Finance, Accounting and Audit
Audit and Assurance
The COSO Internal Control Programme
Designing and evidencing a control framework an auditor can test and a manager can actually run.
- Duration
- 5 days
- Contact hours
- 30
- Level
- Intermediate
- Fee from
- On enquiry
Overview
COSO is widely referenced and thinly implemented. Organisations document their controls, then discover at audit that the documentation describes a process rather than a control, that nobody can evidence the control operated, and that the control environment and monitoring components were never addressed because they are harder to put in a matrix. This week covers the five components with the emphasis on design and evidence: what makes a control a control, how to document one so somebody else can test it, and how to assess a deficiency honestly.
Who should attend
Internal control and compliance staff, financial controllers responsible for the framework, internal auditors who test it, and process owners accountable for controls.
What you will be able to do
- Tell a control from a process step, and document it so it can be tested.
- Address the control environment and monitoring, not only control activities.
- Map controls to the risks and assertions they exist to address.
- Design a control that leaves evidence it operated.
- Assess a deficiency and decide whether it is significant.
How it is taught
Short input, then work, across 5 days of roughly 6 teaching hours each. Exercises run on situations delegates bring rather than on a case study written for a different organisation. Cohorts are capped so that everybody is asked something.
Available as classroom, live online, in house.
Programme outline
Day 1
The framework
- The five components, and the two usually skipped
- Principles, points of focus, and how far to take them
- Entity level against process level control
- What an integrated framework means in practice
Day 2
Environment, information and monitoring
- Control environment, assessed on evidence rather than on tone
- Information and communication as a control component
- Monitoring, and how it differs from internal audit
- Fraud risk assessment inside the framework
Day 3
Designing a control
- Preventive and detective, and choosing between them
- Manual, automated, and IT dependent manual
- Frequency, precision, and the threshold a control works to
- Designing so that operation leaves evidence
Day 4
Documenting and testing
- Narrative, flowchart and matrix, and what each is for
- Mapping controls to risks and to assertions
- Testing design against testing operating effectiveness
- Sampling, and the rationale for a sample size
Day 5
Deficiencies and reporting
- Deficiency, significant deficiency and material weakness
- Aggregating deficiencies across a process
- Compensating controls, and when they genuinely compensate
- Reporting and remediation that gets verified
What you leave with
- A control matrix for one process, mapped to risks and assertions.
- A redesign of two controls so that operation is evidenced.
- A deficiency assessment with the aggregation logic written down.
Dates and fees
| Dates | Location | Format | Fee |
|---|---|---|---|
| 23 to 27 November 2026 | Cairo, Egypt | Classroom | US$1,500 |
| 30 November 2026 to 4 December 2026 | Windhoek, Namibia | Classroom | R15,000 |
| 7 to 11 December 2026 | Dubai, United Arab Emirates | Classroom | US$1,500 |
| 14 to 18 December 2026 | Durban, South Africa | Classroom | R15,000 |
Fees are per delegate and cover tuition, all programme materials and the certificate. Travel, accommodation and visas are arranged by the delegate. Registration closes two weeks before a programme starts.
Certificate
A GATI certificate recording what was attended, issued after the programme has run and attendance has been taken. Attending at least 80 per cent of the days earns a certificate of completion; attending less earns a certificate of attendance stating exactly what was attended. Every certificate carries a code that anybody can check against GATI's own record.
It records participation. and GATI does not claim one it does not hold.