The basics that matter: scope, risk and work programmes in the age of AI: virtual session

Overview

AI can now draft a risk assessment or a work programme in minutes. This is a real opportunity. But speed is not the same as quality. A longer work programme is not a better one, and an AI draft still needs the judgement of an experienced auditor.

Many audit teams still face the same basic problems: the scope grows during the assignment, work programmes take too long to prepare, and testing covers many details but misses the most important risks.

This practical course takes a lean, agile approach to assignment planning. You will see how AI can help at each step – from deciding what is in and out of scope, to building the engagement risk assessment and the work programme – while keeping your work focused and in line with the IIA Global Internal Audit Standards.

Target Audience

Internal audit managers and experienced audit staff.

Course Objectives & Description

• planning with a clear “golden thread” – linking the audit plan to each assignment, so the team stays focused
• choosing 2–3 “exam questions” – the key questions the assignment must answer
• different assignment types (for example review, audit or investigation) and the level of assurance each one gives
• deciding what is in and out of scope – using simple diagrams and tables, and using AI to suggest scope items and challenge your choices
• building the engagement risk assessment – using AI for a first draft of risks, causes and control objectives, then applying auditor judgement and the organisation’s risk appetite
• how to decide what is a key risk and a key control
• work programme templates – when they are too short and when they are too long
• reusable risk and control libraries in your audit or GRC tool – and how AI can draft tests from them, so you do not start from a blank page
• testing the design of controls individually, using SMART
• testing the design of controls in aggregate, using a COSO variant and risk appetite
• a “sprint” approach to testing – test the key controls first, then decide if you need to go deeper
• benchmarking to judge the impact of control failure – when to do this for individual controls and when to do it in aggregate
• finding root causes early, not only symptoms, but how work programme design can also ensure you get 'root causes as you go'
• using AI responsibly – checking AI output, protecting confidential data and keeping evidence of human review

The course includes live demonstrations of AI tools at each stage of planning. You do not need any previous experience of AI to take part.

Upon completion you will be able to:

• set a clear scope, with 2–3 priority questions and clear reasons for what is in and out of scope
• choose the right depth for each assignment and decide which controls to test
• use AI to prepare first drafts of scope, risk assessments and work programmes – and review these drafts critically
• build a work programme that is fit for purpose, using a library of key control objectives
• decide which controls to test first, using a sprint approach
• assess whether controls are well designed
• test controls in a streamlined way
• see the difference between symptoms and root causes
• explain the impact of control weaknesses, including compensating controls, so your findings are clear and convincing for management
• show how your planning meets the requirements of the IIA Global Internal Audit Standards