A focused course, tailored for you
Building Audit Findings That Survive Review
A skill course for audit analysts who need findings that hold up through QA, management response, and committee scrutiny.
The gap between a documented test exception and a finding that holds up through QA, management response, and audit committee review is exactly where senior analysts lose time and credibility.
$199 one-time
Tailored to your situation. Access within 24 hours. 30-day money-back.
Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.
Why this course
Writing an audit finding sounds straightforward once you have the evidence. But for most senior analysts, the finding goes back to QA not because the testing was wrong, but because the chain from test to conclusion had a gap a reviewer could see even when you couldn't. The exception was real, the workpaper was populated, but somewhere between 'this control is not operating effectively' and 'High-rated finding, management action required by next quarter' the argument broke down. QA returns it. You revise. Management disagrees. You revise again. This course teaches you to build that argument before anyone else sees it, so the chain from control objective to test design to exception to rated conclusion is traceable without explanation.
The 12 modules
Module 1. Risk-to-Control Linkage
Most QA gaps begin before testing starts, when the connection between the business risk and the specific control being tested is assumed rather than documented. This module teaches how to map from the risk statement in the audit scope through the control objective to the test procedure, so the rationale for every test step is traceable. Financial services examples drawn from credit risk, operational risk, and technology controls at regulated institutions.
Module 2. Walkthrough Design That Produces Evidence
A walkthrough that produces meeting notes is not the same as a walkthrough that produces audit evidence. This module covers how to structure a control walkthrough to capture defensible documentation: what to request before the meeting, what to observe during it, and what to record afterward. Includes the distinction between a process narrative and an evidence exhibit, and how APRA-supervised institutions document walkthrough results for supervisory file review.
Module 3. Test of Design versus Test of Operating Effectiveness
Applying the wrong test type to a control is itself a QA finding. This module covers when to use a test of design versus a test of operating effectiveness, how to document the distinction in the workpaper, and how the choice affects the nature and quantity of evidence required. Practical guidance on sample sizes for key financial controls, including those subject to APRA CPS 234 information security and CPS 230 operational resilience requirements.
Module 4. Exception Documentation That Holds
An exception documented as 'control not operating as designed' invites management to reframe it as an isolated incident. This module teaches how to write an exception that is specific, evidence-backed, and attributable to a systemic control failure. Covers the language that distinguishes an anomaly from a control deficiency, the evidence exhibits that support each characterisation, and how to document an exception so a reviewer cannot reinterpret it as something less.
Module 5. Building the Control Conclusion
The control conclusion is the point in the workpaper where most QA gaps appear: the jump from 'two exceptions found in a sample of thirty' to 'control is not operating effectively' is not automatic. This module teaches the logic chain from exception evidence to control assessment, including how to document the projection from sample to population, how to apply materiality in internal audit, and how to write the conclusion so it is self-contained and self-explanatory.
Module 6. Risk Rating Methodology for Financial Services
A High-rated finding at a prudentially regulated institution carries a higher evidence burden than the same rating at a smaller organisation. This module covers how to apply a likelihood-impact matrix consistently, how to document the rating rationale in a way that survives challenge, and how APRA expectations under CPS 520 and CPS 234 shape the evidence bar for each severity level. Includes the specific language regulators and audit committees expect to see supporting a High or Significant rating.
Module 7. Structuring the Audit Finding Document
The five-part finding structure: criteria, condition, cause, effect, recommendation. Each part has a specific job and a specific evidence burden. This module teaches how to write each section so the finding stands independently without the reviewer needing to return to the workpaper. Covers the common failure modes in each section: criteria too vague to support a High rating, cause statements describing symptoms instead of root cause, recommendations that are not actionable within the management response window.
Module 8. Handling Management Response
Management's response to an audit finding is the test of whether the finding was written well enough to withstand challenge. This module covers how to evaluate a management response for adequacy, what to accept versus what to escalate, how to write the final finding when management disagrees with the rating, and how to document disagreement in a way that protects the audit conclusion and the audit function's independence from the perspective of both the CAE and a prudential regulator.
Module 9. Workpaper Architecture and Cross-Referencing
A workpaper that requires explanation is a workpaper that will be revised. This module covers how to organise the workpaper file so any reviewer from QA, the CAE office, or an APRA examiner can follow the logic without asking you to walk them through it. File naming conventions, evidence indexing, cross-references between risk assessment, test steps, exception exhibits, and the control conclusion, structured so the path from identified risk to approved finding is self-evident.
Module 10. APRA Prudential Standards and Internal Audit Evidence
Internal audit at APRA-regulated institutions operates under specific obligations under CPS 510, CPS 234, and CPS 230. This module covers what those standards require of internal audit documentation, how supervisory visits assess internal audit workpapers, what types of evidence APRA examiners look for when reviewing findings related to operational resilience and information security controls, and how to align your workpaper standard to what a prudential supervisor expects when they open the audit file.
Module 11. From Finding to Audit Committee Pack
The path from your approved finding to the audit committee report involves summarisation, aggregation, and translation of detailed workpaper conclusions into a format that non-audit executives can assess and act on. This module covers how findings are prioritised and summarised for committee presentation, how management action tracking works, how repeat findings are presented, and what information the audit committee expects to assess about the adequacy of management response and the residual risk position.
Module 12. Pre-Submission Self-Review
The professional standard that separates senior analyst work from manager-level work is the ability to self-review before QA sees it. This module builds the self-review checklist: the evidence chain check, the rating calibration check, the management response adequacy test, the workpaper navigation test. Applied as a habit before every finding submission, this checklist reduces QA revision cycles and builds the consistent track record that supports the case for promotion to manager-level audit roles.
How this addresses your situation
Specific modules that map to what you said you are dealing with.
Finding returned for second revision: modules 4, 5, and 7 address the exception documentation, control conclusion, and finding structure gaps most commonly cited in QA review comments.
Management has disagreed with a High rating: module 8 covers the evidence standard required to hold a rating against challenge and how to document the disagreement without weakening the conclusion.
APRA supervisory visit scheduled or anticipated: modules 10 and 9 cover the workpaper standard and evidence documentation that prudential supervisors assess during file review.
Seeking promotion to audit manager: module 12 builds the self-review habit that distinguishes manager-ready output from senior analyst output, and module 6 covers the rating consistency that managers are assessed on.
Who it is for
Senior analysts in internal audit functions at financial services firms who conduct control testing, write findings, and manage the QA and management response cycle. You are accountable for the evidence chain on your own findings. You have had at least one finding returned with 'insufficient evidence' or 'conclusion not clearly supported.' You want to build findings that clear first-pass review consistently.
Who this is NOT for. Audit directors writing audit committee presentations. External auditors building attestation opinions. GRC analysts designing control frameworks from scratch. This course is for the analyst who conducts the test, documents the exception, and writes the finding.
How it arrives
Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.
Time investment. 3-4 hours per module, self-paced. The core evidence-to-finding cycle in modules 1-7 can be completed in a single week.
FAQ
Is this course specific to Australian financial services and APRA requirements?
The course is built around financial services audit context, including APRA prudential standards (CPS 234, CPS 230, CPS 510) and the evidence expectations of APRA supervisory visits. The core evidence methodology applies to any financial services internal audit function, but the regulatory examples and evidence standards are calibrated for APRA-regulated institutions.
What if my firm uses a different finding template from the one in the course?
The course teaches the underlying logic of finding construction, not any specific template. The evidence chain, the exception documentation standard, and the control conclusion methodology apply regardless of the template your firm uses. The downloadable templates are structured to the five-part finding logic that maps onto most firm templates directly.
I already have a strong testing methodology. Which modules are most relevant?
If testing is strong but findings still go back to QA, modules 5, 7, and 8 cover the control conclusion, finding structure, and management response cycle specifically. Module 12 adds the self-review habit that catches evidence chain gaps before submission.
