AEES Executive Certificate in Audit, risk and internal control

The capabilities the assessment attests if you pass.

• Frame an audit assignment
• Hold a trail
• Get a gap decided
• Write a fact
• Propose a tenable move
• Come back to see whether management actually decided

This is the European Commission’s classification of skills, competences, qualifications and occupations. This certificate is linked to it through the skills below. Each link opens the official record.

• internal auditing http://data.europa.eu/esco/skill/8804d963-5a31-4609-b5df-f741b7199fb7
• risk management http://data.europa.eu/esco/skill/6eff134b-e34f-4d6e-a6e8-5e47cf2228d0
• implement corporate governance http://data.europa.eu/esco/skill/f2c63b7a-ed6c-4890-9f8c-7685d172624c

Scientific readings related to this certificate.

• Financial Risk Management and Explainable, Trustworthy, Responsible AI 2022 · Finance, risk and ESG
• Understanding the Impact of ESG Practices in Corporate Finance 2021 · Finance, risk and ESG
• The impacts of ESG performance and digital finance on corporate financing efficiency in China 2021 · Finance, risk and ESG
• Machine Learning for Financial Risk Management: A Survey 2020 · Finance, risk and ESG

1. Module 1, Scope Scoping is the first decision you make that shapes everything that follows. It tells management what you will look at and, as important, what you will not. A clear scope protects the assignment from drifting, keeps effort aligned with risk, and allows you to deliver a conclusion that stands on solid ground. Weak scoping spreads work too thin, confuses stakeholders, and leads to findings that are contested or not actionable. In practice, scope is where assurance intent meets real constraints. You balance ambition with what can be done in the time, with the data, people, and budget you have. You decide the auditable unit, the period, the locations, the processes, and the controls that matter. You also name exclusions and assumptions up front. This is not about limiting accountability. It is about focusing attention on what is material for the objective and documenting the logic of that choice.
2. Module 2: Risk Risk work is your compass. It tells you where the organization is exposed and where your limited audit time will change outcomes. The practical meaning of the public synopsis, Go where it breaks, not where it is convenient, is that you will accept discomfort and uncertainty to look at what can damage objectives, customers, cash, compliance, and reputation. This module gives you a simple, robust way to work with risk in any audit. You will define risks in clear words, link them to objectives, and evaluate both the scale and speed of exposure. You will separate inherent from residual risk, connect risks to controls, and decide what deserves deeper testing now and what can wait.
3. Module 3, Trail: Follow an operation end to end Trail work is the moment an auditor leaves the plan and goes into the operation. You pick one complete operation, then follow it step by step until you can explain every movement of data, cash, and decision. Your goal is to make the invisible visible. You gather evidence, test whether controls worked, and document what you saw so another professional could reproduce your steps. A solid trail rests on three pillars. First, a clear model of the process you are exploring. Second, a sharp view of risks and the specific controls intended to address them. Third, disciplined documentation that ties facts to evidence. The Institute of Internal Auditors sets the bar for due professional care and evidence sufficiency. COSO provides the reference for what an effective control system looks like. You will use both ideas when you decide whether what you saw is acceptable or not.
4. AEES Executive Certificate in Audit, Risk and Internal Control, Module 4/6: Gap A gap is the difference between what exists in practice and what should exist according to a criterion. In audit, risk and internal control work, your value depends on turning observations into decision-ready statements. This module focuses on writing the gap as a verifiable fact, not an opinion. You will learn how to link condition to criterion, show evidence, and express the risk without speculation. The ability to write a gap well is what moves an audit from description to decision. A good gap statement is specific, neutral in tone, and complete. It allows management to choose a response without redoing the analysis. When a gap is poorly framed, discussions derail into taste, preference or debate over words. When a gap is factual, debate focuses on what to do and by when.
5. AEES Executive Certificate, Module 5: Recommendation This module moves you from diagnosis to decision. You already know how to frame an assignment, follow a trail, and write facts that stand on their own. Here you will craft recommendations that management can actually adopt. Your aim is not to display knowledge or produce a catalogue of controls. Your aim is to help the organization choose a concrete next step that fits its risk, constraints, and capacity. A tenable recommendation is specific, feasible, and tied to a defined risk reduction. It is written so that a competent manager can understand the move, assign it, budget it, and know when it is done. It acknowledges constraints such as systems, vendor contracts, and regulatory deadlines. It names an owner, a timeframe, and a measure of success. It keeps the decision where it belongs, with management, while meeting professional standards for quality and clarity.
6. Follow-up Follow-up is where an audit result turns into management action or a clear and owned decision to accept risk. It is not a formality. You verify whether commitments were met, whether risk moved to an acceptable level, and whether unresolved exposure is now a conscious choice with the right authority. The discipline you apply here protects credibility, value, and continuity of your audit work. This module gives you a concrete approach to follow-up that you can apply on your next assignment. You will set evidence expectations at the end of fieldwork, build a risk-based calendar, test implementation and effectiveness, decide on closure or escalation, and document final positions. You will also learn when a change in circumstances requires you to adjust prior recommendations or timing.