Audit & Quality
Risk-Based Internal Auditing (RBIA)
This five-day programme prepares internal auditors to plan and deliver engagements driven by risk rather than by time, covering governance, risk and control foundations, ISO 31000 and COSO ERM frameworks, audit universe construction and risk assessment, risk-based plan development, engagement planning and control testing, and residual risk evaluation and reporting. Participants develop skills in risk assessment, plan construction, control testing, and risk-focused reporting.
Introduction
Risk-Based Internal Auditing (RBIA) Training Course prepares internal auditors to plan and deliver engagements driven by risk rather than by time. Participants work through governance, risk, and control foundations, risk management frameworks including ISO 31000 and COSO ERM, the audit universe and risk assessment, constructing the risk-based audit plan, engagement risk assessment and programme design, testing controls and residual risk, and reporting opinions on risk and control as one connected method. The programme links the risks that threaten organisational objectives with the assurance work that addresses them. As a result, learners gain a practical method for risk-based auditing. Furthermore, the course strengthens risk judgement, evidence quality, and audit reporting.
Risk-Based Internal Auditing (RBIA) Course Objectives
- Explain risk-based internal auditing and how it differs from cyclical auditing.
- Apply the IIA Global Internal Audit Standards to risk-based engagements.
- Apply ISO 31000 risk management principles and processes.
- Apply the COSO ERM framework and its components.
- Build the audit universe and assess inherent risk.
- Construct a risk-based audit plan with clear rationale.
- Design engagement programmes around key risks and controls.
- Assess control design and test operating effectiveness.
- Evaluate residual risk and form an engagement opinion.
- Apply risk-focused findings, reporting, and follow-up.
Course Methodology
- Interactive sessions built on risk-based audit cases across sectors.
- Workshops on risk assessment, audit universe, and plan construction.
- Group exercises on control testing and residual risk evaluation.
- Hands-on practice with risk registers, control matrices, and audit working papers.
- Simulation of an engagement from risk assessment to opinion.
- Facilitator coaching and peer review on personal risk-based audit plans.
Who Should Take This Course
- Internal auditors and audit seniors.
- Audit managers and heads of internal audit.
- Risk management and compliance professionals.
- Internal control and governance officers.
- Process owners working with risk and control.
- Consultants advising on risk-based audit and assurance.
Risk-Based Internal Auditing (RBIA) Course Outlines
Governance, Risk, and Control Foundations
- • Governance, risk, and control and their relationship.
- • Risk-based auditing versus cyclical and compliance auditing.
- • IIA Global Internal Audit Standards and the audit charter.
- • Three lines model and assurance coordination.
- • Risk appetite, tolerance, and organisational objectives.
- • Risk language and common classification methods.
- • Case discussion: an audit plan that missed the real risk.
Risk Management Frameworks
- • ISO 31000 principles, framework, and process.
- • COSO ERM framework and its components.
- • Risk identification techniques and risk registers.
- • Risk analysis, evaluation, and prioritisation.
- • Inherent risk versus residual risk.
- • Key risk indicators and risk reporting.
- • Workshop: building a risk register for a business unit.
Audit Universe and the Risk-Based Plan
- • Constructing and maintaining the audit universe.
- • Risk assessment, scoring, and ranking methodology.
- • Linking auditable entities to strategic objectives.
- • Building the risk-based audit plan and rationale.
- • Resourcing, capacity, and plan flexibility.
- • Plan approval and communicating coverage gaps.
- • Exercise: constructing a risk-based audit plan.
Engagement Planning and Testing
- • Engagement-level risk assessment.
- • Defining objectives, scope, and criteria by risk.
- • Designing audit programmes and test steps.
- • Control design assessment and walkthroughs.
- • Operating effectiveness testing and sampling.
- • Documenting evidence and working papers.
- • Simulation: planning and executing a risk-based engagement.
Rating, Reporting, and Follow-Up
- • Evaluating control effectiveness and residual risk.
- • Forming and communicating an engagement opinion.
- • Risk-focused findings and root cause analysis.
- • Reporting to management and the audit committee.
- • Follow-up, risk movement, and assurance mapping.
- • Updating the plan from audit results.
- • Capstone: presenting a complete risk-based audit engagement.
Conclusion
By successfully completing Risk-Based Internal Auditing (RBIA), participants will gain a practical command of governance, risk, and control foundations, ISO 31000 and COSO ERM risk frameworks, audit universe construction and risk assessment, risk-based audit plan development, engagement planning and control testing, and residual risk evaluation and opinion reporting. They will acquire skills in risk assessment, plan construction, control testing, and risk-focused reporting that focus audit effort where risk is greatest. Gentex Training Center designs the programme to help auditors apply risk-based auditing with confidence.
FAQs for the Risk-Based Internal Auditing (RBIA) course
— What is the "Risk-Based Internal Auditing (RBIA)" course about?
It prepares internal auditors to plan and deliver engagements driven by risk rather than by time. The course spans governance, risk and control foundations, ISO 31000 and COSO ERM frameworks, audit universe construction and risk assessment, risk-based plan development, engagement planning and control testing, and residual risk evaluation and reporting.
— What are the key benefits of the "Risk-Based Internal Auditing (RBIA)" course?
You gain a practical method for risk-based auditing that links the risks threatening organisational objectives with the assurance work that addresses them. The course improves risk assessment and plan construction, strengthens control design and operating effectiveness testing, sharpens residual risk evaluation, and gives you risk-focused reporting practice that directs audit effort where it matters most.
— What skills will I gain from the "Risk-Based Internal Auditing (RBIA)" course?
You will develop four core skills: governance, risk and control framework application with ISO 31000 and COSO ERM, audit universe construction and risk assessment, risk-based audit plan development and engagement planning, and control testing with residual risk evaluation and risk-focused reporting.
— What tools, methods, or standards are covered in the "Risk-Based Internal Auditing (RBIA)" course?
The course covers governance, risk and control and their relationship, risk-based auditing versus cyclical and compliance auditing, the IIA Global Internal Audit Standards and the audit charter, the three lines model and assurance coordination, risk appetite, tolerance and organisational objectives, risk classification methods, ISO 31000 principles, framework and process, the COSO ERM framework and its components, risk identification techniques and risk registers, risk analysis, evaluation and prioritisation, inherent risk versus residual risk, key risk indicators and risk reporting, audit universe construction and maintenance, risk assessment, scoring and ranking methodology, linking auditable entities to strategic objectives, risk-based audit plan construction and rationale, resourcing, capacity and plan flexibility, plan approval and communicating coverage gaps, engagement-level risk assessment, defining objectives, scope and criteria by risk, audit programme and test step design, control design assessment and walkthroughs, operating effectiveness testing and sampling, documenting evidence and working papers, evaluating control effectiveness and residual risk, forming and communicating an engagement opinion, risk-focused findings and root cause analysis, reporting to management and the audit committee, follow-up, risk movement and assurance mapping, and updating the plan from audit results.
— How is the "Risk-Based Internal Auditing (RBIA)" course applied in real-world practice?
Participants apply it to real work such as building a risk register for a business unit, constructing a risk-based audit plan with ranked entities, performing an engagement-level risk assessment, designing an audit programme around key risks, testing control operating effectiveness with sampling, evaluating residual risk and forming an engagement opinion, and updating the plan from results. The same methods support assurance mapping and audit committee reporting.
Scheduling in Progress | Training Arranged Around Your Needs
Our team can coordinate this program based on available dates and locations. Contact us to explore training options that best fit your needs.
Introduction
Risk-Based Internal Auditing (RBIA) Training Course prepares internal auditors to plan and deliver engagements driven by risk rather than by time. Participants work through governance, risk, and control foundations, risk management frameworks including ISO 31000 and COSO ERM, the audit universe and risk assessment, constructing the risk-based audit plan, engagement risk assessment and programme design, testing controls and residual risk, and reporting opinions on risk and control as one connected method. The programme links the risks that threaten organisational objectives with the assurance work that addresses them. As a result, learners gain a practical method for risk-based auditing. Furthermore, the course strengthens risk judgement, evidence quality, and audit reporting.
Risk-Based Internal Auditing (RBIA) Course Objectives
- Explain risk-based internal auditing and how it differs from cyclical auditing.
- Apply the IIA Global Internal Audit Standards to risk-based engagements.
- Apply ISO 31000 risk management principles and processes.
- Apply the COSO ERM framework and its components.
- Build the audit universe and assess inherent risk.
- Construct a risk-based audit plan with clear rationale.
- Design engagement programmes around key risks and controls.
- Assess control design and test operating effectiveness.
- Evaluate residual risk and form an engagement opinion.
- Apply risk-focused findings, reporting, and follow-up.
Course Methodology
- Interactive sessions built on risk-based audit cases across sectors.
- Workshops on risk assessment, audit universe, and plan construction.
- Group exercises on control testing and residual risk evaluation.
- Hands-on practice with risk registers, control matrices, and audit working papers.
- Simulation of an engagement from risk assessment to opinion.
- Facilitator coaching and peer review on personal risk-based audit plans.
Who Should Take This Course
- Internal auditors and audit seniors.
- Audit managers and heads of internal audit.
- Risk management and compliance professionals.
- Internal control and governance officers.
- Process owners working with risk and control.
- Consultants advising on risk-based audit and assurance.
Risk-Based Internal Auditing (RBIA) Course Outlines
Governance, Risk, and Control Foundations
- • Governance, risk, and control and their relationship.
- • Risk-based auditing versus cyclical and compliance auditing.
- • IIA Global Internal Audit Standards and the audit charter.
- • Three lines model and assurance coordination.
- • Risk appetite, tolerance, and organisational objectives.
- • Risk language and common classification methods.
- • Case discussion: an audit plan that missed the real risk.
Risk Management Frameworks
- • ISO 31000 principles, framework, and process.
- • COSO ERM framework and its components.
- • Risk identification techniques and risk registers.
- • Risk analysis, evaluation, and prioritisation.
- • Inherent risk versus residual risk.
- • Key risk indicators and risk reporting.
- • Workshop: building a risk register for a business unit.
Audit Universe and the Risk-Based Plan
- • Constructing and maintaining the audit universe.
- • Risk assessment, scoring, and ranking methodology.
- • Linking auditable entities to strategic objectives.
- • Building the risk-based audit plan and rationale.
- • Resourcing, capacity, and plan flexibility.
- • Plan approval and communicating coverage gaps.
- • Exercise: constructing a risk-based audit plan.
Engagement Planning and Testing
- • Engagement-level risk assessment.
- • Defining objectives, scope, and criteria by risk.
- • Designing audit programmes and test steps.
- • Control design assessment and walkthroughs.
- • Operating effectiveness testing and sampling.
- • Documenting evidence and working papers.
- • Simulation: planning and executing a risk-based engagement.
Rating, Reporting, and Follow-Up
- • Evaluating control effectiveness and residual risk.
- • Forming and communicating an engagement opinion.
- • Risk-focused findings and root cause analysis.
- • Reporting to management and the audit committee.
- • Follow-up, risk movement, and assurance mapping.
- • Updating the plan from audit results.
- • Capstone: presenting a complete risk-based audit engagement.
Conclusion
By successfully completing Risk-Based Internal Auditing (RBIA), participants will gain a practical command of governance, risk, and control foundations, ISO 31000 and COSO ERM risk frameworks, audit universe construction and risk assessment, risk-based audit plan development, engagement planning and control testing, and residual risk evaluation and opinion reporting. They will acquire skills in risk assessment, plan construction, control testing, and risk-focused reporting that focus audit effort where risk is greatest. Gentex Training Center designs the programme to help auditors apply risk-based auditing with confidence.
FAQs for the Risk-Based Internal Auditing (RBIA) course
— What is the "Risk-Based Internal Auditing (RBIA)" course about?
It prepares internal auditors to plan and deliver engagements driven by risk rather than by time. The course spans governance, risk and control foundations, ISO 31000 and COSO ERM frameworks, audit universe construction and risk assessment, risk-based plan development, engagement planning and control testing, and residual risk evaluation and reporting.
— What are the key benefits of the "Risk-Based Internal Auditing (RBIA)" course?
You gain a practical method for risk-based auditing that links the risks threatening organisational objectives with the assurance work that addresses them. The course improves risk assessment and plan construction, strengthens control design and operating effectiveness testing, sharpens residual risk evaluation, and gives you risk-focused reporting practice that directs audit effort where it matters most.
— What skills will I gain from the "Risk-Based Internal Auditing (RBIA)" course?
You will develop four core skills: governance, risk and control framework application with ISO 31000 and COSO ERM, audit universe construction and risk assessment, risk-based audit plan development and engagement planning, and control testing with residual risk evaluation and risk-focused reporting.
— What tools, methods, or standards are covered in the "Risk-Based Internal Auditing (RBIA)" course?
The course covers governance, risk and control and their relationship, risk-based auditing versus cyclical and compliance auditing, the IIA Global Internal Audit Standards and the audit charter, the three lines model and assurance coordination, risk appetite, tolerance and organisational objectives, risk classification methods, ISO 31000 principles, framework and process, the COSO ERM framework and its components, risk identification techniques and risk registers, risk analysis, evaluation and prioritisation, inherent risk versus residual risk, key risk indicators and risk reporting, audit universe construction and maintenance, risk assessment, scoring and ranking methodology, linking auditable entities to strategic objectives, risk-based audit plan construction and rationale, resourcing, capacity and plan flexibility, plan approval and communicating coverage gaps, engagement-level risk assessment, defining objectives, scope and criteria by risk, audit programme and test step design, control design assessment and walkthroughs, operating effectiveness testing and sampling, documenting evidence and working papers, evaluating control effectiveness and residual risk, forming and communicating an engagement opinion, risk-focused findings and root cause analysis, reporting to management and the audit committee, follow-up, risk movement and assurance mapping, and updating the plan from audit results.
— How is the "Risk-Based Internal Auditing (RBIA)" course applied in real-world practice?
Participants apply it to real work such as building a risk register for a business unit, constructing a risk-based audit plan with ranked entities, performing an engagement-level risk assessment, designing an audit programme around key risks, testing control operating effectiveness with sampling, evaluating residual risk and forming an engagement opinion, and updating the plan from results. The same methods support assurance mapping and audit committee reporting.
Partners in Learning
Our Partners in Learning include leading companies and organizations that trust Gentex Training Center for high-quality training courses and professional development programs. Together, we deliver impactful training programs that support skills growth, leadership development, and organizational excellence.
.png)
