Improving Internal Audit’s ability to audit IT.
Arming Staff, Seniors, and Managers with the competency and practices to audit IT systems, applications, and controls.
First Class starts April 21, 2025
The Financial Auditor’s Dilemma
Internal auditors have long been experts in financial reporting risks—navigating walkthroughs with ease and testing business process controls with confidence.
But the landscape is shifting.
More and more, audit and SOX compliance work is intertwined with IT. ITGCs, ITACs, and IPEs are no longer just “IT Audit’s” responsibility; they play an increasingly critical role in overall audit effectiveness.
For internal audit and controls practitioners looking to expand their role, take on more responsibility, and lead high-impact, risk-based projects, IT competency is no longer optional—it’s essential.
Introducing Synergy
Synergy is a “how-to” training program designed to give internal auditors, internal controls pros, and rising IT auditors the expertise they need to stay competitive, drive compliance, and future-proof their careers.
This course will help SOX and Internal Auditors:
Understand the IT Audit ecosystem – and provide advice on IT system and control scoping for SOX compliance and an organization’s IT control environment.
Better test and support IT controls – design control testing attributes and support ITGC, ITAC, and IPE testing results.
Defend IT control testing conclusions to external auditors – Reduce back-and-forth and unnecessary retesting.
Develop internal auditors into well-rounded Integrated Auditors – Expand their roles and further build out their auditing skillset.
Ensure SOX and Internal Audit professionals keep pace with evolving IT environments – to help reduce deficiencies and improve enterprise risk management initiative.
What you get:
Building Today’s Integrated Internal Auditor
This course explores different types of IT controls found in an organization’s control environment and SOX program and applies real-world scenarios to enhance critical thinking and problem solving skills.
Course Overview & Introduction to IT Auditing in SOX Compliance
By the end of this session, you will be able to:
Make the argument for a synergistic approach to SOX auditing
Differentiate ITGCs, ITACs, End-User, and Entity Level controls
Point out the differences between major IT control frameworks
Course Overview & Introduction to IT Auditing in SOX Compliance
Description:
This course introduces IT auditing within the context of SOX compliance, emphasizing the unique challenges faced by auditors without a technical background. Participants will explore key IT control areas, the impact of IT on financial reporting, and regulatory expectations for technology-related controls. The session will include a high-level introduction to control types and discussions to enhance auditors' ability to assess IT risks effectively.
Learning Objectives:
Explain the role of IT auditing in SOX compliance and its significance for financial reporting.
Identify key IT controls and common challenges non-IT auditors face when engaged in testing.
Discuss common frameworks auditors should know for background in IT audit.
CPE Credits
1 credit
Field of Study
Specialized knowledge
Instructional Method
Group Internet-based
Prerequisites
None
Advanced Preparation
None
Challenges of Scoping IT Components in Business Process Controls
By the end of this session, you will be able to:
Scope IT systems based on material business processes
Understand the IT components to consider when scoping systems
Know what to do when you miss something when scoping
Challenges of Scoping IT Components in Business Process Controls
Description:
Effective SOX scoping must account for technology that supports financially material accounts. Unfortunately, IT components are often overlooked until issues arise during walkthroughs or testing. This course will explore properly identifying and including IT elements in the SOX scope from the outset, reducing surprises and audit deficiencies.
Learning Objectives:
Recognize common IT components that impact business process controls in SOX audits.
Conduct a systematic scoping exercise to identify IT systems relevant to financial reporting.
Develop strategies to ensure IT components are properly considered in the SOX scope.
CPE Credits
1 credit
Field of Study
Specialized knowledge
Instructional Method
Group Internet-based
Prerequisites
None
Advanced Preparation
None
IT System Risk Assessments and Control Identification
By the end of this session, you will be able to:
Build a basic IT SOX risk assessment and apply a standard ITGC framework
Consider risk assessments and business impacts analyses performed by IT
Detail risk-based scoping decisions
IT System Risk Assessments and Control Identification
Description:
IT risk assessments are critical for identifying key control areas in SOX compliance. This course will cover different types of IT risk assessments auditors commonly encounter, including application risk, infrastructure risk, and third-party risk. Attendees will learn how to evaluate IT risks effectively and determine the appropriate controls for mitigating them.
Learning Objectives:
Differentiate between various IT risk assessment methodologies used in SOX audits.
Identify control requirements based on assessed IT risks.
Apply risk-based approaches to IT control testing and documentation.
CPE Credits
1 credit
Field of Study
Specialized knowledge
Instructional Method
Group Internet-based
Prerequisites
None
Advanced Preparation
None
Simulated Scoping Exercise and Group Discussion
By the end of this session, you will be able to:
Scope a real system in use at an organization
Assess the risk associated with that system
Document control inclusions and exclusion rationales
Simulated Scoping Exercise and Group Discussion
Description:
Participants will apply SOX scoping principles through a hands-on exercise in this interactive session. Using a real-world business scenario, they will assess IT components supporting financial processes, identify risks, and determine control requirements. The session will conclude with a group discussion on best practices and common pitfalls.
Learning Objectives:
Perform an IT scoping exercise using a structured methodology.
Identify critical IT dependencies in financial processes.
Collaborate in a group setting to discuss scoping challenges and solutions.
CPE Credits
1 credit
Field of Study
Specialized knowledge
Instructional Method
Group Internet-based
Prerequisites
None
Advanced Preparation
None
IT Entity Level Controls (ELCs) – Importance and Common Pitfalls
By the end of this session, you will be able to:
List the expected ELCs for cybersecurity related risks
Design ELC testing for those controls
Anticipate potential control failures
IT Entity Level Controls (ELCs) – Importance and Common Pitfalls
Description:
IT ELCs play a fundamental role in SOX compliance but are often overlooked or misunderstood. This course will provide an in-depth review of IT ELCs, their impact on financial reporting, and common failures in testing these controls. Participants will also explore evolving cybersecurity-related ELCs and their growing importance in audit frameworks.
Learning Objectives:
Define IT ELCs and their role in supporting financial reporting integrity.
Identify common pitfalls in testing IT ELCs and strategies for effective assessment.
Evaluate cybersecurity-related ELCs and their impact on SOX compliance.
CPE Credits
1 credit
Field of Study
Specialized knowledge
Instructional Method
Group Internet-based
Prerequisites
None
Advanced Preparation
None
IT General Controls (ITGCs) – Access Management
By the end of this session, you will be able to:
Create a standard ITGC framework
Devise a testing approach for comprehensive ITGC testing
Anticipate ITGC control failures
IT General Controls (ITGCs) – Access Management
Description:
Access management is a critical ITGC area that directly affects financial reporting reliability. This course will delve into best practices for user access controls, segregation of duties, and privileged account management. Participants will analyze real-world case studies of ITGC failures and their impact on SOX audits.
Learning Objectives:
Explain the role of access management in ITGCs and SOX compliance.
Identify key access control failures and their potential financial reporting risks.
Develop risk-based approaches for testing access management controls.
CPE Credits
1 credit
Field of Study
Specialized knowledge
Instructional Method
Group Internet-based
Prerequisites
None
Advanced Preparation
None
IT General Controls (ITGCs) – Change Management and System Integration
By the end of this session, you will be able to:
Tell the difference between SDLC and change management scenarios
Articulate why change management controls are vitally important
Trace system changes from source data to ticketing systems for approval
IT General Controls (ITGCs) – Change Management and System Integration
Description:
Change management and system integration are integral to maintaining a controlled IT environment. This course will cover best practices for managing system changes, tracking IT modifications and ensuring system integrations do not introduce financial reporting risks. Participants will explore real-life change management failures and discuss mitigation strategies.
Learning Objectives:
Identify key risks associated with change management and system integrations.
Assess the impact of ineffective change management on financial reporting.
Develop testing strategies for change management and integration controls.
CPE Credits
1 credit
Field of Study
Specialized knowledge
Instructional Method
Group Internet-based
Prerequisites
None
Advanced Preparation
None
Testing Scenarios and Case Studies on ITGC Failures
By the end of this session, you will be able to:
Identify an ITGC control issue
Perform an impact assessment
Plan mitigation strategies
Testing Scenarios and Case Studies on ITGC Failures
Description:
Auditors often encounter ITGC failures that impact SOX compliance. This session will present real-world scenarios of ITGC breakdowns, including access management failures, unauthorized system changes, and inadequate monitoring. Participants will evaluate each case study and discuss remediation approaches.
Learning Objectives:
Analyze real-world ITGC failures and their financial reporting implications.
Develop strategies for identifying and mitigating ITGC deficiencies.
Apply risk-based thinking when evaluating ITGC issues in audits.
CPE Credits
1 credit
Field of Study
Specialized knowledge
Instructional Method
Group Internet-based
Prerequisites
None
Advanced Preparation
None
IT Application Controls (ITACs) – Identification and Scope
By the end of this session, you will be able to:
Identify application level controls that could have a financial impact
Determine if an ITAC is appropriate through inspection
Address a common request for code from externals
IT Application Controls (ITACs) – Identification and Scope
Description:
IT application controls (ITACs) govern automated financial reporting processes but are often difficult to identify and test. This course will guide participants through ITAC scoping, control mapping, and reliance on system-generated information. Case studies on financial system controls will be used to enhance learning.
Learning Objectives:
Differentiate between ITGCs and ITACs in SOX compliance.
Identify ITACs within financial reporting systems.
Develop an approach for testing ITACs using system implementation documentation and vendor reports.
CPE Credits
1 credit
Field of Study
Specialized knowledge
Instructional Method
Group Internet-based
Prerequisites
None
Advanced Preparation
None
Using Financial Reporting Systems as Case Studies for ITACs
By the end of this session, you will be able to:
Ask the right questions when looking for application controls
Simulate a walkthrough and control identification
Design an appropriate control test
Using Financial Reporting Systems as Case Studies for ITACs
Description:
This hands-on workshop will immerse participants in the process of identifying IT application controls (ITACs) within financial reporting systems. Using a real-world financial reporting application as an example, attendees will assess control design, identify deficiencies, and develop compensating control strategies to address gaps. Discussions will emphasize the importance of ITACs in ensuring the accuracy and reliability of financial reporting.
Learning Objectives:
Identify and evaluate ITACs within a financial reporting system.
Analyze control deficiencies and their potential impact on financial reporting accuracy.
Develop and recommend compensating controls for mitigating identified risks.
CPE Credits
1 credit
Field of Study
Specialized knowledge
Instructional Method
Group Internet-based
Prerequisites
None
Advanced Preparation
None
Understanding SOC 1 Reports and Third-Party Risks
By the end of this session, you will be able to:
Request and understand a SOC 1 report
Figure out if there is an issue with the vendor
Go beyond the report into 4th party risks
Understanding SOC 1 Reports and Third-Party Risks
Description:
With increased reliance on third-party software providers, auditors must evaluate vendor controls through SOC 1 reports. This session will provide a comprehensive guide to SOC 1 report assessments, identifying key control areas, and addressing vendor deficiencies. The discussion will also cover expectations related to fourth-party risks and their implications.
Learning Objectives:
Interpret SOC 1 reports and their relevance to ITGC frameworks.
Identify control gaps in SOC 1 reports and develop mitigation strategies.
Assess the impact of third- and fourth-party risks on SOX compliance.
CPE Credits
1 credit
Field of Study
Specialized knowledge
Instructional Method
Group Internet-based
Prerequisites
None
Advanced Preparation
None
Workshop on Evaluating SOC 1 Reports and Mitigating Vendor Control Gaps
By the end of this session, you will be able to:
Read a real SOC 1 report
Identify areas of concern
Know what to do with SOC 1 report information
Workshop on Evaluating SOC 1 Reports and Mitigating Vendor Control Gaps
Description:
This hands-on workshop will provide participants practical experience in evaluating SOC 1 reports. Attendees will review sample reports, identify deficiencies, and determine compensating controls to address vendor control gaps. Attention will be given to identifying which fourth-party controls may be relevant.
Learning Objectives:
Analyze SOC 1 report findings and identify areas of concern.
Develop mitigation strategies for vendor control deficiencies.
Apply best practices for integrating SOC 1 reviews into the audit process.
CPE Credits
1 credit
Field of Study
Specialized knowledge
Instructional Method
Group Internet-based
Prerequisites
None
Advanced Preparation
None
Documentation Expectations – Flowcharts, Narratives, Policies, and Procedures
By the end of this session, you will be able to:
Create basic IT documentation
Design flowcharts with the right balance of information
Draft or request additional documentation to support the control process
Documentation Expectations – Flowcharts, Narratives, Policies, and Procedures
Description:
Clear and comprehensive documentation is essential for SOX compliance. This course will explore best practices for preparing flowcharts, narratives, policies, and procedures that align with audit requirements. Participants will discuss common documentation challenges and ways to streamline evidence collection.
Learning Objectives:
Define key SOX documentation requirements for IT controls.
Identify best practices for preparing effective audit documentation.
Develop strategies for overcoming documentation challenges in IT audits.
CPE Credits
1 credit
Field of Study
Specialized knowledge
Instructional Method
Group Internet-based
Prerequisites
None
Advanced Preparation
None
Information Prepared by the Entity (IPE) – Best Practices and Testing Strategies
By the end of this session, you will be able to:
Actually define IPE in common terms
Support management in providing the right documentation
Test IPE in a consistent manner
Information Prepared by the Entity (IPE) – Best Practices and Testing Strategies
Description:
IPE plays a critical role in SOX audits, but its definition and testing expectations often vary. In IT, we have the added challenge of working with disparate systems often feeding into many potential data sources. This session will provide auditors with practical approaches to assessing IPE risks, validating data integrity, and implementing controls for reliable financial reporting.
Learning Objectives:
Explain the importance of IPE in IT audits and financial reporting.
Identify best practices for testing IPE reliability and accuracy.
Develop an approach for documenting and validating IPE compliance.
CPE Credits
1 credit
Field of Study
Specialized knowledge
Instructional Method
Group Internet-based
Prerequisites
None
Advanced Preparation
None
Identifying and Addressing Deficiencies in IT Controls
By the end of this session, you will be able to:
Draft deficiencies in a way that management can understand
Create action plans that are appropriate based on when the issue is found
Determine the impact on financial reporting
Identifying and Addressing Deficiencies in IT Controls
Description:
Auditors must proactively identify IT control deficiencies and implement remediation plans. This course will cover methods for evaluating control gaps, documenting deficiencies, and developing corrective actions. Participants will also learn how to communicate findings to stakeholders.
Learning Objectives:
Identify common IT control deficiencies and their root causes.
Develop a risk-based approach to addressing IT control gaps.
Communicate IT audit findings effectively to management and external auditors.
CPE Credits
1 credit
Field of Study
Specialized knowledge
Instructional Method
Group Internet-based
Prerequisites
None
Advanced Preparation
None
Fireside Chat – Open Discussion with Guest Speakers from the Audit Collective and Course Wrap-Up
By the end of this session, you will be able to:
Apply the knowledge of others working in IT SOX
Work in IT SOX with more confidence
Use what you learned to make your organization better
Fireside Chat – Open Discussion with Guest Speakers from the Audit Collective and Course Wrap-Up
Description:
This interactive session will allow participants to interact with experienced professionals in the IT audit field. In a roundtable discussion format, guest speakers from the Audit Collective will share their insights and experiences related to SOX compliance, ITGCs, ITACs, SOC reports, and other key topics covered in the course. Attendees will have the chance to ask questions, discuss challenges, and gain practical knowledge from experts in the field.
Learning Objectives:
Gain insights from experienced IT audit professionals on SOX compliance challenges.
Engage in meaningful discussions on ITGCs, ITACs, and other key audit topics.
Apply lessons learned from industry experts to improve IT audit practices.
CPE Credits
1 credit
Field of Study
Specialized knowledge
Instructional Method
Group Internet-based
Prerequisites
None
Advanced Preparation
None
About the Course Instructor
Toby DeRoche
MBA, CIA, CCSA, CRMA, CFE, CISA, cAAP
Toby DeRoche is the founder of Insight CPE, LLC, dedicated to advancing education for audit, risk, and fraud professionals. Throughout his career, he has advised governance and assurance professionals on effective solutions for audit, risk, and compliance challenges.
With nearly 20 years of experience in internal audit, fraud examination, and technology enablement consulting, Toby brings deep expertise to the profession. He has authored over 100 blogs and written the books Agile Audit: Transformation and Beyond and Only Audit What Matters.
In addition to his thought leadership, Toby applies his expertise in practice as a Senior Manager of IT Controls at Agilon Health.
How the course works:
Sessions will start April 21, 2025 and run through May 15, 2025 from 12pm - 1pm EST.
Access Method:
Granted through the Internal Audit Collective Community under “Upcoming Events” Participation links will be provided
Who is this Course For?
SOX Auditors, Internal Auditors, and Internal Controls SOX practitioners who have never been trained on the fundamentals and practical application of IT Audit.
If you manage a SOX compliance program that struggles with determining what ITGCs and ITACs should be in and out of scope, and are looking for ways to reduce IT control deficiencies.
If you are looking for a sound strategy to use to improve your organization’s approach to IPEs and IUCs.
Who is this course not for?
IT Auditors with more than 8 years of experience.
You are not respectful or quickly dismissive of new ideas, practices or concepts.
Register for the
SYNERGY
SYNERGY: Creating the Data -Driven Internal Auditor
9 expert Instructor-led
7 facilitated workshops and peer discussions
Syllabus with all shared presentations and templates
BONUS 12 month access to the Internal Audit Collective Community
Frequently Asked Questions
Who is this course for?
Internal Audit Staff, Seniors, and Managers who are tasked with the use of data analytics in the course of an internal audit project
A risk-based audit leader seeking an application agnostic of any data analytics application
Any 2nd or 3rd line compliance or transaction-based auditor with data analytic responsibilities
Who are you? And what is the Internal Audit Collective?
Hi - I’m Tom O’Reilly. I help internal audit and SOX professionals uplevel their programs and careers.
You can read more about my backstory and why I built the Internal Audit Collective here.
Are the CPEs NASBA certified?
We are working towards this.
What if I cannot attend all of the meetings?
You will receive CPE credits for all sessions that you attend.
You will receive a certificate of completion for participating in 80% of the meetings (13 total)
OK - I’m sold. What happens after I pay for the course?
Once you are registered, you will receive a welcome email, which will include the program syllabus with meeting information and materials. You will be asked to choose what breakout sessions you’d like to attend (7 total). You’ll then receive meeting invites.
What do I do if I have any additional questions?
Email me at: Tom@InternalAuditCollective.com - and I’ll get back to you asap.
