Risk-based Auditing

The programme

Programme overview

The Institute of Internal Auditors highlights the growing demand for internal auditors to deliver greater assurance to senior management. To meet this need, risk-based auditing (RBA) has emerged as a crucial method for providing objective assurance. By focusing on significant risks within organisations, audit functions can effectively allocate their resources to address issues that are pivotal to achieving business goals and aspirations, primarily operational risks.

Ratomac Risk-Based Auditing course provides insights into the latest advancements in RBA and includes a detailed case study demonstrating a step-by-step approach to conducting a risk-based operational audit.

Who should attend

Who is this programme for?

• Audit Managers and Senior Auditors
• Auditors Responsible for Developing or Implementing a Risk-Based Approach
• Other Assurance Professionals, Such as Those in Compliance and QA Functions, Wanting to Develop Their Risk-Based Approach
• Managers and Directors of Business Functions Wanting to Enhance Their Knowledge of a Risk-Based Audit Approach

Learning outcomes

What you will learn

Participants will learn how to embed a risk-based audit process, understand enterprise risk management, develop strategic audit plans, and coordinate with other assurance providers. The course also covers practical aspects of RBA, including planning assignments, conducting audit tests, and presenting evidence to management. Special focus will be given to identifying over-managed risks, opportunity auditing, and developing the consultancy role within internal audit functions, all grounded in the IIA’s current 2024 Global Internal Audit Standards.

Explore the programme

Detailed programme outline

• The principles of Risk-Based Auditing (RBA)
• Worldwide trends, and trends from GRC research and the internal audit best-practice database
• Focusing more audit attention on operational risks
• Refocusing internal audit to meet the IIA's 2024 Global Internal Audit Standards, effective for quality assessments from January 2025 — a single consolidated framework of 5 domains, 15 principles, and 52 standards, replacing the previous fragmented 2017 IPPF structure
• Enhancing internal audit credibility and value with new insights and considering future impact
• Providing a higher level of assurance, coordinated with other assurance providers
• Adding measurable value to the business
• Internal audit as a strategic partner and advisor
• Enhancing organisational value with risk-based, objective, and reliable assurance, advice, and insight
• Aligning risks with the organisation's risk appetite
• Changing the face of auditing with risk-based audit
• Ethics and professionalism under the 2024 Global Internal Audit Standards, and the Topical Requirements now in effect for specific risk areas including cybersecurity, third-party risk, organisational behaviour, and organisational resilience
• Helping the Board protect the assets, reputation, and sustainability of the organisation
• Internal audit's right to attend and observe executive committee meetings
• Explanation of ERM and its importance
• How ERM can help during economic crises
• Directors' and senior management's roles and responsibilities in ERM
• ERM roles and responsibilities, and categories of risk
• Selling ERM benefits to top management
• Deciding which areas to audit, with a focus on operational risks
• The audit universe and current IIA guidance
• Determining the level of assurance
• Producing the audit plan with IIA guidance, and RBA audit plan preparation
• Risk-Based Internal Audit Plan example
• Best-practice audit risk planning model (provided electronically to delegates)
• Coordinating assurance providers' roles to avoid duplication of effort
• Incorporating internal audit agreed actions in the risk register
• Taking environmental risk seriously, and comprehensive business continuity planning
• Benefiting the wider community
• Current guidance on coordinating risk management and assurance
• Brainstorming functional objectives and building a risk picture
• Considering threats and opportunities
• Building the details of controls
• Planning the assignment, and determining types of tests and techniques
• Identifying threats to success
• Walking through a risk-based programme case study
• Reviewing business objectives, ensuring they are comprehensive and SMART
• Relating risks in the register to objectives
• Evaluating inherent risks and identifying key risks
• Identifying causes of events and recording mitigating actions
• Assessing the status of actions and management decisions
• Establishing target risk and confidence level in actions
• Audit testing and evidence presentation
• Identifying risks in the green zone of the risk matrix
• Removing unnecessary controls, and challenging established processes
• Benefits and penalties associated with reducing efforts in some areas
• Viewing risk as an opportunity
• Targeting significant areas of business opportunity
• Demonstrating value for money with opportunity audits
• Developing an opportunity register
• Opportunity audit topics (e.g., travel management, mobile communications, insurance, consultancy, energy management)
• IIA standards on consultancy under the 2024 Global Internal Audit Standards
• Encouraging consultancy
• Documenting and reporting consultancy assignments
• Audit by workshop and facilitation

Learning approach

How you will learn

Our diverse instructional approaches ensure effective learning:

– Lectures & Presentations: Engage with expert-driven, stimulating content.– Course Material: Access well-crafted supporting resources.– Group Work: Collaborate on discussions and case studies for practical insights.– Workshops & Role-Play: Participate in immersive, scenario-based activities.– Practical Application: Focus on applying theoretical knowledge in real situations.– Post-Training Support: Receive extensive support after training for skill implementation.

Discuss your requirements

Dates, duration & arrangements

Contact Ratomac to confirm dates, duration, delivery format, entry requirements and any applicable assessment or certification before booking.