Finance, Accounting and Audit
Audit and Assurance
Risk-Based Auditing Training Course
Planning an audit against where the organisation is actually exposed, and reporting a finding that gets acted on.
- Duration
- 5 days
- Contact hours
- 30
- Level
- Intermediate
- Fee from
- On enquiry
Overview
Risk based auditing is widely claimed and less widely practised. The usual failure is a plan built from a rolling cycle with a risk assessment attached afterwards, which produces coverage rather than assurance: everything audited eventually, nothing audited because it mattered this year. The second failure is at the other end, where sound work produces a report that is accepted, agreed and not implemented. This week covers both ends, from building a plan that can be defended to an audit committee to writing a finding that survives the meeting it is discussed in.
Who should attend
Internal auditors moving from a cyclical to a risk based approach, audit managers responsible for the annual plan, and heads of internal audit who have to defend it to an audit committee.
What you will be able to do
- Build an annual plan from an assessment of exposure rather than from a rotation.
- Scope an engagement so the work answers a question somebody asked.
- Test a control for whether it would actually catch the thing it exists for.
- Write a finding that states the consequence, not only the condition.
- Follow up in a way that closes an action rather than recording it as closed.
How it is taught
Short input, then work, across 5 days of roughly 6 teaching hours each. Exercises run on situations delegates bring rather than on a case study written for a different organisation. Cohorts are capped so that everybody is asked something.
Available as classroom, live online, in house.
Programme outline
Day 1
Where the plan comes from
- Assessing exposure rather than listing processes
- Cyclical coverage, and why it feels safer than it is
- Using other people's assurance without inheriting their blind spots
- Defending a plan that deliberately leaves things out
Day 2
Scoping an engagement
- The question the audit is answering, written down first
- Objective, scope, and the boundary that will be argued about
- Risk and control matrices that stay usable
- Agreeing scope with a client who wants it narrower
Day 3
Evidence and testing
- Designing a test that would fail if the control were absent
- Sampling, and what a sample of five actually supports
- Data analysis against whole populations
- Working papers somebody else can follow
Day 4
Reporting so it lands
- Condition, cause and consequence, in that order
- Rating a finding so the rating means something
- Writing for an audit committee rather than for the file
- Handling disagreement about a fact and about an opinion
Day 5
Afterwards
- Agreeing an action with a date and an owner
- Following up on substance rather than on assertion
- Reporting repeated or overdue actions upward
- Measuring whether the function changed anything
What you leave with
- A risk based plan for the delegate's own function, with the reasoning recorded per engagement.
- A scoping document for one engagement, written to the question being answered.
- A rewritten finding from the delegate's own files, with the consequence made explicit.
Dates and fees
| Dates | Location | Format | Fee |
|---|---|---|---|
| 23 to 27 November 2026 | Durban, South Africa | Classroom | R15,000 |
| 30 November 2026 to 4 December 2026 | Accra, Ghana | Classroom | US$1,500 |
| 7 to 11 December 2026 | Kampala, Uganda | Classroom | US$1,500 |
| 14 to 18 December 2026 | Nairobi, Kenya | Classroom | US$1,500 |
Fees are per delegate and cover tuition, all programme materials and the certificate. Travel, accommodation and visas are arranged by the delegate. Registration closes two weeks before a programme starts.
Certificate
A GATI certificate recording what was attended, issued after the programme has run and attendance has been taken. Attending at least 80 per cent of the days earns a certificate of completion; attending less earns a certificate of attendance stating exactly what was attended. Every certificate carries a code that anybody can check against GATI's own record.
It records participation. and GATI does not claim one it does not hold.