Training Course: Public Sector Internal Audit: Risk-Based Engagements

Public sector internal audit is the independent assurance and advisory work that tests whether a government entity's risk management, controls and operations protect public funds and deliver services as intended. This ten-day course is for internal auditors and audit team leaders in public bodies, and its final deliverable is a complete risk-based engagement file, from audit plan to evidence, findings, report and follow-up plan.

Introduction

Three references frame the course. The Global Internal Audit Standards, issued by The Institute of Internal Auditors, set the principles and requirements for professional internal audit work. The COSO Internal Control – Integrated Framework defines five components of an internal control system. The Three Lines Model clarifies how management, oversight functions and internal audit share responsibility. The level is practitioner, extended over ten days so that every stage of an engagement is practised on public sector cases, including a service directorate and a procurement file.

Course Objectives

• Distinguish the assurance and advisory roles of internal audit and define its position within public sector governance
• Apply risk mapping to prepare a risk-based annual and medium-term audit plan for a public entity
• Compare control design with operating effectiveness and interpret weaknesses using the COSO Internal Control framework
• Apply interviews, observation, document review and data analysis to gather sufficient and appropriate evidence
• Apply the condition, criteria, cause and effect structure to draft findings and justify measurable recommendations
• Select follow-up indicators and judge whether corrective actions have improved control and performance

Target Audience

• Internal auditors in ministries, agencies and municipalities, who must decide which areas of the audit universe receive coverage
• Audit team leaders running engagements, who must judge whether evidence is sufficient and appropriate to support a finding
• Heads of small public sector audit units, who must choose how to allocate limited auditor time across risks
• Risk, compliance and inspection officers moving into internal audit, who must assess how audit methods differ from monitoring
• Audit committee secretariat and quality staff, who must determine whether reports and follow-up give decision-makers what they need

Course Outline

Day 1: The Strategic Role of Public Sector Internal Audit

• Assurance vs Advisory Roles: Two Ways Internal Audit Adds Value in Government
• Evolution of Internal Audit in Government Entities: From Compliance Checking to Risk Insight
• Internal Audit, Governance and Public Funds: Accountability, Transparency and Efficiency Links
• Position in the Institutional Control System: The Three Lines Model in Public Bodies
• Global Internal Audit Standards: Principles and Requirements Applied to Public Sector Functions

Day 2: The Public Sector Environment and Its Risks

• Operational vs Regulatory Risks: Service Delivery Failures Compared with Legal Breaches
• Nature of Public Entities: Service Delivery Requirements and Multiple Stakeholders
• Public Spending, Resource and Asset Risks: Where Public Funds Are Most Exposed
• Risk and Service Quality Links: Connecting Exposures to Institutional Performance
• Risk Map Exercise: Developing a Risk Map for a Sample Public Entity

Day 3: Risk-Based Audit Planning

• Annual vs Medium-Term Audit Plans: Short Cycles Compared with Multi-Year Coverage
• High-Impact Audit Areas: Identifying Audit Universe Entries with the Greatest Public Effect
• Strategic Alignment of the Plan: Linking Audit Priorities to Entity Objectives
• Resource and Time Allocation: Matching Audit Effort to Risk Level and Process Importance
• Audit Plan Exercise: Preparing a Risk-Based Plan for a Public Institution

Day 4: Governance and Internal Control Assessment

• Control Design vs Operating Effectiveness: Testing Whether Controls Exist and Actually Work
• COSO Internal Control Framework: Five Components Applied to Government Operations
• Authorities, Responsibilities and Approval Channels: Assessing Their Clarity in Public Entities
• Control Weaknesses: Identifying Causes and Linking Them to Institutional Risks
• Control Assessment Exercise: Evaluating Financial and Administrative Controls in a Public Entity

Day 5: Auditing Government Operations and Efficiency

• Efficiency vs Effectiveness: Resources Used Compared with Objectives Achieved
• Service Delivery Process Audits: Mapping Steps, Delays and Handovers in Government Services
• Resource Use Review: Human, Financial and Operational Inputs Measured Against Outputs
• Compliance with Approved Procedures: Testing Adherence to Policies and Delegated Authorities
• Process Review Exercise: Extracting Waste, Duplication and Improvement Opportunities

Day 6: Auditing Public Spending, Procurement and Contracts

• Procurement vs Contract Execution Audits: Award-Stage Compared with Delivery-Stage Risks
• Public Spending Cycle: Reviewing Controls from Budget Planning Through to Payment
• Tendering and Award Procedures: Testing Fairness, Documentation and Approvals
• Payments, Claims and Approvals: Controls That Prevent Overpayment and Duplicate Claims
• Procurement File Exercise: Spotting Waste, Conflict-of-Interest and Weak Control Indicators

Day 7: Engagement Execution and Audit Evidence

• Sufficient vs Appropriate Evidence: Quantity Compared with Relevance and Reliability
• Detailed Engagement Plan: Matching Audit Tests to Engagement Scope and Objectives
• Examination Techniques: Interviews, Observation, Document Review and Data Analysis
• Working Paper Documentation: Organised, Referenced and Reviewable Engagement Records
• Engagement File Exercise: Handling Limited Data and Weak Cooperation from Departments

Day 8: Analysing Results and Developing Findings

• Condition vs Criteria: Establishing the Gap That Defines an Audit Finding
• Cause and Effect Analysis: Explaining Why Gaps Occur and What They Cost
• Finding Severity Rating: Setting Treatment Priorities by Risk and Impact
• Measurable, Implementable Recommendations: Addressing Causes Rather Than Visible Symptoms
• Findings Discussion and Drafting Exercise: Agreeing Facts with Departments Before Reporting

Day 9: Audit Reports for Decision-Makers

• Detailed Report vs Executive Summary: Two Layers Written for Different Readers
• Report Structure: Clear, Concise Content Focused on Senior Management Decisions
• Impact Presentation: Showing Effects on Performance, Resources and Public Services
• Prioritising Findings and Recommendations: Ordering by Risk and Expected Benefit
• Report Quality Review: Testing Accuracy, Objectivity and Implementability Before Issue

Day 10: Follow-Up Practice and the Complete Engagement

• Follow-Up vs Re-Audit: Tracking Agreed Actions Compared with Retesting Controls
• Follow-Up Plan and Impact Indicators: Applying Recommendations to Measurable Targets
• Post-Implementation Assessment: Applying Control Tests to Confirm Real Improvement
• Follow-Up Report: Applying Reporting Rules to Progress, Challenges and Required Actions
• Complete Engagement File: Finalising Plan, Evidence, Findings, Report and Follow-Up Plan

Skills You Will Gain

• Public Sector Risk Mapping
• Risk-Based Audit Planning
• Control Testing
• Procurement Audit
• Evidence Gathering
• Finding Development
• Audit Report Writing
• Recommendation Follow-Up

Why Attend This Course

• From audits chosen by habit or rotation to a plan ranked by risk to public funds and services
• From checking that procedures exist to testing whether controls work and what their weaknesses cost
• From findings that only describe problems to findings stating condition, criteria, cause, effect and a measurable remedy
• From reports filed and forgotten to a complete engagement file with a follow-up plan and impact indicators

Conclusion

Internal audit in a public body earns its place by showing, with evidence, where public money and services are at risk and whether agreed fixes have worked. The course clarifies three distinctions: assurance versus advisory work, control design versus operating effectiveness, and follow-up versus re-audit. It is the right choice for public sector auditors and team leaders who want ten days to practise every stage of an engagement, rather than a shorter overview of the internal audit role.

Course FAQs

What is public sector internal audit?

Public sector internal audit is independent, objective assurance and advice inside a government entity, testing whether risk management, controls and operations protect public funds, comply with rules and deliver services efficiently, and reporting results to senior management.

What is the difference between control design and operating effectiveness in public sector internal audit?

Control design asks whether a control, as written, would prevent or detect the risk. Operating effectiveness asks whether that control actually worked consistently during the period, which auditors test through sampling, observation and re-performance.

Which standards does public sector internal audit training follow?

The course follows the Global Internal Audit Standards of The Institute of Internal Auditors for engagement work, the COSO Internal Control – Integrated Framework for assessing controls, and the Three Lines Model for roles.

Is public sector internal audit training right for an audit team leader?

Yes. An audit team leader plans engagements, reviews working papers and signs off findings, and the sessions on evidence sufficiency, finding severity, report structure and follow-up design match those responsibilities directly.

What do delegates produce in public sector internal audit training?

Delegates produce a complete engagement file for a public entity case, containing a risk map, a risk-based audit plan, control test results, working papers, drafted findings, an audit report and a follow-up plan with impact indicators.