Public Sector Governance, Risk-Based Audit and Compliance

Public sector governance is the system of rules, roles and oversight through which a public body is directed and held to account, and risk-based audit and compliance point assurance work at the areas where risk is highest. This 10-day course is for internal audit, compliance and risk practitioners in public bodies, and each delegate builds an integrated assurance plan for a case organisation. The subject is taught by Blackbird Training Centre.

Introduction

The course rests on three references. ISO 31000 sets out principles and a process for managing risk in any organisation. The COSO Internal Control Integrated Framework defines five components of internal control and the principles behind them. The Global Internal Audit Standards of the Institute of Internal Auditors set requirements for how internal audit is governed and performed. The level is practitioner. This 10-day edition adds risk-based internal audit, risk-based compliance and governance performance review to the risk and governance core, taught through case studies from health services and municipal services.

Course Objectives

• Distinguish public governance from corporate governance, and assign oversight, executive and assurance roles on that basis.
• Compare cyclical and risk-based audit planning, and select the approach that matches a public body's risk profile.
• Apply ISO 31000 and the COSO internal control framework to assess risks and the controls that treat them.
• Interpret compliance obligations and rank them by likelihood and consequence of breach to set monitoring priorities.
• Justify an annual internal audit plan to an audit committee using risk scores from the audit universe.
• Select indicators and review methods for an evaluation of governance performance.

Target Audience

• Internal auditors and audit managers in public bodies who must decide which units and processes to audit first.
• Compliance officers and compliance function leads who must judge which obligations need active monitoring.
• Risk managers and risk coordinators who must decide how risk appetite translates into control expectations.
• Finance and governance managers who must judge whether controls and reporting meet accountability expectations.
• Audit committee secretaries and governance advisers who must decide what assurance the oversight body needs.

Course Outline

Day 1: Public Sector Governance Foundations

• Public Governance vs Corporate Governance: Accountability to Citizens Compared With Shareholders
• Good Governance Principles: Transparency, Accountability, Integrity and Participation in Public Decisions
• Governance Frameworks and Models: Roles of Boards, Executives and Oversight Bodies
• Stakeholder Engagement: Mapping Citizens, Ministries, Oversight Bodies and Service Users
• Ethical Leadership: Tone at the Top, Codes of Conduct and Organisational Culture

Day 2: Enterprise Risk Management Core

• ISO 31000 vs COSO ERM: Two Enterprise Risk Management Frameworks Compared
• Risk Identification and Assessment: Likelihood, Impact and Heat Map Techniques
• Risk Appetite vs Risk Tolerance: Setting Boundaries for Public Service Decisions
• Risk Treatment Options: Avoid, Reduce, Transfer or Accept, With Named Control Owners
• Risk Register: Recording Strategic, Operational, Financial and Reputational Risks in One Place

Day 3: Internal Control and the Three Lines

• COSO Internal Control Framework: Five Components and Seventeen Principles Explained
• Three Lines Model: Roles of Management, Risk and Compliance Functions and Internal Audit
• Preventive vs Detective Controls: Choosing Control Types for Public Service Processes
• Fraud Prevention and Detection: Red Flags, Segregation of Duties and Whistleblowing Channels
• Audit Committee Responsibilities: Oversight of Risk, Control and Audit Effectiveness

Day 4: Internal Audit Roles and Standards

• Global Internal Audit Standards: Purpose, Ethics, Governance and Performance Requirements
• Assurance vs Consulting Engagements: Two Kinds of Internal Audit Work Compared
• Internal Audit Charter: Mandate, Independence and Reporting Lines to the Oversight Body
• Compliance Audit vs Performance Audit: Testing Rules Compared With Testing Results
• Audit Universe: Listing Every Auditable Unit, Process and Public Service of a Body

Day 5: Risk-Based Internal Audit Planning

• Cyclical vs Risk-Based Audit Planning: Fixed Rotation Compared With Risk Priority
• Audit Universe Risk Scoring: Ranking Units by Inherent and Residual Risk
• Annual Audit Plan: Linking Audit Coverage to the Organisational Risk Register
• Engagement Planning: Objectives, Scope, Risk and Control Matrix and Sample Selection
• Audit Finding Structure: Condition, Criteria, Cause, Effect and Recommendation Explained

Day 6: Risk-Based Compliance Functions

• Rules-Based vs Risk-Based Compliance: Checking Everything Compared With Targeting Exposure
• ISO 37301: Requirements and Elements of a Compliance Management System
• Compliance Obligations Register: Laws, Regulations, Standards and Internal Policies Recorded Together
• Compliance Risk Assessment: Rating Obligations by Likelihood and Consequence of Breach
• Compliance Monitoring and Regulatory Updates: Testing, Reporting and Managing Legal Reforms

Day 7: Financial Governance and Accountability

• IPSAS Accrual vs Cash-Basis Reporting: Two Ways Public Bodies Report Finances
• Public Financial Management: Budget Planning, Resource Allocation and Expenditure Control
• PEFA Framework: Assessing Public Financial Management Performance Across Its Pillars
• Value for Money: Economy, Efficiency and Effectiveness Assessments of Public Spending
• Transparency and Disclosure: Financial Reporting and Publication Practices for Accountability

Day 8: Information, Continuity and Crisis Risk

• Data Governance vs Information Security: Ownership of Data Compared With Its Protection
• ISO/IEC 27001: Information Security Controls and Cybersecurity Practices for Public Services
• Privacy and Data Protection: Handling Citizen Personal Data and Managing Technology Risk
• ISO 22301: Business Continuity Planning, Crisis Preparedness and Response Frameworks
• Crisis Communication: Reputation Management and Stakeholder Engagement During Service Disruption

Day 9: Performance, Sustainability and Digital Governance

• Output KPIs vs Outcome Indicators: Measuring Activity Compared With Public Value Delivered
• Strategic Planning and Performance Monitoring: Planning Methods, Evaluation and Continuous Improvement
• ESG Integration and Sustainable Development Goals: Social Responsibility and Public Engagement
• Climate-Related Risk: Physical and Transition Risks in Public Sector Planning
• E-Governance and Digital Transformation: Emerging Technologies in Digital Public Services

Day 10: Governance Review and Integrated Assurance Plan

• Self-Assessment vs Independent Review: Two Ways to Evaluate Governance Performance
• Governance Performance Review: Applying Principles, Controls and Indicators to the Case Body
• Risk-Based Audit Plan Build: Applying Audit Universe Scores to the Case Body
• Compliance Risk Map: Applying the Obligations Register to Set Monitoring Priorities
• Integrated Assurance Plan: Finalising Audit Coverage, Compliance Monitoring and Review Actions

Skills You Will Gain

• Risk-based audit planning
• Audit universe scoring
• Compliance obligations mapping
• Compliance risk rating
• Internal control design
• Risk appetite setting
• Value-for-money assessment
• Governance performance review

Why Attend This Course

• From auditing units in a fixed rotation to directing audit effort where risk scores are highest.
• From checking every rule with equal effort to concentrating compliance monitoring on the obligations with the greatest breach exposure.
• From separate risk, audit and compliance reports to one coordinated view under the Three Lines Model.
• From an informal sense of governance strength to an integrated assurance plan with audit coverage, compliance priorities and review actions.

Conclusion

Governance in a public body depends on knowing which risks matter most and checking that controls and obligations are met where they matter. The course makes three distinctions clear: public against corporate governance, cyclical against risk-based audit planning, and rules-based against risk-based compliance. It also separates self-assessment from independent review of governance performance. It suits internal audit, compliance and risk practitioners who already work with controls and now need to plan assurance across a whole public body.

Course FAQs

What is public sector governance, risk-based audit and compliance?

It is the combined discipline of directing a public body through clear roles and oversight, auditing it where risk is highest and monitoring the legal and policy obligations whose breach would cause the most harm.

What is the difference between cyclical and risk-based audit planning in the public sector?

Cyclical planning audits every unit on a fixed rotation regardless of exposure. Risk-based planning scores the audit universe for inherent and residual risk and directs audit time to the highest-scoring units first, linking coverage to the risk register.

Which standards does public sector risk-based audit and compliance training follow?

It follows ISO 31000 for risk management, the COSO Internal Control Integrated Framework for controls, the Global Internal Audit Standards for audit practice and ISO 37301 for compliance management systems.

Is public sector risk-based audit and compliance training right for a compliance officer?

Yes. A compliance officer builds an obligations register, rates obligations by breach risk and decides monitoring priorities, and also learns how internal audit plans its work, which helps coordinate the two functions.

What does a delegate produce in public sector governance, risk-based audit and compliance training?

Each delegate produces an integrated assurance plan for a case public body, combining a risk-based annual audit plan, a compliance risk map with monitoring priorities and the actions from a governance performance review.