10 Topics
5 Days
49 Sessions
Programme Overview
Training Description
• Internal Auditors and Chief Audit Executives
• Risk Management Officers and Enterprise Risk Managers
• Compliance and Governance Officers
• Finance and Accounts Officers
• Audit Committee Members and Board Members
• Heads of Departments involved in risk ownership
• Quality Assurance and Business Continuity Officers
• Public Sector and Corporate Governance Practitioners
• Professionals preparing to transition from compliance-based to risk-based auditing
Session Objectives
- • Understand the principles, standards and value proposition of Risk-Based Internal Auditing (RBIA), including relevant IIA International Standards and the Three Lines Model.
- • Understand the fundamentals of Enterprise Risk Management (ERM) and frameworks such as COSO ERM and ISO 31000, and how they integrate with the internal audit function.
- • Develop and maintain a risk-based audit universe and annual audit plan aligned to the organization's strategic objectives and risk appetite.
- • Plan, scope and execute individual risk-based audit engagements, from risk assessment through to fieldwork, evidence gathering and testing.
- • Evaluate the design and operating effectiveness of governance, risk management and internal control processes across the organization.
- • Report audit findings, risk exposures and assurance conclusions clearly and persuasively to management, audit committees and boards, and design follow-up mechanisms to track remediation and embed continuous risk-based assurance.
About the Course
Internal audit functions are increasingly expected to move beyond transactional compliance checks and deliver assurance that is aligned to the organization's most significant risks. This comprehensive training course on Risk-Based Internal Auditing (RBIA) & ERM Integration equips participants with the knowledge and practical skills to build and execute a risk-based audit approach that is fully integrated with the organization's Enterprise Risk Management (ERM) framework. Participants will learn how to construct a risk-based audit universe, plan and execute risk-based engagements, evaluate the design and effectiveness of governance, risk management and control processes, and communicate assurance conclusions that add real value to decision-making. The course bridges internal audit methodology and enterprise risk management practice, empowering participants to strengthen organizational resilience and governance.
Curriculum & Topics
10 Topics | 49 Sessions
-
Workshop 1.1:
• Evolution of internal audit: from compliance-based to risk-based assurance.
-
Workshop 1.2:
• IIA International Professional Practices Framework (IPPF) and International Standards for the Professional Practice of Internal Auditing.
-
Workshop 1.3:
• The Three Lines Model and the role of internal audit within organizational governance.
-
Workshop 1.4:
• Defining assurance, consulting and advisory roles of a risk-based internal audit function.
-
Workshop 1.5:
• Independence, objectivity and the internal audit charter.
-
Workshop 2.1:
• Core concepts of ERM: risk appetite, risk tolerance, risk capacity and risk culture.
-
Workshop 2.2:
• Overview of COSO ERM Framework (2017) and ISO 31000 Risk Management principles.
-
Workshop 2.3:
• Risk identification, risk categorisation and enterprise risk registers.
-
Workshop 2.4:
• Risk assessment techniques: likelihood, impact, velocity and heat mapping.
-
Workshop 2.5:
• Linking ERM to strategy setting, performance management and decision-making.
-
Workshop 3.1:
• Aligning the internal audit plan with the organization's ERM framework and risk register.
-
Workshop 3.2:
• Positioning internal audit as an independent evaluator of ERM effectiveness.
-
Workshop 3.3:
• Coordinating assurance activities across the Three Lines to avoid duplication and gaps.
-
Workshop 3.4:
• Using management's risk assessments as an input while maintaining independent audit judgement.
-
Workshop 3.5:
• Common pitfalls in RBIA-ERM integration and how to avoid them.
-
Workshop 4.1:
• Constructing a comprehensive audit universe from organizational structure, processes and risks.
-
Workshop 4.2:
• Risk-scoring auditable entities and prioritising the annual audit plan.
-
Workshop 4.3:
• Engaging the audit committee and senior management in plan approval.
-
Workshop 4.4:
• Maintaining plan flexibility to respond to dynamic and emerging risks.
-
Workshop 5.1:
• Preliminary survey and engagement-level risk assessment.
-
Workshop 5.2:
• Defining audit objectives, scope and criteria linked to key risks and controls.
-
Workshop 5.3:
• Developing the risk and control matrix (RCM) for the engagement.
-
Workshop 5.4:
• Audit programs, resource allocation and engagement work plans.
-
Workshop 5.5:
• Communicating engagement scope and objectives to auditees.
-
Workshop 6.1:
• Evaluating the design adequacy of key controls against identified risks.
-
Workshop 6.2:
• Testing operating effectiveness: sampling approaches, walkthroughs and re-performance.
-
Workshop 6.3:
• Using data analytics and continuous auditing techniques in risk-based fieldwork.
-
Workshop 6.4:
• Identifying root causes of control weaknesses versus symptoms.
-
Workshop 6.5:
• Documenting working papers to support risk-based conclusions.
-
Workshop 7.1:
• Assessing the maturity of the organization's governance and risk management processes.
-
Workshop 7.2:
• Auditing risk ownership, accountability and escalation mechanisms.
-
Workshop 7.3:
• Evaluating the effectiveness of risk committees, management assurance and second-line functions.
-
Workshop 7.4:
• Reviewing key risk indicators (KRIs) and risk monitoring and reporting systems.
-
Workshop 7.5:
• Benchmarking ERM maturity using recognised maturity models.
-
Workshop 8.1:
• Incorporating fraud risk assessment into the risk-based audit approach.
-
Workshop 8.2:
• Red flags and indicators of fraud, corruption and mismanagement.
-
Workshop 8.3:
• Auditing emerging risks: cyber, technology, climate and third-party/outsourcing risk.
-
Workshop 8.4:
• Scenario analysis and horizon-scanning techniques for emerging risk identification.
-
Workshop 8.5:
• Coordinating with risk management and compliance on emerging risk response.
-
Workshop 9.1:
• Structuring risk-based audit reports around risk significance and business impact.
-
Workshop 9.2:
• Rating findings and forming overall assurance opinions.
-
Workshop 9.3:
• Communicating results effectively to management, audit committees and boards.
-
Workshop 9.4:
• Preparing combined/integrated assurance reporting across the Three Lines.
-
Workshop 9.5:
• Handling disagreements and escalating unresolved high-risk issues.
-
Workshop 10.1:
• Designing follow-up processes to track management action plans and remediation.
-
Workshop 10.2:
• Measuring the impact and value added by the risk-based internal audit function.
-
Workshop 10.3:
• Quality assurance and improvement programs (QAIP) for the internal audit function.
-
Workshop 10.4:
• Embedding a risk-aware culture across the organization.
-
Workshop 10.5:
• Sustaining RBIA-ERM integration through continuous learning and framework updates.
