Description

A focused course, tailored for you

The Internal Audit Data Analytics Senior's Continuous Testing Playbook

Build the scripts, sampling logic, and exception triage that turn brokerage and banking data into audit committee evidence.

Your IA function has the data. Trade blotters, client onboarding journals, wire approval logs, entitlement extracts, AML alerts. The reviewer keeps asking why your quarterly tests are still n=25 judgmental samples. This is the playbook for moving the audit plan from sampling to continuous testing without losing the workpaper rigor a regulator's examiner expects.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Internal audit data analytics seniors at large broker-dealers and custody banks live in a specific gap. The data exists in queryable form, the audit committee is asking for population-level assurance, and the audit methodology manual still describes sampling-based testing with documented selection rationale. The senior is the person who has to bridge that gap. Translate a control objective into a query, defend the exception threshold to the audit director, document the work so it survives examiner challenge, then convince the in-charge auditor that the script result is workpaper evidence. The skill is not analytics in the abstract. It is the script library, the threshold logic, and the workpaper standards that make data-driven audit work hold up under review.

What you walk away with

Convert three judgmentally-sampled control tests in your current audit plan to full-population continuous testing.
Write the SQL and Python that pulls brokerage trade, client onboarding, and entitlement data into reproducible workpaper evidence.
Set exception thresholds that the audit director and audit committee will accept as risk-based and defensible.
Document continuous testing in workpapers that survive external auditor and regulatory examiner review.
Build a reusable script library so the next audit cycle runs in hours, not weeks.

The 12 modules

Module 1. From sampling memo to population query

How a control objective in the audit methodology translates into a population definition the data lake can return. Worked example on a trade-execution control: source system, time window, exclusions, completeness check against the source-of-truth ledger. The senior writes the population query, the in-charge auditor signs off the scope, the workpaper holds the SQL and the completeness reconciliation as the evidence of population integrity.

Module 2. Brokerage trade surveillance exception logic

Continuous testing patterns for trade surveillance controls. Marking-the-close, wash trades, layering, suitability deviations. How to write the exception logic so it flags only genuine anomalies, not noise. The threshold-setting conversation with the surveillance team and the audit committee. How to document false-positive analysis so the workpaper shows your threshold is risk-based, not arbitrary.

Module 3. Client onboarding and AML continuous controls

Testing customer identification, beneficial ownership, sanctions screening, and enhanced due diligence as continuous controls instead of monthly samples. Joining the CIP database, the screening hit log, and the EDD workflow into a single exception pipeline. How to scope the population for retail brokerage versus institutional custody, and how to handle the privileged-data access agreement with the BSA officer.

Module 4. Suitability and Regulation Best Interest analytics

Reg BI care-obligation testing using the actual recommendation log, customer profile data, and product attributes. How to build the deviation flag that identifies recommendations outside the customer's stated objectives, and how to age the exception list so the audit committee sees the trend, not just the count. Workpaper standards for documenting the rule logic and the recommendation-population completeness.

Module 5. Entitlement and segregation-of-duties testing at scale

Pulling the entitlement extract from the access management system, joining it to the role catalog, and running the toxic-combination matrix continuously instead of quarterly. How to document the SoD ruleset so the workpaper shows business sign-off on what counts as a conflict. Handling privileged access reviews, fired-employee access removal, and the cross-system joiner-mover-leaver test in one continuous pipeline.

Module 6. FINRA 4511 and SEC 17a-4 retention evidence

Continuous testing of books-and-records retention controls. How to query the archive index, prove WORM storage compliance for the records in scope, and document the sample-versus-population distinction for the regulator. Workpaper standards for retention-period calculations, hold-list reconciliation, and the chain-of-custody documentation that examiners challenge first.

Module 7. Sampling logic that survives audit committee review

When continuous testing is not appropriate and a sample is still the right answer. Stratified sampling, monetary-unit sampling, and risk-based attribute sampling written in Python with documented seed values so the work is reproducible. How to defend the sample size to the audit director and how to write the workpaper so an external auditor relying on your work accepts the methodology.

Module 8. Exception triage and follow-through

What you do with the 800 exceptions the script returned. Triage logic that ranks by financial impact, regulatory severity, and likelihood of root cause. How to set the threshold for what goes into the workpaper as a tested exception versus what is filtered as data-quality noise. The standing conversation with the control owner about remediation, and the tracking log that closes the audit.

Module 9. Workpaper standards for analytics evidence

Translating a script result into workpaper evidence that holds up under external auditor and regulator review. Version control for the scripts, evidence of the population completeness check, documented reviewer note responses, and the index that links the analytics output back to the control objective. How to handle the external auditor's request to reperform your work.

Module 10. The continuous auditing reporting cadence

Building the dashboard the audit director takes to the audit committee. Exception trends by control, remediation aging, and the heat map that shows where continuous testing is generating value. The reporting cadence that maintains audit committee engagement without overwhelming them, and the narrative that explains why the exception count went up when actually testing improved.

Module 11. Coordinating with the data warehouse team

The working relationship that makes audit analytics sustainable. How to scope a data-pull request, document the data-lineage dependency, and handle the case where the source system changes after the script went live. Privileged access for audit, separation from the production reporting team, and the SLAs that keep the audit cycle on schedule when source data is late.

Module 12. Building the senior's reusable script library

How to architect a script library that compounds across audit cycles. Naming conventions, parameter handling, the reusable completeness-check helper, the threshold-logic library, and the workpaper-export template. How to onboard the next senior so they inherit the library and contribute back to it. The artefact the senior leaves behind that makes the next audit cycle faster than the last.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

When the audit committee asks why quarterly tests are still sample-based: modules 1, 2, 7, 10.

When the external auditor wants to rely on your continuous testing: modules 6, 9.

When the regulator's examiner is reviewing your workpaper file: modules 6, 7, 9.

When you're building the data-team relationship that lets the audit plan scale: modules 11, 12.

What you get with this course

The 12-module written course in the Art of Service learning environment.
Downloadable SQL and Python script templates for each of the 12 modules.
Workpaper exhibit templates for population completeness, exception triage, and threshold documentation.
The hand-built implementation playbook scoped to three control tests in your current audit plan.
30-day money-back guarantee.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours: learning environment account provisioned and tailored implementation playbook delivered alongside it.

Weeks 1-2: complete modules 1-4 and pick three controls from the current audit plan for continuous testing conversion.

Weeks 3-4: complete modules 5-8 and write the first continuous-testing scripts against real data extracts.

Weeks 5-6: complete modules 9-12 and deliver the workpaper package for audit-in-charge review.

Week 7: present the continuous-testing dashboard to the audit director, with the next three control candidates queued.

Before and after

Before

Quarterly control tests run for two to three weeks. Sampling memos defend a population scope the audit committee no longer accepts. Each new senior rebuilds the script library from scratch. Reviewer notes ask why population-level testing wasn't used when the data was queryable.

After

Three control tests in the current cycle convert to continuous testing. The script library is reusable across audits. Workpaper evidence stands up to external auditor reperformance and examiner challenge. The audit committee dashboard shows exception trends, not just counts.

What happens if you do not address this

The audit committee keeps asking why testing is still sample-based when the data exists. External auditors document a reliance gap on your work. The regulator's examiner challenges sampling rationale. The next senior inherits no script library and rebuilds from zero, again.

Who it is for

Internal audit seniors and managers in data analytics roles at broker-dealers, custody banks, asset managers, and bank holding companies. Three to eight years of audit experience, SQL or Python fluency, a CIA or CISA in progress or complete. The person who sits between the audit-in-charge and the data warehouse team. Comfortable with controls testing, learning the analytics craft on the job.

Who this is NOT for. Not for first-year staff auditors who haven't yet led a control test. Not for pure data scientists outside the audit function. Not for IT general controls specialists looking for ITGC depth. The course assumes you already know what a control objective is, what a workpaper looks like, and what your audit committee accepts as evidence.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable SQL and Python script templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Six to seven weeks elapsed, roughly four to six hours per week. Heavier in weeks 3-4 when first scripts are written against live data extracts.

Why $199 is the right number

A CIA or CISA refresher teaches audit theory without the script craft. Free SQL tutorials teach the language without audit-committee-acceptable workpaper standards. Vendor analytics platforms package the tooling but not the methodology a senior auditor uses to defend the work. This course is the bridge: the script craft, the threshold logic, and the workpaper standards that make data-driven audit work hold up under review.

FAQ

Do I need to be a strong Python or SQL developer to start?

Working fluency is enough. The course assumes you can read a SELECT statement and write a basic Python function. The depth is in the audit-specific logic, not the language syntax.

Will this work if my firm's data lake is still partially mainframe-based?

Yes. Several modules cover extraction patterns where the source is a nightly batch file from a legacy system. The completeness-check methodology is the same regardless of source.

Can I share the script library with the rest of the IA analytics team?

Yes. The licence covers the buyer's audit team. The implementation playbook is scoped to your three controls, but the script templates and workpaper exhibits are usable across the function.

How does the implementation playbook get built?

After purchase, you share the three controls you want to convert first. The playbook is hand-built around those three, with the specific SQL, threshold logic, and workpaper exhibit each one needs. Delivered alongside course access.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.