Define engagement objectives, scope and criteria from documented risk scenarios
  • Prepare risk and control matrices linking risks, controls and audit procedures
  • Select testing approaches, samples and evidence appropriate to control risks
  • Evaluate audit findings through root-cause analysis and issue-rating methods
  • Produce action-focused audit reports and follow-up plans for management

Benefits of attending

For you

  • A defensible method for prioritising audit work against material risks
  • Greater confidence challenging risk ratings, controls and management responses
  • Reusable documentation for planning risk-based audit engagements
  • Stronger judgement when selecting tests, samples and audit evidence
  • Clearer reporting of root causes, consequences and corrective actions

For your organisation

  • Audit plans better aligned with strategic, financial and regulatory risk priorities
  • More consistent risk assessments across audit teams and business units
  • Earlier identification of control failures requiring management attention
  • Better-targeted audit testing and reduced work on lower-priority areas
  • More actionable findings and stronger follow-up of agreed actions

Course modules

10 modules over 5 days

Participants can explain how risk-based auditing directs assurance work toward priority risks.

  • Risk-based auditing principles under the IIA Global Internal Audit Standards
  • Three Lines Model roles for governing bodies, management and internal audit
  • Audit universe construction using entities, processes, systems, products and projects
  • Distinguishing assurance, advisory, investigation and compliance monitoring responsibilities
  • Independence, objectivity and due professional care in engagement decisions
  • Board and audit committee expectations for risk-based assurance coverage

Participants can use recognised risk and control frameworks to structure audit assessments.

  • ISO 31000 principles applied to risk identification and treatment decisions
  • COSO ERM components linking strategy, performance, risk and governance
  • COSO internal control components within process-level audit assessments
  • Risk appetite statements translated into audit planning criteria
  • Governance structures, delegated authorities and accountability for risk ownership
  • Control objectives distinguished from policies, procedures and operational activities

Participants can assess, score and prioritise auditable risks using documented criteria.

  • Inherent and residual risk ratings using likelihood and impact scales
  • Risk registers reviewed for causes, events, consequences and existing controls
  • Scoring criteria calibrated for financial, regulatory, operational and reputational impacts
  • Interviews and document review used to validate management risk assessments
  • Risk heat maps interpreted without overstating precision or certainty
  • Emerging risks identified through change initiatives, incidents and external developments

Participants can prepare a risk-based audit plan that balances coverage, resources and timing.

  • Annual audit plan priorities derived from risk assessment results
  • Coverage analysis identifying unaudited high-risk processes and risk concentrations
  • Engagement selection based on residual risk, change and control maturity
  • Resource estimates incorporating audit hours, specialist skills and timing constraints
  • Rolling audit plans updated for incidents, restructures and regulatory changes
  • Audit committee papers presenting rationale, coverage gaps and proposed priorities

Participants can translate priority risks into focused audit objectives, scope and procedures.

  • Engagement objectives framed around risk events and expected control outcomes
  • Scope boundaries defined by processes, locations, systems, periods and populations
  • Risk and control matrices linking objectives, risks, controls and tests
  • Walkthroughs used to confirm process flows and control points
  • Control design assessed against stated risk causes and consequences
  • Fraud risk factors incorporated into engagement planning and testing

Participants can select and document testing methods that produce sufficient appropriate evidence.

  • Tests of design distinguish intended controls from effective controls
  • Tests of operating effectiveness assess consistency across selected transactions
  • Sampling approaches selected using population characteristics, risk and materiality
  • Audit evidence evaluated for relevance, reliability, sufficiency and source independence
  • Data analytics procedures identify exceptions, outliers, duplicates and trend anomalies
  • Working papers document procedures, evidence, conclusions and reviewer sign-off

Participants can evaluate control deficiencies and form findings supported by evidence and risk analysis.

  • Control deficiencies classified by design failure, operating failure or absence
  • Five Whys analysis traces recurring issues to underlying causes
  • Fishbone diagrams separate people, process, technology and governance causes
  • Issue ratings determined through consequence, likelihood and control failure severity
  • Compensating controls assessed before concluding that residual risk remains unacceptable
  • Management responses evaluated for ownership, feasibility, timing and risk reduction

Participants can produce concise audit reports that support timely management decisions.

  • Executive summaries connect findings to objectives, risks and business consequences
  • Finding statements distinguish condition, criteria, cause, consequence and recommendation
  • SMART actions specify accountable owners, milestones, evidence and completion dates
  • Issue ratings explained using agreed methodology and supporting risk rationale
  • Draft reports discussed with management while preserving auditor independence
  • Audit committee reporting highlights themes, overdue actions and material exposures

Participants can incorporate common cross-functional risk areas into risk-based audit coverage.

  • Technology risk assessments address access, change management and data integrity
  • Third-party audits examine due diligence, contracts, monitoring and exit controls
  • Regulatory obligations mapped to control requirements and assurance evidence
  • Cybersecurity risks considered when defining audit scope and specialist support
  • Business continuity controls tested against disruption scenarios and recovery requirements
  • Financial crime indicators incorporated into procurement, payments and customer processes

Participants can monitor corrective actions, evaluate audit quality and plan workplace application.

  • Action tracking logs record owners, dates, evidence and implementation status
  • Follow-up testing validates closure rather than relying on management confirmation
  • Issue ageing analysis identifies overdue actions and repeated control failures
  • Quality assurance reviews assess conformance with internal audit methodology
  • Audit performance measures cover plan delivery, finding quality and stakeholder feedback
  • Personal application plans define priority improvements for current audit responsibilities

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Risk-based audit universe template
  2. Inherent and residual risk scoring model
  3. Annual risk-based audit plan template
  4. Risk and control matrix template
  5. Audit testing and evidence checklist
  6. Audit finding and action-tracking template

Who should attend

  • Internal Auditors — need a disciplined method for planning and delivering risk-focused engagements
  • Senior Internal Auditors — need stronger risk assessment, testing and reporting judgement
  • Audit Managers — need to prioritise audit coverage and supervise risk-based assignments
  • Financial Controllers — need to understand how internal audit evaluates financial control risks
  • Risk Managers — need to align enterprise risk information with assurance planning
  • Compliance Managers — need to coordinate regulatory assurance priorities with internal audit

Skills and tools covered

Risk assessmentAudit planningControl testingEvidence evaluationRoot-cause analysisAudit reporting

Tools and standards

IIA Global Internal Audit Standards, ISO 31000, COSO Enterprise Risk Management, COSO Internal Control—Integrated Framework

How the course runs

Training methodology

The course uses short instructor briefings to introduce standards, methods and decision criteria, followed by case work based on finance, operational, regulatory and technology risks. Participants work in groups to assess risk scenarios, prioritise an audit universe, prepare planning documents, analyse controls and evaluate evidence. Simulated audit discussions develop judgement around scope, findings and issue ratings. Facilitated reviews compare alternative approaches, while individual application planning connects the methods to participants' own audit responsibilities.

Requirements and prerequisites

Participants should understand basic internal control concepts, business processes and the purpose of internal audit. Experience preparing audit working papers, reviewing procedures, performing control tests or supporting risk assessments is helpful. The course assumes comfort with reading process documentation, financial or operational reports, and risk registers. Prior exposure to audit planning is useful but not essential. Participants do not need an accounting qualification, data analytics expertise, specialist IT audit knowledge or prior certification in IIA, ISO or COSO standards.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

You should understand basic internal controls, business processes and the role of internal audit. Some audit, compliance, risk or finance experience is helpful, but prior IIA, ISO or COSO certification is not required.

Bring a laptop if possible, along with a current audit plan, risk register or anonymised process documentation if your employer permits it. These materials are useful when preparing your individual application plan.

The course is designed for internal auditors, senior auditors, audit managers, risk professionals, compliance managers and financial control staff. It is most useful for people who contribute to audit planning, fieldwork, reporting or follow-up.

General internal audit courses often introduce the audit process broadly. This course concentrates on using risk information to decide what to audit, how deeply to test and how to report issues according to their likely business effect.

Participants can use the templates to refresh an audit universe, challenge risk ratings, plan an engagement and prepare a risk and control matrix. The final module helps identify specific changes to apply within current audit work.

The five days progress from risk, governance and audit planning through engagement design, testing, reporting and follow-up. Training runs from 08:30 to 16:30 each day, providing about 6.5 contact hours daily plus breaks.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Auditing