Description

A focused course, tailored for you

The Internal Audit Associate Playbook for Index and ESG Data Providers

Run substantive testing across index methodology, ESG ratings, and benchmark administration that passes senior review first time.

The walkthrough memo gets marked up because the control owner gave a verbal and the evidence pack only contains the post-event reconciliation.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Internal audit associates at index, benchmark, and ESG data providers sit in a strange spot. The control universe is partly technology general controls, partly methodology governance, partly third-party data vendor reliance, partly SOC 1 carve-out evidence that downstream asset-manager clients depend on. The standard internal audit toolkit assumes a single financial-statement-anchored control environment, and most external rotations into in-house roles arrive with bank or asset-manager audit muscle memory that does not map cleanly. The walkthrough for a benchmark administration control reads as adequate until the senior asks who signs off the constituent change before publication, what the four-eye evidence looks like between rebalance windows, and whether the methodology committee minute is in the file. The ESG rating walkthrough reads as adequate until the senior asks for the override log, the analyst rationale, the data vendor source, and the committee approval before publication. The third-party SOC 1 reliance section reads as adequate until the senior asks which complementary user entity controls were tested at the provider and whether the SOC 1 covered the full audit period. Each gap is fixable in the planning phase if the associate knows what to ask for. None of them are fixable at draft-report stage.

What you walk away with

Plan and execute a benchmark administration walkthrough that the senior signs off without rewrite, including four-eye constituent change evidence and methodology committee minute references.
Draft an ESG rating override sampling plan that captures analyst rationale, data vendor source citation, and committee approval timestamps for every selected exception.
Test third-party data vendor SOC 1 reliance by identifying complementary user entity controls in scope and confirming SOC 1 coverage of the full audit period.
Build a model risk testing programme for factor and climate models that addresses calibration, back-testing, and methodology committee oversight in proportion to model criticality.
Produce an SSAE 18 SOC 1 carve-out evidence pack for the downstream client base that survives the asset-manager auditor's review without follow-up requests.

The 12 modules

Module 1. The index and ESG data provider control universe

Map the full control universe specific to an index, benchmark, and ESG data provider. Distinguish methodology governance controls from operational benchmark administration controls, ESG rating production controls, third-party data ingestion controls, model risk controls, and client-facing SOC 1 controls. Walk the rotation matrix that determines which controls test annually versus on a multi-year cycle and how associate-level testing fits each cycle.

Module 2. Benchmark administration under IOSCO principles

Work through the IOSCO principles for financial benchmarks and the controls they require around oversight, methodology, quality of input data, governance, and accountability. Plan a walkthrough that asks the right questions of the index oversight committee secretary, the methodology owner, and the production operations lead. Identify the four-eye evidence for constituent changes between rebalance windows.

Module 3. Methodology governance and change control

Test the methodology committee charter, meeting minutes, change request log, impact analysis, and client communication trail. Sample methodology changes across the audit period and tie each one back to committee approval, technical implementation evidence, and client notification timing. Identify common gaps like undocumented urgent changes and methodology committee quorum failures.

Module 4. ESG rating production and override governance

Walk the ESG rating production pipeline from source data ingestion through analyst rating, committee review, override governance, and publication. Test the override log for analyst rationale, data vendor source citation, and committee approval timestamps. Sample published ratings and tie back to the underlying evidence pack. Address the rating action policy and conflict-of-interest controls.

Module 5. Third-party data vendor reliance and SOC 1 review

Identify every third-party data vendor in scope. Read each vendor SOC 1 report for the period coverage, scope, complementary user entity controls, and any qualifications. Map the user entity controls back to the in-house control environment and test them. Document the reliance memo the manager signs before relying on the SOC 1.

Module 6. Model risk for factor and climate models

Apply model risk principles to factor models, ESG materiality models, climate transition models, and physical risk models. Test the model development documentation, validation report, back-testing results, calibration evidence, and methodology committee oversight in proportion to model criticality. Identify the model inventory and the model owner sign-off for each model in scope.

Module 7. Data quality controls across the ingestion and publication pipeline

Test data quality controls at ingestion, transformation, calculation, and publication stages. Walk the exception handling process for missing data, late data, and corrected data. Test the four-eye sign-off on data overrides and the audit trail for every intervention. Sample published values and tie back to the source data and the calculation evidence.

Module 8. Client SOC 1 carve-out evidence and complementary user entity controls

Build the SSAE 18 SOC 1 evidence pack the downstream asset-manager and bank client auditor consumes. Document the in-scope controls, the carve-out controls, the complementary user entity controls the client must perform, and the test evidence for each. Address the unique reliance pattern where downstream client auditors test the data provider's controls every cycle.

Module 9. IT general controls and application controls in the data pipeline

Test access management, change management, computer operations, and program development across the index calculation engine, the ESG rating platform, the data ingestion services, and the publication infrastructure. Sample privileged access reviews, code deployments, and incident tickets across the audit period. Identify the application-level controls that compensate for ITGC weaknesses.

Module 10. Cybersecurity and data integrity controls for benchmark integrity

Test the control environment that protects benchmark integrity from unauthorised methodology change, unauthorised data override, and unauthorised publication. Walk the segregation-of-duties matrix across methodology approval, data override, and publication sign-off. Test the logging and monitoring controls that detect anomalous activity in the calculation engine.

Module 11. Walkthrough memo, working paper, and evidence pack standards

Write walkthroughs the senior signs off without rewrite. Apply the working paper standards the manager and external auditor expect. Build the evidence pack with control descriptions, sampled population, exception log, conclusion, and cross-reference to the underlying source documents. Address the common review comments that send associates back for rework.

Module 12. Issue write-up, root cause, and audit committee reporting

Write a finding that survives the partner review and the audit committee read. Apply the root-cause analysis discipline that distinguishes one-off failures from systemic control design weaknesses. Draft the management response negotiation, the remediation timeline, and the quarterly issue closure tracker the audit committee secretary expects.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Module 2 and module 3 cover the benchmark administration walkthrough where the four-eye constituent change evidence is missing from the file.

Module 4 covers the ESG rating override walkthrough where the analyst rationale, the vendor source citation, and the committee approval do not line up.

Module 5 covers the third-party data vendor SOC 1 reliance memo the manager will not sign off until the complementary user entity controls are mapped.

Module 8 covers the SSAE 18 SOC 1 carve-out evidence pack the downstream asset-manager client auditor consumes every cycle.

What you get with this course

Twelve text modules covering the full control universe of an index, benchmark, and ESG data provider internal audit programme.
Walkthrough templates for benchmark administration, ESG rating production, methodology governance, third-party SOC 1 reliance, and model risk.
Sampling templates with population definition, sample size rationale, and exception log structure ready to drop into the working paper file.
Issue write-up templates with root-cause framing, management response negotiation prompts, and audit committee reporting language.
Hand-built implementation playbook tailored to the buyer's specific in-scope control universe and audit calendar.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

Modules 1 through 4 work in the first week alongside the next walkthrough memo.

Modules 5 through 8 work in the second week alongside the next SOC 1 reliance memo and ESG rating test.

Modules 9 through 12 work in the third and fourth weeks alongside the next issue write-up and audit committee paper.

Before and after

Before

Walkthrough memos come back marked up because the evidence pack is missing the four-eye sign-off, the methodology committee minute, or the data vendor source citation. Issue write-ups get reframed by the senior because the root cause is shallow. The SOC 1 reliance memo sits in draft because the complementary user entity controls have not been mapped.

After

Walkthrough memos pass first-time review. Evidence packs include the four-eye sign-off, the committee minute, and the source citation by default. Issue write-ups carry the root-cause analysis the manager expects. The SOC 1 reliance memo is signed off in the planning phase, not at draft-report stage.

What happens if you do not address this

Walkthroughs keep getting rewritten. Senior review cycles slip. The annual plan misses delivery on benchmark administration testing and the audit committee notices. SOC 1 carve-out evidence packs reach downstream client auditors with gaps and follow-up requests pile up. The associate who is supposed to be moving toward senior promotion gets stuck in rework loops instead of finishing audits.

Who it is for

Internal audit associates one to three years in, sitting in an in-house internal audit function at an index provider, benchmark administrator, ESG data provider, or factor and climate model vendor. The control universe spans methodology governance, benchmark administration under IOSCO principles, ESG rating governance, third-party data vendor reliance, and the SSAE 18 SOC 1 carve-out evidence pack downstream asset-manager and bank clients consume. Audit work paper review chains run associate, senior, manager, director, with quarterly audit committee reporting on issue closure.

Who this is NOT for. Not for external audit seniors running statutory financial-statement audits, not for compliance officers in the second line, not for chief audit executives setting the annual plan. The course is for the associate who owns the working paper and the evidence pack on a specific walkthrough.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Roughly three to five hours per module, run alongside live walkthroughs so the templates land directly in the current working paper file.

Why $199 is the right number

IIA general internal audit guidance does not cover benchmark administration under IOSCO principles, ESG rating governance, or the carve-out SOC 1 evidence pattern specific to data providers. Big four methodology assets cover statutory financial-statement audits and do not map to the in-house data-provider control universe. Free CPE webinars cover topics in isolation without the working paper templates an associate actually files. This course covers the full control universe of an index, benchmark, and ESG data provider with the templates the senior expects in the file.

FAQ

I have just rotated in from external audit. Will this make sense?

Yes. The course is built for associates one to three years in, including external-audit rotations into in-house internal audit roles. The first two modules cover the control universe specific to a data provider, which is the piece that does not map directly from a bank or asset-manager audit background.

Does this cover IOSCO benchmark principles?

Yes, module 2 walks the IOSCO principles for financial benchmarks and the controls each principle requires. Module 3 goes deeper into methodology governance and change control.

How does the SOC 1 carve-out section work?

Module 8 builds the SSAE 18 SOC 1 evidence pack the downstream asset-manager and bank client auditor consumes. It covers in-scope controls, carve-out controls, complementary user entity controls, and the unique reliance pattern where downstream client auditors test the data provider's controls every cycle.

What does the hand-built implementation playbook contain?

It is tailored to the buyer's specific in-scope control universe, audit calendar, and the next walkthrough or test in the plan. It maps each course module to the working papers you will write next.

Refund policy?

Thirty-day refund, no questions asked.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.