Internal Controls and Audit Course

Lesson 1 • The Control Environment

Examines tone at the top, ethical culture, and organisational structure as the foundation for all controls. Shows how environment shapes control effectiveness.

Lesson 2 • Types of Internal Controls

Distinguishes preventive, detective, and corrective controls with examples. Provides a classification framework used throughout the course.

Lesson 3 • Control Objectives and Categories

Explains the three primary control objectives: operational efficiency, financial reliability, and compliance. Connects each objective to real organisational outcomes.

Lesson 4 • What Internal Controls Are

Defines internal controls, their origin, and their relationship to organisational risk. Anchors all subsequent technical content in a shared conceptual vocabulary.

Lesson 1 • COSO Framework Components

Breaks down the five COSO components and seventeen principles in depth. Connects each component to practical control design decisions.

Lesson 2 • Regulatory and Compliance Expectations

Covers how regulators and external auditors use frameworks to evaluate control adequacy. Prepares students to communicate control design to external stakeholders.

Lesson 3 • Applying Frameworks to Organisations

Demonstrates how to map framework requirements to existing organisational processes. Builds skill in translating abstract standards into actionable controls.

Lesson 1 • Risk Identification Techniques

Covers structured methods for surfacing risks across business processes. Provides tools directly applied in the risk-control matrix built later in the chapter.

Lesson 2 • Designing Effective Controls

Explains principles for designing controls that are proportionate, efficient, and testable. Links control design directly to identified risks.

Lesson 3 • Control Gaps and Compensating Controls

Addresses situations where ideal controls are impractical and compensating controls are needed. Teaches students to document and justify control substitutions.

Lesson 4 • Building a Risk-Control Matrix

Guides construction of a risk-control matrix (RCM) that maps risks to controls and owners. Produces the primary deliverable used in audit planning.

Lesson 1 • Audit Universe and Risk-Based Planning

Explains how to build an audit universe and prioritise engagements using risk scores. Connects risk assessment skills from Chapter 3 to audit scheduling.

Lesson 2 • Audit Standards and Professional Ethics

Reviews professional standards governing internal audit practice and the ethical obligations of auditors. Grounds all subsequent audit work in professional accountability.

Lesson 3 • Engagement-Level Audit Planning

Covers scope definition, objective setting, and preliminary risk assessment for a single engagement. Produces the engagement planning memo used in fieldwork.

Lesson 4 • The Internal Audit Function

Defines internal audit's mandate, independence requirements, and value to the organisation. Distinguishes internal audit from external audit and management review.

Lesson 1 • Sampling in Audit Testing

Explains statistical and judgemental sampling approaches and their appropriate use cases. Enables students to design samples that support defensible audit conclusions.

Lesson 2 • Workpaper Documentation Standards

Establishes standards for creating clear, complete, and reviewable audit workpapers. Ensures evidence is properly linked to conclusions and findings.

Lesson 3 • Data Analytics in Testing

Introduces data analytics tools for population analysis, anomaly detection, and continuous testing. Extends traditional testing methods with technology-enabled approaches.

Lesson 4 • Nature and Types of Audit Evidence

Defines the attributes of reliable evidence and the main evidence categories. Establishes quality standards applied when evaluating all evidence gathered.

Lesson 1 • Severity Classification of Findings

Explains how to rate findings as critical, significant, or moderate based on impact and likelihood. Provides a consistent rating scale used in audit reporting.

Lesson 2 • Root Cause Analysis

Teaches structured root cause techniques including five-whys and fishbone analysis. Ensures recommendations address causes rather than symptoms.

Lesson 3 • Developing Actionable Recommendations

Guides construction of recommendations that are specific, feasible, and risk-reducing. Links each recommendation directly to the identified root cause.

Lesson 4 • Preliminary Finding Communication

Covers the process of sharing draft findings with auditees before the formal report. Reduces surprises and improves the accuracy of final audit reports.

Lesson 1 • Writing Clear and Concise Findings

Teaches the condition-criteria-cause-effect structure for writing individual findings. Ensures findings are factual, objective, and persuasive.

Lesson 2 • Presenting Findings to Stakeholders

Covers verbal presentation of audit results to management and governance bodies. Builds confidence in delivering difficult messages clearly and professionally.

Lesson 3 • Audit Report Structure and Content

Defines the standard components of an audit report and the purpose of each section. Provides a template framework applied in the chapter's report-writing exercise.

Lesson 4 • Tone, Objectivity, and Persuasion

Addresses how word choice and tone affect management receptivity to audit findings. Balances professional objectivity with the need to motivate corrective action.

Lesson 1 • Strategic Audit Planning and Quality Assurance

Covers multi-year audit strategy, quality assurance programmes, and audit function maturity. Prepares students to lead and improve an internal audit function.

Lesson 2 • Continuous Monitoring and Auditing

Introduces automated monitoring techniques that provide real-time control assurance. Positions continuous auditing as a complement to periodic audit engagements.

Lesson 3 • Third-Party and Vendor Risk Controls

Addresses control risks introduced by outsourcing and vendor relationships. Teaches how to assess and audit third-party controls through service organisation reports.

Lesson 4 • IT General Controls and Application Controls

Covers access management, change management, and operations controls as IT general controls. Distinguishes them from application-level controls embedded in business systems.