About This Course
As organisations become increasingly dependent on digital infrastructure, the integrity, availability, and security of information systems have become board-level concerns. IT auditing is no longer a back-office technical function — it is a critical assurance discipline that informs strategic decisions, satisfies regulatory bodies, and protects organisational assets from internal and external threats.
This five-day IT Auditing and Information Systems Controls Training programme by TrainingComplex provides a structured, practical grounding in all key dimensions of IT audit practice. From risk-based audit planning and general IT controls (GITCs) to application controls, cybersecurity assessments, and audit reporting, participants will develop the competencies required to conduct rigorous, value-adding IT audits in any sector.
The programme draws on internationally recognised frameworks including COBIT, ISO/IEC 27001, NIST, ITIL, and the IIA's International Professional Practices Framework. Participants will engage with real-world audit scenarios, work through control testing simulations, and leave with practical tools and templates they can immediately apply in their organisations.
Whether you are an internal auditor expanding into IT, a dedicated IT auditor seeking to sharpen your methodology, or an IT professional transitioning into assurance, this course will deepen your understanding and strengthen your professional credibility.
Who Should Attend
- Internal auditors assigned to IT audit portfolios or transitioning from financial to IT audit
- IT risk and compliance officers responsible for control frameworks and regulatory adherence
- Information security managers seeking a structured audit and assurance perspective
- External auditors conducting systems reviews or integrated audits for corporate clients
- ICT managers and systems administrators who support or respond to IT audit engagements
- Governance, risk, and compliance (GRC) professionals working across digital environments
- Finance and accounting professionals involved in ERP system controls or SOX compliance
- Public sector audit staff responsible for reviewing government information systems
Learning Objectives
- Explain the role and scope of IT auditing within the broader internal audit and governance framework
- Apply recognised frameworks — including COBIT, ISO 27001, and NIST — to plan and structure IT audit engagements
- Identify and evaluate General IT Controls (GITCs) covering access management, change management, and IT operations
- Assess application controls including input, processing, and output controls within key business systems
- Conduct risk-based IT audit planning aligned to organisational strategy and regulatory requirements
- Perform control testing using both automated tools and manual evidence-gathering techniques
- Evaluate cybersecurity controls and assess organisational resilience against common threat vectors
- Review IT governance structures, IT policies, and vendor/third-party risk management arrangements
- Document audit findings accurately and develop clear, actionable audit recommendations
- Draft professional IT audit reports tailored to technical and non-technical stakeholder audiences
- Apply data analytics techniques to enhance audit coverage, sampling, and anomaly detection
Course Modules
Module 1: Foundations of IT Auditing and the Assurance Landscape
- The role of IT audit within corporate governance and the three lines of defence model
- Differences between IT audit, cybersecurity review, and IT risk management
- Key IT audit standards: IIA IPPF, ISACA guidelines, and relevant regulatory expectations
- The IT audit lifecycle: planning, fieldwork, reporting, and follow-up
- Professional ethics and independence requirements for IT auditors
- Overview of IT audit career pathways and certifications (CISA, CRISC, CIA)
Module 2: IT Governance Frameworks and Control Environments
- Introduction to COBIT 2019: governance and management objectives relevant to audit
- Applying ISO/IEC 27001 as an audit reference framework for information security
- NIST Cybersecurity Framework: functions, categories, and audit applications
- ITIL service management concepts and their relevance to IT operations audit
- Mapping organisational IT policies and procedures to framework requirements
- Evaluating the maturity of an organisation's IT governance structure
Module 3: Risk-Based IT Audit Planning
- Defining the IT audit universe and prioritising engagements using a risk-based approach
- Conducting IT risk assessments: identifying threats, vulnerabilities, and business impact
- Developing the IT audit plan: scope, objectives, resources, and timelines
- Engagement-level planning: preparing audit programmes and control matrices
- Coordinating with external auditors and other assurance providers to avoid duplication
- Documenting the planning phase: working papers, terms of reference, and stakeholder communication
Module 4: General IT Controls (GITCs): Access and Identity Management
- Understanding the purpose and significance of GITCs in an integrated audit context
- Logical access controls: user provisioning, authentication standards, and privilege management
- Reviewing access control lists, role-based access, and segregation of duties (SoD)
- Identity and access management (IAM) systems: audit considerations and common weaknesses
- Password policies, multi-factor authentication, and privileged access management
- Testing access controls: sampling strategies, evidence collection, and exception reporting
Module 5: General IT Controls: Change Management and IT Operations
- Change management processes: request, approval, testing, and deployment controls
- Emergency change procedures and the audit risks they present
- Patch management and vulnerability remediation as IT control objectives
- IT operations controls: job scheduling, batch processing, and incident management
- Capacity management, availability monitoring, and service continuity controls
- Auditing IT operations: key indicators, log review, and control testing approaches
Module 6: Application Controls and Business System Reviews
- The application controls framework: input, processing, output, and interface controls
- Reviewing controls in ERP systems (SAP, Oracle, Microsoft Dynamics) relevant to financial reporting
- Interface and data transfer controls: completeness, accuracy, and integrity validation
- Segregation of duties within applications and compensating controls where SoD is not feasible
- Auditing system configuration settings and parameter changes as control considerations
- Conducting a structured application control walkthrough and preparing the findings workpaper
Module 7: Cybersecurity Controls Assessment
- Core cybersecurity concepts for IT auditors: attack surfaces, threat actors, and kill chains
- Auditing network security controls: firewalls, intrusion detection, and network segmentation
- Endpoint security controls: antivirus, device management, and patch currency
- Security incident and event management (SIEM): audit review of alerting and response
- Vulnerability management programmes: assessing coverage, frequency, and remediation tracking
- Evaluating the organisation's security awareness training and phishing resilience programmes
Module 8: Data Privacy, Regulatory Compliance, and Third-Party Risk
- Key data protection regulations relevant to IT audit: GDPR, Kenya Data Protection Act, and sectoral frameworks
- Auditing data classification, retention policies, and personal data handling controls
- Cloud computing audit considerations: shared responsibility models and control gaps
- Third-party and vendor risk management: due diligence, contracts, and ongoing monitoring
- Outsourced IT services and managed service providers: scoping and reliance decisions
- Reviewing compliance monitoring mechanisms and evidence of regulatory self-assessment
Module 9: Data Analytics and Technology-Assisted Audit Techniques
- The role of data analytics in modern IT audit: coverage, efficiency, and anomaly detection
- Common data analytics tools used in audit: ACL/Galvanize, IDEA, Power BI, and Excel
- Designing analytics-driven audit tests: defining expectations, extracting data, and interpreting results
- Continuous auditing and continuous monitoring: concepts and implementation considerations
- Using structured query language (SQL) basics for audit data extraction and testing
- Documenting and validating data analytics procedures within the audit working paper file
Module 10: Audit Reporting, Communication, and Follow-Up
- Structuring the IT audit report: executive summary, findings, risk ratings, and recommendations
- Writing clear, evidence-based findings that link control weaknesses to business risk
- Rating audit findings by severity: critical, high, medium, and low — criteria and application
- Presenting IT audit results to audit committees, boards, and senior management
- Managing management responses and negotiating agreed actions and deadlines
- Tracking remediation: follow-up procedures, escalation protocols, and closure evidence
Requirements & Prerequisites
Participants should have a foundational understanding of information technology concepts and basic familiarity with how enterprise systems operate. Prior experience in internal audit, IT risk, compliance, or a related field is recommended, as the programme builds on working knowledge of control environments. No advanced programming or cybersecurity expertise is required, though comfort with IT terminology will help delegates engage more fully with the technical content.
Training Methodology
- Structured case studies drawn from real IT audit engagements across banking, government, and manufacturing sectors, requiring participants to identify control gaps and propose remediation steps
- Hands-on control testing simulations using sample system logs, access reports, and change management records to practise evidence evaluation and exception identification
- Framework mapping exercises in which delegates apply COBIT, ISO 27001, and NIST controls to sample audit programmes and compare coverage
- Audit planning workshops where small groups develop risk-based IT audit plans for assigned fictitious organisations, then present and defend their scope decisions
- Peer review of draft audit findings and recommendations, mirroring the quality-assurance stage of a real engagement
- Scenario-based discussions on cybersecurity incidents and data breaches, analysing the control failures that contributed and the audit lessons to be drawn
- Practical report-writing sessions in which participants draft executive summaries and detailed findings sections, receiving structured facilitator feedback
- Group walkthroughs of audit management and data analytics tools to familiarise participants with technology-assisted audit approaches
Organisational Benefits
- Stronger assurance over IT systems that underpin financial reporting, operations, and regulatory compliance
- Reduced exposure to cybersecurity incidents through the identification and remediation of control weaknesses
- Improved alignment between IT audit practice and internationally recognised frameworks such as COBIT and ISO 27001
- Enhanced ability to satisfy external regulators, auditors, and certification bodies during IT reviews
- A more capable and confident internal audit function that can independently cover IT audit engagements
- Better risk identification and prioritisation across the organisation's digital and systems landscape
- Higher quality audit reports that drive meaningful management action and board-level accountability
- A workforce that can bridge the communication gap between technical IT teams and audit or governance committees
Where Is IT Auditing and Information Systems Controls Training Offered?
This course runs in-person across: Cape Town, Kampala, Nairobi, Dubai, Nakuru, Zanzibar, Mombasa, Abuja, Naivasha, Kigali, Lagos, Riyadh, Johannesburg, Pretoria, Arusha, Kisumu, Accra, Dar es Salaam, Addis Ababa, plus Live Virtual (online) cohorts. Browse live dates for your city below.
Upcoming Schedules
| Location | Format | Dates | Price |
|---|
| Cape Town, South Africa |
In-Person |
5 Oct 2026 – 9 Oct 2026 |
USD 3,800 |
| Kampala, Uganda |
In-Person |
5 Oct 2026 – 9 Oct 2026 |
USD 1,900 |
| Nairobi, Kenya |
In-Person |
5 Oct 2026 – 9 Oct 2026 |
KES 105,000 |
| Dubai, United Arab Emirates |
In-Person |
12 Oct 2026 – 16 Oct 2026 |
USD 4,100 |
| Nakuru, Kenya |
In-Person |
12 Oct 2026 – 16 Oct 2026 |
KES 115,000 |
| Live Virtual |
Online |
17 Oct 2026 – 8 Nov 2026 |
KES 80,000 |
| Zanzibar, Tanzania |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 2,500 |
| Mombasa, Kenya |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
KES 120,000 |
| Abuja, Nigeria |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 2,800 |
| Naivasha, Kenya |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
KES 115,000 |
| Kigali, Rwanda |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 1,900 |
| Lagos, Nigeria |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 2,500 |
| Riyadh, Saudi Arabia |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 4,500 |
| Johannesburg, South Africa |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 3,500 |
| Pretoria, South Africa |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 3,300 |
+237 more dates — view live schedule →
Frequently Asked Questions
Do I need to be a certified IT auditor to attend this course?
No formal certification is required. The course is designed for professionals with practical experience in IT, audit, risk, or compliance who want to build or deepen their IT audit competencies. Certified professionals such as CISAs will also find value in the applied, scenario-based content.
Will I receive a certificate upon completion?
Yes. All participants who successfully complete the five-day programme receive a TrainingComplex Certificate of Completion in IT Auditing and Information Systems Controls, which can be referenced for continuing professional education (CPE) hours with bodies such as ISACA and the IIA.
Is the course relevant to public sector IT auditors?
Absolutely. The programme covers frameworks and control principles applicable across both private and public sector contexts, including government information systems, regulatory compliance, and public financial management systems. Case studies include public sector scenarios.
What should I bring or prepare before attending?
No advance preparation is required, though participants are encouraged to bring a copy of their organisation's IT audit charter or IT policy documents if available, as these can enrich the planning and case study exercises. A laptop or tablet is helpful but not mandatory.
Can this course be delivered in-house for an entire audit team?
Yes. TrainingComplex offers customised in-house delivery of this programme for internal audit departments, risk teams, or IT functions. In-house delivery allows the content and case studies to be tailored to your organisation's specific systems, sector, and regulatory environment.
