Risk-Based Auditing:

A Value-Added Proposition

Training Introduction:

In an increasingly complex risk environment, traditional audit approaches are no longer sufficient. Stakeholders expect internal audit to go beyond compliance and control checks—to anticipate and respond to strategic and operational risks that impact organizational objectives.

Risk-Based Auditing (RBA) is a proactive, value-driven methodology that enables internal audit to prioritize high-risk areas, focus limited resources, and contribute meaningfully to decision-making and performance.

This training helps participants design, implement, and improve a risk-based audit approach using global best practices aligned with the IIA Standards, COSO, and ISO 31000 frameworks.

 

Learning Objectives:

By the end of this training, participants will be able to:

• Understand the principles and benefits of risk-based auditing
• Link audit plans and engagements to enterprise risk management (ERM) priorities
• Use tools to assess risks at strategic, operational, and process levels
• Execute audits with a risk-focused lens to enhance insights and recommendations
• Communicate audit results in a way that supports risk-informed decision-making

 

Target Audience:

• Internal Auditors and Audit Managers
• Chief Audit Executives (CAEs)
• Risk and Compliance Officers
• Performance and Operational Auditors
• Assurance professionals in both private and public sectors

 

Format & Duration:

• 4 structured modules
• Suggested: 2 full days or 4 half-day sessions
• Includes exercises, templates, and case-based discussions

 

Course Modules Overview

Module 1: Foundations of Risk-Based Auditing

Objective: Understand the concepts, drivers, and framework of risk-based auditing.

Topics:

• What is risk-based auditing (RBA)?
• Difference between traditional and risk-based audit approaches
• Value proposition of RBA: efficiency, effectiveness, relevance
• Role of internal audit in risk governance and assurance
• Alignment with COSO ERM and ISO 31000
• RBA within the IIA Standards (2010, 2201, 2210, 2310)
• Exercise: Compare a compliance-based vs. risk-based audit scenario

Module 2: Risk-Based Audit Planning and Prioritization

Objective: Design an audit universe and annual plan based on risk assessments.

Topics:

• Developing the audit universe and aligning it with strategic objectives
• Performing risk assessments at enterprise and process levels
• Sources of risk information (risk registers, interviews, dashboards, external trends)
• Risk scoring and prioritization (impact, likelihood, velocity, etc.)
• Building a risk-based internal audit plan
• Dynamic and continuous risk monitoring for audit planning
• Exercise: Develop a high-level risk-based audit plan from a case risk profile

Module 3: Conducting Risk-Focused Audit Engagements

Objective: Integrate risk considerations into audit fieldwork, testing, and reporting.

Topics:

• Scoping audits using risk drivers and objectives
• Identifying and evaluating risk responses and control design
• Linking risk to audit criteria and procedures
• Audit testing tailored to risk likelihood and impact
• Integrating fraud risk into RBA
• Using root cause analysis to understand risk/control failures
• Audit documentation and risk-focused working papers
• Exercise: Draft audit objectives and test plans based on identified risks

Module 4: Reporting, Communicating, and Adding Value through RBA

Objective: Deliver audit results that support risk-informed action and continuous improvement.

Topics:

• Writing risk-oriented findings and recommendations
• Risk ratings and prioritization in audit reporting
• Communicating with risk owners and management
• Using dashboards and visual risk reporting
• Follow-up mechanisms linked to risk mitigation progress
• Measuring the value and impact of RBA
• Embedding RBA into continuous assurance and advisory services
• Exercise: Write a sample risk-focused audit observation and recommendation

 

Training Materials & Deliverables:

• PowerPoint presentation deck
• Participant workbook
• Templates and tools:
• Risk assessment matrix
• Risk-based audit plan template
• Audit engagement planning worksheet
• Risk-focused findings and report writing guide
• Case study (sector-customizable) for applied learning
• Certificate of Completion

 

Certification:

Participants receive a Certificate of Completion in Risk-Based Auditing Essentials
after completing the course and exercises.

 

Optional Add-ons:

• Toolkit for risk-based audit planning in Excel or Power BI
• Add-on module: Integrating RBA with Agile Auditing or Continuous Auditing
• CAE-focused strategy session on embedding RBA in audit methodology
• Custom workshops by sector (e.g., public sector, banking, healthcare, energy)