Risk Based Auditing

Risk-based Auditing

Embedding RBA, ERM, Strategic Audit Planning, and the Consultancy Role in Internal Audit

|
Platform:
Online
In-class
Revised and Updated: 23 October 2026
Date Venue Duration
13 - 14 January 2027 Sandton, Gauteng 2 Days
01 - 02 March 2027 Sandton, Gauteng 2 Days
12 - 13 April 2027 Sandton, Gauteng 2 Days
02 - 03 June 2027 Sandton, Gauteng 2 Days
12 - 13 July 2027 Sandton, Gauteng 2 Days

Course Introduction

The Institute of Internal Auditors highlights the growing demand for internal auditors to deliver greater assurance to senior management. To meet this need, risk-based auditing (RBA) has emerged as a crucial method for providing objective assurance. By focusing on significant risks within organisations, audit functions can effectively allocate their resources to address issues that are pivotal to achieving business goals and aspirations, primarily operational risks.

 

Prospen Africa’s Risk-Based Auditing course provides insights into the latest advancements in RBA and includes a detailed case study demonstrating a step-by-step approach to conducting a risk-based operational audit.

Course Objectives

  • Participants will learn how to embed a risk-based audit process, understand enterprise risk management, develop strategic audit plans, and coordinate with other assurance providers. The course also covers practical aspects of RBA, including planning assignments, conducting audit tests, and presenting evidence to management. Special focus will be given to identifying over-managed risks, opportunity auditing, and developing the consultancy role within internal audit functions, all grounded in the IIA’s current 2024 Global Internal Audit Standards.

Who should attend?

  • Audit Managers and Senior Auditors
  • Auditors Responsible for Developing or Implementing a Risk-Based Approach
  • Other Assurance Professionals, Such as Those in Compliance and QA Functions, Wanting to Develop Their Risk-Based Approach
  • Managers and Directors of Business Functions Wanting to Enhance Their Knowledge of a Risk-Based Audit Approach
Audit, Risk and Governance courses

Training Methodology

Our diverse instructional approaches ensure effective learning:

– Lectures & Presentations: Engage with expert-driven, stimulating content.
– Course Material: Access well-crafted supporting resources.
– Group Work: Collaborate on discussions and case studies for practical insights.
– Workshops & Role-Play: Participate in immersive, scenario-based activities.
– Practical Application: Focus on applying theoretical knowledge in real situations.
– Post-Training Support: Receive extensive support after training for skill implementation.

Training Outline

Day 1: Module 1 — Embedding a Risk-Based Audit Process
Embedding a Risk-Based Audit Process
  • The principles of Risk-Based Auditing (RBA)
  • Worldwide trends, and trends from GRC research and the internal audit best-practice database
  • Focusing more audit attention on operational risks
  • Refocusing internal audit to meet the IIA's 2024 Global Internal Audit Standards, effective for quality assessments from January 2025 — a single consolidated framework of 5 domains, 15 principles, and 52 standards, replacing the previous fragmented 2017 IPPF structure
  • Enhancing internal audit credibility and value with new insights and considering future impact
  • Providing a higher level of assurance, coordinated with other assurance providers
  • Adding measurable value to the business
  • Internal audit as a strategic partner and advisor
  • Enhancing organisational value with risk-based, objective, and reliable assurance, advice, and insight
  • Aligning risks with the organisation's risk appetite
  • Changing the face of auditing with risk-based audit
  • Ethics and professionalism under the 2024 Global Internal Audit Standards, and the Topical Requirements now in effect for specific risk areas including cybersecurity, third-party risk, organisational behaviour, and organisational resilience
  • Helping the Board protect the assets, reputation, and sustainability of the organisation
  • Internal audit's right to attend and observe executive committee meetings
  • Exercise 1: Challenges for Internal Audit.
Enterprise Risk Management (ERM) and the IA Role
  • Explanation of ERM and its importance
  • How ERM can help during economic crises
  • Directors' and senior management's roles and responsibilities in ERM
  • ERM roles and responsibilities, and categories of risk
  • Selling ERM benefits to top management
Strategic Audit Planning
  • Deciding which areas to audit, with a focus on operational risks
  • The audit universe and current IIA guidance
  • Determining the level of assurance
  • Producing the audit plan with IIA guidance, and RBA audit plan preparation
  • Risk-Based Internal Audit Plan example
  • Best-practice audit risk planning model (provided electronically to delegates)
  • Exercise 3: Developing a Strategic Audit Plan Using the Model.
Ensuring Coordination with Other Assurance Providers
  • Coordinating assurance providers' roles to avoid duplication of effort
  • Incorporating internal audit agreed actions in the risk register
  • Taking environmental risk seriously, and comprehensive business continuity planning
  • Benefiting the wider community
  • Current guidance on coordinating risk management and assurance
  • Exercise 4: Team Exercise – The Mystery.

Day 2: Module 2 — Risk-Based Auditing in Practice
Risk-Based Auditing in Practice
  • Brainstorming functional objectives and building a risk picture
  • Considering threats and opportunities
  • Building the details of controls
  • Planning the assignment, and determining types of tests and techniques
  • Identifying threats to success
  • Exercise 5: Brainstorming Audit Topics.
The Risk-Based Audit, Step by Step
  • Walking through a risk-based programme case study
  • Reviewing business objectives, ensuring they are comprehensive and SMART
  • Relating risks in the register to objectives
  • Evaluating inherent risks and identifying key risks
  • Identifying causes of events and recording mitigating actions
  • Assessing the status of actions and management decisions
  • Establishing target risk and confidence level in actions
  • Audit testing and evidence presentation
  • Exercise 6: The RBA in Practice – Audits Selected by Delegates.
Identifying Over-Managed Risks
  • Identifying risks in the green zone of the risk matrix
  • Removing unnecessary controls, and challenging established processes
  • Benefits and penalties associated with reducing efforts in some areas
  • Exercise 7: Identifying Over-Managed Activities.
Opportunity Auditing
  • Viewing risk as an opportunity
  • Targeting significant areas of business opportunity
  • Demonstrating value for money with opportunity audits
  • Developing an opportunity register
  • Opportunity audit topics (e.g., travel management, mobile communications, insurance, consultancy, energy management)
  • Exercise 8: Opportunity Exercise – Moonshot.
Developing the Consultancy Role
  • IIA standards on consultancy under the 2024 Global Internal Audit Standards
  • Encouraging consultancy
  • Documenting and reporting consultancy assignments
  • Audit by workshop and facilitation
  • Exercise 9: Convincing Management of the Consultancy Direction for Internal Audit.

Course Categories

Get a Quote Banner Outline

Request a Call Back

Your submission has been successful

Please check your email for confirmation

Success Stories

Discover how our courses enhance professionals’ effectiveness in their workplaces.

Central Bank of Lesotho

Fraud Risk Management

The Fraud Risk Management training was clear, practical, and very relevant to day-to-day work. Content was well structured and the real world case studies made concepts easy to apply. Presenter knowledge and engagement kept the session interactive. Overall a valuable program that strengthened my understanding of fraud detection, prevention, and regulatory requirements.

Central Bank of Lesotho

Fraud Risk Management

The facilitator was exceptionally good, approachable eloquent and was able to structure the course content to relate to our specific work designations, it was just perfect service delivery

Central Bank of Lesotho

Fraud Risk Management

Keep up the good work which I experienced during my training being training materials offered and great hospitality we received from all the staff members

Centenary Rural Development Group Ltd

Risk Management for Risk champions

Very informative course with good content and benchmarks of key players in South Africa. We are able to agree a plan on how to build an enterprise risk management framework for a developing group of companies. Several references to guide us and experienced Facilitators

GEMS

Auditing the ESG Process Masterclass

Very happy with the training. It was excellently delivered and comprehensively covered all critical aspects of ESG and effectively contextualised them within the environments of our respective organisations.

North West Gambling Board

Risk Management in the Public Sector

The course was eye opening and exceeded my expectations.

FAQs – Risk-Based Auditing

Master risk-based auditing (RBA), learning IIA 2024 Global Internal Audit Standards alignment, strategic audit planning, operational risk evaluation, and internal control assurance methodologies to optimize audit resources and drive institutional value.

What is covered in the Risk-Based Auditing course?
The course covers risk-based internal audit (RBIA) methodology, aligning audit plans with organizational risk profiles, evaluating internal control design and operating effectiveness, risk assessment mapping, and compiling risk-focused audit reports.
Who should attend this Risk-Based Auditing Training?
This training is designed for internal auditors, senior auditors, audit managers, chief audit executives (CAEs), risk officers, compliance reviewers, and quality assurance professionals seeking to transition from compliance-based to risk-focused auditing.
How does this course help auditors align internal audit plans with enterprise risks?
Delegates learn practical methods to leverage enterprise risk registers, evaluate organizational risk appetite, prioritize high-risk operational areas, and design dynamic audit plans that focus resources where exposures are greatest.
Will delegates learn how to test and evaluate internal control effectiveness?
Yes. The curriculum explores designing substantive and compliance testing procedures, evaluating control deficiencies, linking control failures to residual risk, and formulating actionable audit recommendations.
Does the masterclass align with international internal auditing standards?
Yes. The training aligns core auditing practices with the Institute of Internal Auditors (IIA) Global Internal Audit Standards, ensuring globally benchmarked methodologies and professional rigor.
Why is risk-based auditing essential for modern internal audit functions?
Risk-based auditing ensures assurance resources target critical vulnerabilities, provides the board with objective assurance on key risk management processes, and elevates internal audit into a strategic advisory role.

Related Courses

Your submission has been successful

Please check your email for confirmation