Programme overview
Technical depth: Practitioner · Practical mode: Case study
Introduction
Internal audit functions that follow a fixed rotation or last year's plan spend scarce hours on low-risk areas while the exposures that concern the board go unexamined. Engagements scoped without a clear view of risk produce long reports with findings management struggles to act on. This Core Concept course equips internal auditors to plan and perform audits driven by risk, from the audit universe and plan through engagement scoping, control testing and reporting. Participants apply each step to case material from several sectors and leave with a Risk-Based Internal Audit Plan and Engagement Work Programme.
Course Objectives
- Define an audit universe and assess the organisation's risk maturity to set the starting point for risk-based auditing
- Apply COSO, ISO 31000 and the Global Internal Audit Standards to evaluate governance, risk management and control
- Build a risk-based internal audit plan that allocates resources to the highest risks and relies on other assurance providers where justified
- Plan engagements with a risk and control matrix, work programme and sampling approach matched to the risks in scope
- Develop findings with root causes, risk ratings and agreed action plans that management can act on
- Produce a Risk-Based Internal Audit Plan and Engagement Work Programme ready for audit committee review
Target Audience
- Internal auditors who plan and perform assurance engagements
- Senior auditors and audit team leaders who scope engagements and review workpapers
- Risk and control specialists moving into an assurance role
- Compliance and second-line reviewers who coordinate their work with internal audit
- IT and operational auditors who perform process and control testing
Course Outline
Day 1: Risk-Based Auditing Foundations and Context
- Global Internal Audit Standards (2024): Five Domains and Fifteen Principles
- IIA Three Lines Model: Roles of Management, Risk Functions and Internal Audit
- Audit Universe Definition by Process, Entity and Strategic Objective
- Risk Maturity Assessment of the Organisation's Risk Management
- Internal Audit Charter and Mandate Review Under Standard 6.2
Day 2: Risk and Control Frameworks for Auditors
- COSO Internal Control—Integrated Framework (2013): Components and Principles
- COSO ERM (2017): Strategy, Performance and Risk Appetite
- ISO 31000:2018 Risk Management Process from an Assurance Perspective
- IIA Topical Requirements: Cybersecurity and Third-Party Risk Baselines
- Combined Assurance Map and Reliance on Other Providers Under Standard 9.5
Day 3: Building the Plan and Planning Engagements
- Risk-Based Audit Plan: Risk Scoring, Coverage and Resource Allocation Under Standard 9.4
- Engagement Risk Assessment and Scope Setting Under Standards 13.2 and 13.3
- Process Walkthrough and Risk and Control Matrix Development
- Audit Work Programme Design: Tests of Design and Operating Effectiveness
- Audit Sampling: Statistical and Judgemental Sample Selection
Day 4: Findings, Emerging Risks and Audit Quality
- Findings Built on Condition, Criteria, Cause and Effect Under Standard 14.3
- Root Cause Analysis with the 5 Whys and Fishbone Diagram
- Risk Rating of Findings and Management Action Plans
- Auditing Culture, Fraud Indicators and Emerging Risks
- Internal Quality Assessment of Engagements Under Standard 12.1
Day 5: Case Work and the Risk-Based Audit Plan
- Procurement Function Case Study: Engagement Scoping and Control Testing
- Utility Operations Case Study: Rating and Reporting Findings
- Risk-Based Audit Plan Build for an Own Audit Universe
- Engagement Work Programme Drafting for a Priority Audit
- Peer Challenge Panel and Plan Defence
Skills You Will Gain
- Audit Universe Design
- Risk Assessment
- Control Evaluation
- Audit Planning
- Audit Sampling
- Findings Development
- Root Cause Analysis
- Assurance Mapping
Why Attend This Course
- Return to work with a Risk-Based Internal Audit Plan and Engagement Work Programme for your own function, tested in peer review
- Direct limited audit hours to the risks that matter to the board rather than to a fixed rotation cycle
- Write findings that explain causes and consequences in terms management accepts and acts on
- Compare audit methodology with auditors from other sectors and countries
Conclusion
Risk-based auditing is what allows a small audit function to give meaningful assurance over a large and changing organisation. This course moves from the standards, audit universe and risk maturity, through the risk and control frameworks auditors rely on, to building the plan, scoping engagements, testing controls and developing findings that lead to action. The final day turns that material into a Risk-Based Internal Audit Plan and Engagement Work Programme that participants take back to their function, ready for the next planning cycle.