Risk-Based Auditing Training Course

Risk based auditing is widely claimed and less widely practised. The usual failure is a plan built from a rolling cycle with a risk assessment attached afterwards, which produces coverage rather than assurance: everything audited eventually, nothing audited because it mattered this year. The second failure is at the other end, where sound work produces a report that is accepted, agreed and not implemented. This week covers both ends, from building a plan that can be defended to an audit committee to writing a finding that survives the meeting it is discussed in.

It runs 7 times over the published calendar, in 6 cities and live online. Every date is the same programme with the same content and the same certificate.

• Build an annual plan from an assessment of exposure rather than from a rotation.
• Scope an engagement so the work answers a question somebody asked.
• Test a control for whether it would actually catch the thing it exists for.
• Write a finding that states the consequence, not only the condition.
• Follow up in a way that closes an action rather than recording it as closed.

Internal auditors moving from a cyclical to a risk based approach, audit managers responsible for the annual plan, and heads of internal audit who have to defend it to an audit committee.

Short input, then work. Across 5 days of roughly 6 teaching hours each, the balance sits deliberately with the second: a programme where the trainer talks for six hours produces notes rather than capability.

• Your own material

  Exercises run on situations delegates bring, not on a case study written for a different organisation in a different decade.

• A capped cohort

  Small enough that everybody is asked something. Executive programmes are capped tighter still.

• Practice under scrutiny

  The difficult conversation, the challenged assumption, the decision defended out loud. Judgement is not built by watching.

• Something to take back

  Each day ends with a thing you can use on Monday rather than a slide deck you will not reopen.

• A risk based plan for the delegate's own function, with the reasoning recorded per engagement.
• A scoping document for one engagement, written to the question being answered.
• A rewritten finding from the delegate's own files, with the consequence made explicit.

A GATI certificate recording what you attended, issued after the programme has run and attendance has been taken. Attending at least 80 per cent of the days earns a certificate of completion; attending less earns a certificate of attendance stating exactly what was attended.

Every certificate carries a code that anybody can check against GATI's own record, which is what makes it worth holding. It records participation. This site will not imply one it does not have.