Internal Audit Fundamentals: From Planning Through Follow-Up
Internal audit's value comes from independence and method, not from proximity to the business it reviews. The three lines of defence model is the usual way organisations describe where internal audit sits, as the third line giving independent assurance over the first line's operations and the second line's risk and compliance functions, but knowing where the line sits is not the same skill as knowing how to plan an engagement, test a control properly, and write a finding that actually gets fixed instead of argued with.
This two-day programme teaches internal audit as a working practice, aligned to the International Standards for the Professional Practice of Internal Auditing, for people building or developing an internal audit function rather than preparing for a professional certification exam. It complements, without duplicating, Orbix's own Co-Sourced Internal Audit service for organisations that want the methodology taught to their own staff rather than, or alongside, an outsourced engagement. It is also deliberately distinct from Enterprise Risk Management, which teaches the risk framework an audit later tests against: that course builds the framework, this one tests it.
HRD Corp SBL-Khas Claimable
Programme Agenda
Day 1, 9:00 AM - 9:15 AM
Welcome and Programme Overview
Introduction to the session, objectives, and housekeeping.
Day 1, 9:15 AM - 10:15 AM
Internal Audit's Purpose, Independence and the Three Lines of Defence
Why independence and objectivity are internal audit's core currency, how the three lines of defence model positions internal audit relative to management's first-line controls and the second line's risk and compliance functions, and the reporting line that protects that independence in practice.
Day 1, 10:15 AM - 10:30 AM
Break
Day 1, 10:30 AM - 12:30 PM
Risk-Based Annual Audit Planning
Building an annual audit plan from the organisation's own risk assessment rather than from habit or last year's plan, prioritising auditable units, and presenting the plan to the audit committee in a form it can actually challenge and approve.
Day 1, 12:30 PM - 1:30 PM
Lunch
Day 1, 1:30 PM - 3:15 PM
Engagement Planning and Scoping
Scoping an individual audit engagement, setting objectives and criteria, planning the resources and timeline, and the engagement planning memo that keeps a fieldwork team aligned once the work starts.
Day 1, 3:15 PM - 3:30 PM
Break
Day 1, 3:30 PM - 4:45 PM
Fieldwork: Walkthroughs, Control Testing and Working Papers
Conducting a process walkthrough, designing a control test that actually tests the control rather than just confirming a policy exists, practical non-statistical sampling for a fieldwork setting, and building working papers that another reviewer can follow without the original auditor in the room.
Day 1, 4:45 PM - 5:00 PM
Day 1 Close
Recap and what to review before day two.
Day 2, 9:00 AM - 9:15 AM
Day 1 Review
Recap of day one and the questions it left open.
Day 2, 9:15 AM - 10:15 AM
Writing Findings That Get Fixed
Structuring a finding around root cause rather than symptom, rating risk consistently, and writing a recommendation specific enough that management can actually act on it, which is the difference between a finding that gets closed and one that reappears next cycle.
Day 2, 10:15 AM - 10:30 AM
Break
Day 2, 10:30 AM - 12:30 PM
Reporting to Management and the Audit Committee
Structuring an audit report for two different audiences at once, the operational detail management needs and the summary-level assurance the audit committee needs, and handling management's response and any disagreement over a finding's rating.
Day 2, 12:30 PM - 1:30 PM
Lunch
Day 2, 1:30 PM - 3:15 PM
Follow-Up and Tracking Remediation to Closure
Tracking agreed management actions to their actual closure rather than their stated target date, validating that a remediation genuinely fixed the root cause rather than just the symptom, and escalating overdue actions to the audit committee.
Day 2, 3:15 PM - 3:30 PM
Break
Day 2, 3:30 PM - 4:45 PM
Applied Workshop: A Full Engagement Walkthrough
Participants take a sample process, scope an engagement, design two control tests, draft a finding and a report summary, and set a follow-up plan, covering the full cycle taught across the two days.
Day 2, 4:45 PM - 5:00 PM
Wrap-Up and Q&A
Key takeaways, next steps, and close.
Key Outcomes
- Explain internal audit's independence requirements and its position within the three lines of defence model
- Build a risk-based annual audit plan the audit committee can challenge and approve
- Scope and plan an individual audit engagement with clear objectives and criteria
- Design and perform control tests and build working papers that stand up to review
- Write findings structured around root cause with recommendations management can act on
- Report to management and the audit committee at the right level of detail for each
- Track remediation to genuine closure rather than a stated target date
Training Mode Physical / Online / Hybrid / e-learning
HRD Corp SBL-Khas Claimable
Level Intermediate. For new and developing internal auditors, audit committee members who want to understand what good audit work looks like, and finance or risk staff moving into an audit role.
Duration 2 Days (16 Hours) | 9:00 AM to 5:00 PM daily
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment A full engagement walkthrough workshop producing a scoped plan, two control tests, a draft finding and a follow-up plan, plus a written knowledge check
Certificate Certificate of Completion issued to all participants upon full attendance