Last reviewed 2 November 2026 against the sources linked in this post.
The walkthrough goes well until the control owner asks what the auditor will test, and nobody on the team can say how the SOX control maps to the ISO 27001 clause. The Association of Certified Fraud Examiners (ACFE) found that internal audit detected 15% of the frauds in its 2026 study, second only to tips (43%), and that organisations lose an estimated 5% of revenue to fraud each year. Auditors only find what they know to look for.
Most internal auditor training is about the Certified Internal Auditor exam or ISO lead-auditor certificates. This list covers the other half: the controls, security, fraud and ethics knowledge auditors need to test well. You get 11 ready-made courses in 3 groups, what each fixes and how to roll them out. Each group ends with an Our pick. The legal points describe US federal rules, so use this as a syllabus, not a ruling.
All 11 courses at a glance
| Course | What it covers | Length | US federal rule behind it? |
|---|---|---|---|
| Records retention & internal controls (SOX) | Records retention, key controls and red flags of manipulation | 35 min | Yes (US federal rule) |
| IT governance & audit frameworks (COBIT and TOGAF) | COBIT, TOGAF, maturity models and planning an IT audit | 45 min | No |
| ISO/IEC 27001 and the ISMS | What an ISMS is and how to talk to an auditor | 40 min | No |
| Safety law, committees, management systems and audits | Safety duties, management systems, inspections and audits | 40 min | No |
| AI in finance, audit & accounting | Control steps for AI-assisted close and reporting | 40 min | No |
| Phishing & social engineering | Spotting and reporting phishing and business email compromise | 30 min | No |
| Social engineering, fraud & deepfakes | Payment, phone and impersonation scams, including deepfakes | 35 min | No |
| Code of conduct | Integrity, grey areas and speaking up | 35 min | No |
| Conflicts of interest | Disclosing actual, potential and perceived conflicts | 25 min | No |
| Anti-bribery & corruption (FCPA) | Anti-bribery and accounting provisions, red flags | 40 min | Yes (US federal rule) |
| Data classification & handling | Classifying, labelling and sharing data by level | 25 min | No |
The laws set rules for how organisations behave. They do not require any of these courses.
Controls and frameworks
Records retention & internal controls (SOX)
This course covers why the Sarbanes-Oxley Act (SOX) exists and what sections 302 and 404 require, then key controls, the records retention schedule and legal holds, and red flags of manipulation. The SEC's Sarbanes-Oxley spotlight page (archive.org copy, as the SEC site blocks our servers) lists its rules on internal control provisions and on retention of records relevant to audits and reviews. Auditors test these controls most often, so they need to know what a control owner should be able to show. The course ends on a 12-question final check, and a Pick Answer round on whether a record can be deleted during a legal hold is a good live moment.
IT governance, enterprise architecture and IT audit frameworks: COBIT and TOGAF
COBIT and TOGAF give IT auditors the frameworks they audit against. This 45-minute course explains the aims of IT governance (value, risk and resources), the difference between governance and management objectives, the architecture development method and maturity models, then finishes on planning an IT audit and reporting to leadership. Use the maturity-levels exercise to ask the team to rate a real system, then compare ratings with a Rating Scale.
ISO/IEC 27001 and the information security management system: what every employee must know
ISO 27001 knowledge helps auditors judge what a management system should show. The course is written for employees, so it works well for the people being audited too: what an ISMS is, your role and the rules, grey areas such as exceptions and weaknesses, and a lesson on talking to an auditor. Run it with both sides in one room, then ask auditors and auditees what evidence they would expect for the same control.
Safety law, committees, management systems and audits
Auditors of safety management systems need the legal duties and the audit process. This 40-minute course covers employer, manager and worker duties, joint safety committees, a management system in five steps, internal inspections and audits, and working with the regulator. Try the "Find and fix" inspection round: show a photo of a workplace and let the team vote on what they would raise as a finding.
Our pick: Records retention & internal controls (SOX). Control testing and record keeping sit at the centre of most audit plans, so this is the shortest route to a shared language between auditors and control owners.
AI, phishing and fraud risk
AI in finance, audit and accounting: controls, accuracy and accountability
Auditors of AI-assisted finance need to test accuracy, controls and accountability. This course opens with AI-drafted commentary that invents a driver and misleads a board, then covers where AI helps and fails, four control steps for AI-assisted close and reporting, segregation of duties and evidence for audit. It also works through grey areas such as duplicated suppliers and public uploads. A sorting task asks which finance tasks are safe to hand to AI and which are not.
Phishing & social engineering
Auditors are targets because of their access to systems and findings. This 30-minute course traces the steps of a business email compromise, covers red flags across email, SMS, voice, QR codes and AI deepfakes, and teaches verifying a request through an independent channel. It ends on a 12-question final check. Run a Word Cloud first: "What was the last suspicious request you got?" For a lighter weekly follow-up, see our guide to phishing pulse checks in Slack.
Social engineering, fraud and deepfakes: phone, payment and impersonation scams
Payment fraud and impersonation cases turn up in audit findings, so auditors need to know the scenarios. This course starts with a convincing request for new bank details, then covers the tactics, how to verify the money, faked voices and video, and why people comply with seniority, politeness and secrecy. The "What would you do?" scenario works well as a Pick Answer vote.
Our pick: Social Engineering, Fraud and Deepfakes. Auditors review payment controls, and this course shows how a control is beaten by a polite phone call, which is exactly what a test plan should cover.
Ethics, independence and information handling
Code of conduct
Auditors are held to the same code as everyone else, with objectivity and confidentiality on top. The course gives one clear standard: why integrity matters, the key policies behind the code, a four-question decision test, grey areas and how to speak up. Put a grey-area case to the room as an anonymous Open Ended slide and compare answers with the policy.
Conflicts of interest
Independence and conflicts of interest are central to auditor credibility. This 25-minute course defines actual, potential and perceived conflicts, lists the common types (financial, family, outside work, gifts, corporate opportunity), teaches "disclose, then decide" and walks through completing a conflict disclosure. Ask a Pick Answer question: an auditor's cousin works for the auditee. Disclose, step back or carry on?
Anti-bribery & corruption (FCPA)
Auditors need to know anti-bribery red flags to spot them in fieldwork. The US Department of Justice says the FCPA's anti-bribery provisions prohibit corrupt payments to foreign officials, and that its accounting provisions require covered companies to keep accurate books and records and maintain an adequate system of internal accounting controls. This course covers both, plus gifts, travel, hospitality and third-party red flags.
Data classification & handling
Auditors handle sensitive evidence and must classify and share it correctly. This 25-minute course covers classification levels, how to label, store, share and dispose of data by level, red flags of mishandling and how to report a misclassification. In the case-practice round, ask learners to classify a sample workpaper, a management letter draft and a staff list.
Our pick: Conflicts of Interest. An auditor's findings are only as good as their independence, and this is the shortest course that protects it.
How to roll the plan out
Start with the courses that sit on a US federal rule and apply to everyone on the team (SOX and anti-bribery), plus the code of conduct and conflicts of interest at onboarding. They are the base for everything else, and the ACFE data shows why auditors need them: with internal audit detecting 15% of frauds, the team's own knowledge decides what gets caught.
- At onboarding: code of conduct, conflicts of interest, data classification and phishing.
- Within the first quarter: SOX, anti-bribery, and the ISO 27001 course for auditors who test security controls.
- Each year: a refresher quiz on the conduct and fraud courses, and the impersonation scams course before year-end close.
- Role-specific depth: COBIT and TOGAF for IT auditors, the AI in finance course for those testing reporting, and the safety law course for operational auditors.
Add your own country's rules where your teams work, and ask your legal team what applies. If you lead the audit team as well, our guide to leadership training for supervisors covers that side of the role.
Ways to run these courses on AhaSlides
You can build any of these as a self-paced course with the AhaSlides course creator, run them as a live session deck, or both, with a post-course survey and a 30-day check-in to see what changed.
- Pick Answer: ask whether a record can be deleted during a legal hold, or what to do when an auditor's cousin works for the auditee.
- Word Cloud: ask "What was the last suspicious request you got?" The biggest words show which scams to cover first.
- Rating Scale: have the team rate a real system against the COBIT maturity levels, then compare.
- Open Ended: collect anonymous answers to a conduct grey-area case, so people say what they would do.
FAQ
What training do internal auditors need?
Internal auditors need audit methodology, control frameworks such as COSO or COBIT, fraud awareness and ethics. The courses above cover the last three, which certification courses often assume you already know.
What certification should an internal auditor get?
Most internal auditors choose the Certified Internal Auditor (CIA), and IT auditors often add the Certified Information Systems Auditor (CISA). Check the awarding body for current requirements, as these courses do not count towards either exam.
What does an IT auditor do?
An IT auditor tests technology controls, access, security and change management against recognised frameworks such as COBIT and ISO 27001. The IT governance and ISO 27001 courses above give that framework knowledge.
How often should auditors train?
Professional bodies typically require continuing education every year, so plan a refresher at least annually. Check your own certifying body's rules for the hours it expects.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified lawyer or the regulator.
