Internal Audit Fundamentals Training Course: Mandate, Independence, Evidence and Reporting

Programme Summary

Internal audit fundamentals is the subject of this one-week training course for new and developing auditors, audit managers and control staff moving into assurance, ending in an audit engagement file for one process. Organisations ask internal audit to give reliable assurance, yet the work is often done without a clear mandate, protected independence or evidence that survives challenge. The programme builds the working basics: the mandate, ethics, risk-based planning, evidence, findings and reporting, applied to a process the participant selects. Mars Training Centre UK delivers this programme on internal audit fundamentals to mixed-organisation cohorts.

The Business Case

When auditors lack a shared method, reports vary in quality, findings are disputed and agreed actions are not followed through. A common foundation lets audit teams plan from risk, record evidence in a form others can review and report conclusions that managers accept and act on.

• Report Quality: Improves as findings carry criteria, condition, cause and effect.
• Action Closure: Rises as follow-up is planned and tracked against agreed dates.
• Assurance Coverage: Becomes clearer as plans are tied to ranked risks.

Principles and Evidence Base

• Global Internal Audit Standards: Published by the Institute of Internal Auditors in five domains and 15 principles, they shape the whole programme, with Session 1 covering purpose, ethics and professionalism.
• Three Lines Model: Session 1 uses this model from the same Institute to place management, internal audit and the governing body in relation to each other.
• Risk-based planning: Session 2 applies this principle from the Standards to rank auditable areas and set engagement scope.
• Quality assurance and improvement: Session 5 applies this principle to review the participant's own engagement file.

Intended Participants

• Auditors who plan and carry out engagements and need a consistent method.
• Audit managers who supervise fieldwork and review working papers.
• Finance, risk and compliance staff moving into an assurance role.
• Heads of small audit teams who are setting up methods and files.

Typical settings include banks, public bodies, utilities, manufacturers and healthcare organisations.

Learning Outcomes

1. Participants will be able to explain the audit mandate and position it within the Three Lines Model.
2. Participants will be able to evaluate threats to independence and objectivity and select safeguards.
3. Participants will be able to construct a risk-based engagement plan with scope, criteria and test steps.
4. Participants will be able to assess evidence for relevance, sufficiency and reliability.
5. Participants will be able to formulate findings with root cause and ranked recommendations.
6. Participants will be able to justify a reporting and follow-up approach to a manager or committee.

Programme Structure

Day 1: Internal Audit Fundamentals, Mandate and Ethics

What is internal audit for, and what protects its independence?

• Purpose of Internal Auditing Domain
• Three Lines Model Map
• Audit Charter Elements
• Ethics and Professionalism Principles
• Independence Threat Register

Day 2: Risk-Based Planning and Engagement Scope

How does an auditor choose what to audit and how deeply?

• Audit Universe Listing
• Risk Ranking Matrix
• Annual Plan Rationale
• Engagement Objectives and Scope
• Audit Criteria Selection

Day 3: Fieldwork, Evidence and Working Papers

What counts as sufficient evidence for a conclusion?

• Process Walkthrough Notes
• Control Test Design
• Sampling Approach Sheet
• Evidence Reliability Rating
• Working Paper Standard

Day 4: Findings, Reporting and Follow-Up

How are results written so that managers accept and act on them?

• Finding Structure of Criteria, Condition, Cause and Effect
• Root Cause Questions
• Recommendation Ranking Scale
• Report and Summary Layout
• Action Tracking Log

Day 5: Applying the Tools to One Engagement File

Do the planning, evidence and reporting tools form one defensible file?

• Applying the Session 1 Independence Threat Register
• Using the Session 2 Risk Ranking Matrix
• Checking the Session 3 Evidence Reliability Rating
• Reviewing the Session 4 Report and Summary Layout
• Completing the Engagement File

Methodology

The programme uses structured exercises built on a single running case. Participants work in mixed teams on an anonymised process description, a risk register extract, sample transaction listings and draft working papers. Teams plan, test and report as an audit team would, challenge each other's evidence and receive written facilitator feedback on every exercise set.

• Suggested activity: Ranking auditable areas from a risk register and defending the order.
• Suggested activity: Rating a set of documents for reliability and deciding what more is needed.
• Suggested activity: Rewriting a weak finding so that cause and effect are clear.

Capstone Output

Each participant completes an audit engagement file for one process. It holds the engagement objectives and scope, a risk and criteria summary, a test programme, evidence ratings, two written findings with recommendations and a follow-up plan. The file is used at work as a template for the next engagement and as a briefing for a reviewing manager.

Frequently Asked Questions

Is internal audit fundamentals suitable for staff who have never audited?

Yes. Internal audit fundamentals is taught at foundation level through a running case and worked examples, so no audit experience is required, though familiarity with business processes is assumed.

Which standards does internal audit fundamentals rest on?

Internal audit fundamentals rests on the Global Internal Audit Standards and the Three Lines Model, both from the Institute of Internal Auditors.

How is the engagement file from internal audit fundamentals used at work?

You use the engagement file as a template for your next audit, as a briefing for a reviewing manager and as a model for the working paper standard in your team.

How do internal audit fundamentals differ from a risk management programme?

Internal audit fundamentals concern independent assurance, evidence and reporting on how risks are managed, while a risk management programme teaches how to identify, assess and treat risk itself.