ISO 31000 Risk Management Internal Auditor

Module 1: Introduction to Risk Management Auditing

• Purpose of risk management auditing
• Internal audit concepts
• Risk management assurance
• Auditor responsibilities
• Audit objectives
• Organisational value

Module 2: Understanding ISO 31000

• Purpose of ISO 31000
• Scope and application
• Key terminology
• Risk management guidance
• Organisational application
• Relationship with internal auditing

Module 3: ISO 31000 Risk Management Principles

• Integrated approach
• Structured approach
• Customisation
• Inclusive risk management
• Dynamic risk management
• Continual improvement

Module 4: Risk Management Framework

• Leadership and commitment
• Integration
• Framework design
• Implementation
• Evaluation
• Framework improvement

Module 5: Understanding the Risk Management Process

• Communication and consultation
• Scope and context
• Risk criteria
• Risk assessment
• Risk treatment
• Monitoring and review

Module 6: Internal Audit Fundamentals

• Audit principles
• Independence
• Objectivity
• Confidentiality
• Evidence-based approach
• Professional judgement

Module 7: Establishing Audit Objectives and Scope

• Audit objectives
• Audit scope
• Audit boundaries
• Audit criteria
• Organisational processes
• Stakeholder expectations

Module 8: Risk-Based Audit Planning

• Identifying audit priorities
• High-risk areas
• Process significance
• Previous findings
• Resource planning
• Audit scheduling

Module 9: Preparing the Internal Audit

• Reviewing documentation
• Understanding processes
• Audit questions
• Audit checklists
• Sampling approach
• Working documents

Module 10: Conducting the Opening Meeting

• Introductions
• Confirming objectives
• Confirming scope
• Audit methodology
• Communication arrangements
• Audit schedule

Module 11: Gathering Audit Evidence

• Interviews
• Observation
• Document review
• Record examination
• Sampling
• Evidence verification

Module 12: Auditing Organisational Context

• Internal context
• External context
• Stakeholder considerations
• Organisational objectives
• Risk environment
• Changes in context

Module 13: Auditing Risk Identification

• Risk identification methods
• Risk sources
• Events and causes
• Consequences
• Emerging risks
• Completeness of risk identification

Module 14: Auditing Risk Analysis

• Likelihood assessment
• Consequence assessment
• Existing controls
• Risk levels
• Assessment methodology
• Consistency of analysis

Module 15: Auditing Risk Evaluation

• Risk criteria
• Risk prioritisation
• Risk acceptance
• Escalation
• Decision-making
• Evaluation consistency

Module 16: Auditing Risk Treatment

• Treatment options
• Treatment plans
• Responsibilities
• Resources
• Target dates
• Residual risk

Module 17: Auditing Risk Controls

• Control design
• Control implementation
• Preventive controls
• Detective controls
• Corrective controls
• Control effectiveness

Module 18: Auditing Risk Registers and Documentation

• Risk register completeness
• Risk descriptions
• Risk ownership
• Risk ratings
• Treatment actions
• Document maintenance

Module 19: Auditing Monitoring and Reporting

• Risk monitoring
• Key risk indicators
• Control monitoring
• Risk reviews
• Management reporting
• Escalation processes

Module 20: Developing Audit Findings

• Evaluating evidence
• Audit observations
• Identifying weaknesses
• Finding statements
• Supporting evidence
• Communicating findings

Module 21: Audit Reporting and Follow-Up

• Audit report structure
• Audit conclusions
• Reporting findings
• Management responses
• Follow-up activities
• Verifying improvement actions

Module 22: Improving Risk Management Through Internal Audit

• Identifying improvement opportunities
• Lessons from audit results
• Recurring weaknesses
• Risk management maturity
• Strengthening risk culture
• Continual improvement