Internal Auditing Fundamentals

This two-day program builds a practical foundation in internal auditing, anchored in the IIA Global Internal Audit Standards 2024 (effective 9 January 2025) and the Indonesian regulatory regime (OJK / POJK, BI). It uses a consistent dual lens, every module pairs the global standard or framework  with the applicable Indonesian rule and supervisory expectation so participants leave with both the global vocabulary and the local rulebook positioned side by side. Cases are wei

After completing this 16-hour program, participants will be better able to:
* Read an audit charter and explain SKAI's mandate, independence, and Third-Line position under the IIA 2024 Standards and POJK 1/POJK.03/2019
* Contribute to a risk-based annual audit plan (Rencana Audit Tahunan) built from an audit universe and impact x likelihood scoring
* Scope and plan an engagement - objective, scope statement, and risk-control matrix (RCM)
* Execute fieldwork - select audit procedures, size an attribute sample, gather sufficient/reliable/relevant evidence, and prepare working papers
* Perform root-cause analysis (5 Whys, Fishbone) and write a defensible 5C finding in plain language
* Write an effective report presenting issues and executive summary effectively

Certificate (by PasarTrainer)

Training material

Learning Objectives:
* Apply standard audit procedures (inquiry, observation, inspection, recomputation, confirmation, analytical procedures) to a control test.
* Determine an appropriate attribute sample size using a sampling guide.
* Document audit work in working papers meeting sufficiency, reliability, relevance, and usefulness criteria.
* Conduct a structured walkthrough interview of an auditee.

Key Topics:
* Six audit-procedure categories and when to use each.
* Evidence quality: sufficient (quantity), reliable (source), relevant (assertion), useful (objective); reliability hierarchy: external > internal documented > inquiry/observation.
* Sampling: population definition, sampling unit, attribute vs. variables; simplified attribute sample-size guidance referencing AICPA tables (illustrative ladder - reconcile the answer key with the specific table and confidence level distributed).
* Documentation: working-paper standards, indexing, cross-referencing, review notes, retention.
* Data analytics 101: full-population testing with ACL/IDEA/Excel/Python - when CAATs replace sampling.
* Interview technique: open vs. closed questions, active listening, fraud-indicator red flags. Per ACFE Occupational Fraud 2024: 84% of fraudsters displayed at least one behavioural red flag; the most common, Living Beyond Means, appeared in 39% of cases.
* Walkthrough vs. test of operating effectiveness.

The fieldwork core: applying the six audit procedures, sizing an attribute sample, judging evidence quality, documenting working papers (kertas kerja audit), and conducting a structured walkthrough interview - with an intro to data analytics / CAATs.

Audit Execution and Evidence (105 min)

* Use Google Form to conduct test. Results set the cohort baseline and are compared against the Post-Test to evidence Apply-level learning gain.

A multiple-choice diagnostic to benchmark participants' baseline knowledge of internal-audit concepts, standards, and Indonesian regulation before the program.

Pre-Test (20 Questions - Closed Book)

Learning Objectives:
* Define internal auditing using the IIA Purpose statement (Global Internal Audit Standards 2024, Domain I).
* Distinguish assurance services from advisory / consulting services.
* Explain SKAI's placement as the Third Line in the IIA Three Lines Model (2020).
* Compare internal audit against external audit, compliance, risk management, and fraud investigation (scope and reporting line).

Key Topics:
* IIA Purpose of Internal Auditing - strengthens the organisation's ability to create, protect, and sustain value through independent, risk-based, objective assurance, advice, insight, and foresight (IIA 2024, Domain I).
* Assurance vs. consulting; independence and objectivity at function vs. individual level.
* Reporting lines under POJK 1/POJK.03/2019 (SKAI reports administratively to Direktur Utama, functionally to Komite Audit).
* Third Line in the IIA Three Lines Model (2020 replacement of the 2013 Three Lines of Defense).
* Standards & Regulations: IIA Global Internal Audit Standards 2024 - Domain I (effective 9 Jan 2025); IIA Three Lines Model (2020); POJK 1/POJK.03/2019.

Establishes what internal auditing is and is not - its IIA Purpose, the assurance vs. advisory distinction, independence and objectivity, and SKAI's place as the Third Line - and contrasts it with external audit, compliance, risk management, and fraud investigation in the Indonesian context.

Foundation of Internal Auditing

* 6A - Sampling Decision: Given a population of 4,800 credit-card limit-increase approvals in a quarter, tolerable deviation rate 5%, expected deviation rate 1%, determine an appropriate attribute sample size from the AICPA lookup table and justify. (Ensure the answer key matches the table and confidence level actually distributed.)
* 
* 6B - Walkthrough Role-Play: In triads (auditor, auditee, observer), the auditor conducts a 10-minute walkthrough of “petty-cash reimbursement” at a multifinance branch. The auditee follows a script; the observer scores using a rubric (open questions, evidence requested, clarifying follow-ups, identifying a planted control gap).

Two linked exercises: a statistical sample-size decision, and a triad walkthrough role-play scored on interview technique and gap detection.

“Sampling Decision” (6A) + “Walkthrough Role-Play” (6B)

Learning Objectives:
* Construct an audit finding using the 5C structure: Criteria, Condition, Cause, Consequence, Corrective Action.
* Apply the 5 Whys technique (Sakichi Toyoda / Toyota Production System) to identify a root cause.
* Apply the Ishikawa / Fishbone diagram to a process-level issue with multiple contributing factors.
* Distinguish root cause from symptom and contributing factor.

Key Topics:
* Anatomy of a finding (temuan): the 5C model.
* Severity classification: high/medium/low - taxonomies typical in Indonesian SKAI.
* RCA methods: 5 Whys (linear, Toyota); Fishbone/Ishikawa (Man, Method, Machine, Material, Measurement, Environment); Pareto (80/20).
* Common pitfalls: stopping at “human error,” confusing root cause with blame, treating symptoms.
* Linking RCA outputs to recommendations that address the root.

Teaches the anatomy of a finding (5C) and two root-cause techniques - 5 Whys and the Ishikawa/Fishbone diagram - with emphasis on distinguishing root cause from symptom and contributing factor.

Issue Identification and Root Cause Analysis

* Participants receive 12 organisational activities (e.g., approve a credit limit; test the AML transaction-monitoring rule; investigate a teller cash shortage; issue a Sharia opinion on a new murabahah product; certify financial statements).
* Each activity is individually assigned to: First Line, Second Line, Third Line, External Auditor, DPS, or Other.
* Tcrainer-led debrief reconciles answers and surfaces common boundary confusions."

Individual sorting exercise that cements the Three Lines boundaries: participants assign 12 real organisational activities to the correct line or party, then debrief.

“Whose Job Is It?”

* Apply 5 Whys to drill from symptom to root cause.
* Build a Fishbone categorising contributing factors across Man/Method/Machine/Material/Measurement/Environment.
* Draft three recommendations - one tactical, one process-level, one cultural/governance-level."

Groups receive a one-page narrative of a multifinance branch that lost Rp 850 million from fictitious motorcycle-financing approvals over six months, and drive from symptom to root cause.

Case Study. “Why Did the Multifinance Lose Rp 850 Million?”

Learning Objectives:
* Describe the five domains and 15 guiding principles of the IIA Global Internal Audit Standards 2024.
* Identify the four ethics principles (Integrity, Objectivity, Confidentiality, Competency) embedded in Domain II.
* Apply the Standards to an independence-impairment scenario.

Key Topics:
* The 2024 IPPF supersedes the 2017 IPPF from 9 Jan 2025; conformance now requires both attribute and performance evidence.
* Five domains: I Purpose; II Ethics & Professionalism; III Governing the IA Function; IV Managing the IA Function; V Performing IA Services.
* 15 principles across the domains; 52 standards structured Requirements
* Topical Requirements 
* Independence threats: self-review, familiarity, intimidation, advocacy, self-interest, management participation.
* Indonesia overlay: POJK 1/POJK.03/2019 SKAI charter and ethics.

Walks through the structure of the IIA Global Internal Audit Standards 2024 (5 domains, 15 principles, 52 standards) and the four ethics principles.

Professional Standards and Ethics

Learning Objectives:
* Write an audit finding paragraph using the 5C structure for a given condition.
* Structure a full audit report (executive summary, scope, opinion/conclusion, findings, management action plan).
* Apply plain-language writing principles to convert audit jargon into business-readable prose.
* Plan an exit meeting including audit-committee escalation criteria.

Key Topics:
* Report architecture: executive summary, background, scope and approach, overall conclusion/opinion, detailed findings, management response, appendices.
* Rating conventions in Indonesian FS SKAI: Satisfactory / Needs Improvement / Unsatisfactory; severity per finding.
* Writing for Komite Audit, Direksi, business-unit owner.
* Plain-language techniques: active voice, quantification, avoiding “should” without specifics, removing audit-speak.
* Exit-meeting agenda; agreement on facts; management-response capture; reporting timeline expectations.
* Reporting to OJK: half-yearly summary required for commercial-bank SKAI per POJK 1/POJK.03/2019; special-purpose reporting (investigations, special reviews, advisory).

Builds report-writing skill: structuring a full audit report, writing a 5C finding, converting audit jargon into business-readable plain language, and planning an exit meeting with escalation criteria.

Audit Reporting and Communication

* A: Spouse joins the Treasury department about to be audited next quarter.
* B: Auditee Direktur Operasional offers to “review and edit” a draft finding before Komite Audit.
* C: Former colleague - now auditee - is processing a personal credit-card application through controls you designed two years ago.
* D: Kepala SKAI orders dropping a finding because “Direksi has agreed to fix it informally.”
* Each pair identifies the IIA principle at risk, the threat type, and the appropriate safeguard.

Four independence/ethics scenarios rotated through pairs (5 min each); each pair names the IIA principle at risk, the threat type, and the safeguard (recuse, declare, escalate, refuse).

“Ethics Dilemma Carousel”

Learning Objectives:
* Describe the 5 components and 17 principles of COSO Internal Control - Integrated Framework (2013).
* Describe the 5 components and 20 principles of COSO ERM - Integrating with Strategy and Performance (2017).
* Outline the 8 principles, framework, and process of ISO 31000:2018.
* Map the Three Lines Model to roles in an Indonesian commercial-bank organisation chart.

Key Topics:
* COSO ICIF 2013 - five components (Control Environment; Risk Assessment; Control Activities; Information & Communication; Monitoring Activities); 17 principles must be present and functioning.
* COSO ERM 2017 - five components (Governance & Culture; Strategy & Objective-Setting; Performance; Review & Revision; Information, Communication & Reporting); 20 principles; spiral graphic replaced the 2004 cube.
* ISO 31000:2018 - eight principles; framework (leadership & commitment; design, implementation, evaluation, improvement); process (scope/context/criteria; risk identification + analysis + evaluation; treatment; communication & consultation; monitoring & review; recording & reporting).
* The IIA Three Lines Model in detail.

Introduces the three frameworks internal audit uses to evaluate governance, risk, and control - COSO ICIF (2013), COSO ERM (2017), and ISO 31000:2018 - and maps the Three Lines Model onto an Indonesian commercial-bank organisation chart with the relevant POJK governance rules.

Governance, Risk Management & Control Frameworks

* Rewrite using the 5C structure with plain language and a SMART recommendation (≤ 200 words).
* Peer-review rubric: criteria explicit; condition quantified; cause root-level; consequence linked to risk; recommendation SMART.

Participants receive a poorly-written, jargon-heavy 150-word draft and rewrite it in 5C structure, plain language, and a SMART recommendation (limit 200 words), then peer-review.

“Rewrite the Finding”

* Map COSO ICIF components against the observed control weaknesses.
* Identify the ISO 31000 process step missing from the bank's risk-register cycle.
* Assign Three Lines role ownership to each remediation.

Groups of 4-5 receive a one-page case of a mid-size Indonesian commercial bank (~Rp 50 trillion assets) and map weaknesses against the frameworks.

“Framework Mapping Workshop"

Learning Objectives:
* Explain the CAE / Kepala SKAI role in monitoring management's corrective action.
* Categorise outstanding findings by aging, risk severity, and commitment status.
* Design a basic follow-up dashboard for tracking open findings.
* Recommend escalation paths for overdue or unsatisfactorily-closed findings.

Key Topics:
* IIA Domain V on monitoring and follow-up.
* Status definitions: closed, partially closed, open, deferred, accepted-risk.
* Aging buckets typical in Indonesian banking SKAI: 0-90 days, 91-180, 181-365, >365.
* Verification of closure: independent re-test vs. management self-attestation - when each is appropriate.
* Risk acceptance: formal escalation to Dewan Komisaris / Komite Audit; documentation.
* Reporting open findings to Komite Audit per POJK 1/POJK.03/2019; GRC and audit-management tools (TeamMate, AuditBoard, Pentana, in-house).

Covers the CAE / Kepala SKAI role in monitoring management's corrective action: categorising open findings by aging and severity, designing a follow-up dashboard, and setting escalation paths for overdue or unsatisfactorily-closed findings.

Follow-Up and Monitoring

* Categorise by aging and severity.
* Flag the three to escalate at the next Komite Audit meeting.
* Draft a one-paragraph escalation note for one finding.

Groups receive an Excel register of 20 open findings of varying ages and risk ratings and triage it for the next Komite Audit meeting.

“The Open Findings Register”

Learning Objectives:
* Explain how the annual audit plan (RAT) is built from the audit universe and a risk assessment.
* Construct a basic risk-scoring matrix (impact x likelihood) for an audit universe.
* Apply OJK requirements for the annual plan and its approval (POJK 1/POJK.03/2019).
* Identify mandatory coverage cycles for high-risk auditable units in Indonesian banking.

Key Topics:
* Audit universe (semesta audit) - auditable units: processes, entities, locations, products, systems, regulatory themes.
* Risk factors: inherent drivers, control environment, complexity, change, time since last audit, regulatory exposure, fraud exposure.
* Quantitative vs. qualitative scoring; impact x likelihood matrices; heat maps.
* Risk-based plan: annual cycle, multi-year coverage, mandatory regulatory audits (APU-PPT/AML, IT, treasury, credit, Sharia compliance for BUS/UUS).
* Resource estimation; head-count, days per engagement, training buffer.
* Approval flow under POJK 1/POJK.03/2019: SKAI -> Direksi -> Komite Audit -> Dewan Komisaris; reporting to OJK on plan execution; continuous risk assessment and revision triggers.

Shows how the annual audit plan (Rencana Audit Tahunan) is built from the audit universe and a risk assessment, how to score units by impact x likelihood, and how OJK approval and mandatory coverage cycles shape the plan.

Risk-Based Audit Planning - Annual

* Use Google Form to conduct test. Compared against the Pre-Test to evidence learning gain; incorporates the Module 10 course-recap quiz.

A multiple-choice assessment of knowledge gained across all 10 modules; ≥ 24/30 earns a Certificate of Completion (Apply-level), below earns a Certificate of Attendance plus a 1-page remediation reading list.

Post-Test (30 Questions - Closed Book)

* (a) Score each unit 1-5 on impact and 1-5 on likelihood.
* (b) Compute composite scores.
* (c) Select the top 18 engagements assuming 6 auditors x 25 audit-days each.
* (d) Flag mandatory regulatory audits regardless of score.

Groups receive a 30-line audit universe for a fictitious bank (Bank Pembiayaan Nusantara, Rp 80 trillion assets, 120 branches, with a Sharia UUS) and build a one-year plan.

“Building the Annual Plan”

Learning Objectives:
* Draft an engagement objective and scope statement consistent with IIA Domain V.
* Develop a basic engagement-level risk and control matrix (RCM).
* Prepare a work programme with test steps, sample sizes, and evidence types.
* Plan resource allocation, an entry meeting, and a 4-week timeline.

Key Topics:
* From annual plan to engagement: engagement memo, Surat Penugasan, terms of reference.
* Setting objectives, scope, and criteria.
* Preliminary survey: walkthroughs, policy review, prior audit results, KRIs, incident logs, regulator findings.
* RCM: risk -> control -> control attribute (preventive/detective; manual/automated; key/non-key) -> test approach.
* Work programme: test of design (ToD) vs. test of operating effectiveness (ToE); sample-sizing primer (attribute, judgemental, statistical).
* Entry meeting agenda and attendees (business owner, Komite Audit observer where relevant, DPS for Sharia scope); time budget, milestones, escalation.

Takes participants from the annual plan to a single engagement: drafting an objective and scope, building a risk-control matrix (RCM), and preparing a work programme with test steps, sample sizes, and a 4-week timeline.

Engagement Planning - Per-Audit

* Draft one engagement objective.
* List three in-scope and three out-of-scope items.
* Build an RCM with five risks and five controls.
* Define the test approach for two controls.
* Peer-review against a rubric.

Each participant receives a one-page process narrative (CDD/KYC, credit scoring, limit approval, card issuance) at a commercial bank and scopes the engagement individually, then peer-reviews.