Internal audit training is a competency development program for internal auditors, ranging from audit methodology basics and risk-based auditing to preparation for professional certifications such as QIA, CIA, and BNSP schemes. It can take the form of public classes, in-house sessions at the office, online classes, webinars, or direct coaching during engagements.
This guide is written for heads of internal supervisory units (SPI), chief audit executives, and HR teams preparing an audit team development plan. It covers competency development requirements under the Global Internal Audit Standards, program types, certifications available in Indonesia, core curriculum, how to choose a provider, cost components, and how to measure results. References checked as of 5 November 2026. If you are looking for an individual career path, also read requirements to become an internal auditor.
Why Should Internal Audit Training Be Planned?
Because the professional standards require it. Global Internal Audit Standards (GIAS) 2024 which have been effective since 9 January 2025, contain three standards directly related to training.
| GIAS 2024 standard | Requirement (summary) | What it means for the chief audit executive |
|---|---|---|
| 3.1 Competency | Internal auditors must possess or obtain the competencies for their responsibilities. The chief audit executive must ensure the internal audit function collectively has the competencies for the services described in the internal audit charter | Map the team's competencies against the audit plan, not just per person |
| 3.2 Continuing Professional Development | Internal auditors must pursue continuing professional development, including education and training. Certification holders must follow the continuing education policies of their certification | Training is a routine obligation, not an occasional event |
| 10.2 Human Resources Management | The chief audit executive must evaluate each auditor's competencies and help develop them through training, supervisory feedback, and or mentoring | Link the training plan to performance evaluation results |
The considerations for implementing Standard 3.1 also advise the chief audit executive to include training funds in the internal audit budget. Examples of evidence of conformance named by the standard include a list of auditor certifications, development plans, records of completed training, and an analysis of competency gaps against the audit plan. GIAS 2024 for supervisory units is discussed in the article GIAS 2024 for the SPI.
What Are the Types of Internal Audit Training?
| Types | Suitable for | Example topics |
|---|---|---|
| Fundamentals | New auditors or newly formed audit units | The role of internal audit, standards, the engagement cycle, audit working papers |
| Risk-based audit | Auditors who already run engagements | Risk assessment, annual audit plan preparation, risk based audit |
| Audit techniques | All levels | Audit techniques, sampling, interviews, data analysis, writing findings |
| Specialized areas | Auditors assigned to specific areas | IT audit, fraud audit, procurement audit, compliance audit |
| Sector | Audit units in sectors with specific rules | Banking and rural banks (BPR), SOEs, hospitals, community health centers, universities, government internal auditors (APIP) |
| Managerial | Team leaders and chief audit executives | Internal audit strategy, communication with the board, quality assurance program |
| Certification preparation | Auditors pursuing a professional designation | QIA, CIA, or BNSP scheme exam material |
Formats vary too. Public classes bring together participants from different organizations. In-house training is held for a single organization, so case studies can use its own processes. Online classes and webinars are cheaper and more flexible. Coaching during engagements (on-the-job) is often the most effective for practical skills such as preparing working papers.
Which Internal Audit Certifications Are Available in Indonesia?
Training and certification are different. Training provides knowledge, while certification proves competency through an exam or competency test by an authorized body. Below are the ones internal auditors in Indonesia encounter most often.
| Certification | Issuer | Key features |
|---|---|---|
| CIA (Certified Internal Auditor) | The Institute of Internal Auditors (IIA) | Global internal audit certification, three-part exam |
| IAP (Internal Audit Practitioner) | IIA | Entry route for students or those without a degree; active IAP holders are exempt from CIA exam part 1 |
| QIA (Qualified Internal Auditor) | QIA Certification Board; education is delivered by the Internal Audit Education Foundation (YPIA) | National internal audit certification taken in levels |
| BNSP schemes, for example CIAO (Certified Internal Audit Officer) | BNSP-licensed Professional Certification Bodies (LSP) | Competency test based on competency units; the CIAO covers six units, from designing internal audit responsibilities to communicating engagement results |
| CRMA (Certification in Risk Management Assurance) | IIA | Focused on risk management assurance |
| CISA (Certified Information Systems Auditor) | ISACA | For Information Systems audit and IT |
| CFE (Certified Fraud Examiner) | ACFE | For prevention, detection, and investigation of fraud |
| Auditor Functional Position (JFA) | BPKP as the supervising agency | For APIP auditors in government agencies, through functional position certification training |
Requirements, levels, and fees for each certification may change. Always check directly with the issuer before registering.
What Are the Requirements for CIA Certification?
According to the IIA's official CIA page, experience requirements depend on education. Candidates may take the exam first and meet the work experience afterward.
| Education | Internal audit experience | Notes |
|---|---|---|
| Master's degree or equivalent | 1 year | All three exam parts must be passed within 3 years of applying |
| Bachelor's degree or equivalent | 2 years | Same |
| No degree, through an active IAP | 5 years, 2 of them within the last 3 years | Exam part 1 is waived; parts 2 and 3 must be passed within 3 years |
Recognized experience is not limited to internal audit; it also includes quality assurance, risk management, compliance, external audit, and internal control. After passing, practicing CIA holders must complete 40 hours of continuing professional education (CPE) each year, including 2 hours of ethics.
What Should Internal Audit Training Cover?
Standard 3.1 of GIAS 2024 lists the competency areas internal auditors should develop. This list can serve as a curriculum framework.
- Communication and collaboration
- Governance, risk management, and control processes
- Business functions, such as financial management and information technology
- Pervasive risks, such as fraud
- Tools and techniques for gathering, analyzing, and evaluating data
- The impact of economic, environmental, legal, political, and social conditions
- Laws, regulations, and practices relevant to the organization, sector, and industry
- Trends and emerging issues in the organization and the internal audit profession
- Supervision and leadership
Beyond that, make sure there are practice sessions: preparing an audit work program, filling in working papers, writing findings with five attributes (condition, criteria, cause, effect, recommendation), and monitoring follow-up. These practice sessions show results fastest in the next engagement.
Which Training Suits Each Role on the Audit Team?
| Roles | Training priorities | Relevant certifications |
|---|---|---|
| Internal audit staff (new) | Audit basics, working papers, interview and sampling techniques | IAP, QIA |
| Senior auditor or team leader | Risk-based auditing, writing findings, supervision | CIA, QIA, CIAO |
| Head of SPI or chief audit executive | Audit strategy, communication with the board, quality assurance program | CIA, CRMA |
| IT auditors | Information systems audit, cybersecurity, data analysis | CISA |
| Investigative auditor | Fraud detection, investigative interviews, digital evidence | CFE |
| APIP auditor | Functional position training, performance audit, review | JFA |
How Do You Choose a Training Provider?
- The curriculum follows GIAS 2024. Material that still uses the 2017 standards as its main reference is outdated.
- Practitioner instructors. Look for instructors who have led an internal audit function and hold relevant certifications.
- Case studies that fit your sector. Audits in banks, hospitals, and government agencies follow different rules.
- Practice sessions, not just lectures. Participants should leave with sample working papers and findings they prepared themselves.
- Recognized certificates and CPE hours. Make sure the hours can be recorded toward continuing education requirements.
- An in-house option is available. For larger teams, in-house training is often cheaper and its case studies more relevant.
- Post-training evaluation. A good provider helps measure application on the job, not just a satisfaction survey.
How Much Does Internal Audit Training Cost?
Costs vary widely, so exact figures need to be confirmed with the provider. The usual cost components are:
| Components | What to ask |
|---|---|
| Duration | Number of days or hours, and how many hours count as CPE |
| Format | Public, in-house, or online class; in-house is usually priced per class, not per person |
| Certification exam fees | Included in the training package or paid separately to the certification body |
| Materials and modules | Whether printed modules, recordings, or question banks are included |
| Accommodation and travel | For face-to-face classes out of town |
Free training is also available, usually webinars from professional associations, universities, or audit software vendors. Such webinars work well as an introduction or topic update, but do not replace a certified program.
How Do You Measure Training Results?
Training is only proven successful when the quality of the next engagements improves. The following indicators can be tracked per auditor or per team, and can be combined with internal audit KPIs.
| Indicator | How to measure |
|---|---|
| Working paper quality | Percentage of working papers that pass supervisory review without major revisions |
| Finding quality | Percentage of findings that contain all five attributes |
| Timeliness | Engagements completed on the audit plan schedule |
| Follow-up | Percentage of recommendations followed up on time by the auditee |
| Continuing education | Training hours per auditor per year against target |
After Training, How Do You Make the Knowledge Stick?
Training knowledge is often lost because the team returns to old ways of working: working papers scattered across many files, finding formats that differ by auditor, and follow-up tracked by email. Two simple steps help:
- Standardize the team's working formats from day one. You can start from our free templates: audit working paper template, internal audit work program template, and internal audit checklist template.
- Move the workflow into one system so supervision and the indicators above can be tracked without manual recaps.
Audithink is not a training provider or certification body. Audithink is internal audit management software with risk assessment, audit planning, work program templates, notifications, follow-up monitoring, and automated reports. Teams fresh from training can immediately use the same workflow for risk-based planning, work programs, working papers, and follow-up monitoring. Audithink also holds occasional events for audit practitioners; schedules are announced on the Audithink events page.
FAQ on Internal Audit Training
What is internal audit training?
A competency development program for internal auditors, from audit methodology basics, risk-based auditing, and audit techniques to preparation for certifications such as QIA, CIA, and BNSP schemes.
Is internal audit training mandatory?
Under Standard 3.2 of the 2024 Global Internal Audit Standards, internal auditors must pursue continuing professional development, including education and training. Certification holders must also meet the continuing education hours of their certification.
What is the difference between internal audit training and certification?
Training builds knowledge and skills. Certification proves competency through an exam or competency test by an authorized body, for example the IIA for the CIA, the QIA Certification Board for the QIA, or a BNSP-licensed LSP.
Which internal audit certification suits beginners?
For those without a degree or still in college, the IIA's IAP is the entry route to the CIA. Auditors working in Indonesia also commonly take the QIA or a BNSP scheme. The best choice depends on the sector and career plan.
How much experience does the CIA require?
One year for master's degree holders, two years for bachelor's degree holders, and five years for candidates without a degree through the IAP route. The exam can be taken before the experience is met.
Is there free internal audit training?
Yes, usually webinars from professional associations, universities, or audit software vendors. They work well as an introduction or topic update, but do not replace a certified program.
Conclusion
Internal audit training is most useful when it starts from the team's competency gaps against the audit plan, not from a training catalog. Map competencies, choose programs and certifications by role, then measure the impact on the quality of working papers, findings, and follow-up.
If your team wants to apply what it learned in one well-organized workflow, schedule an Audithink demo or contact our team.
