Connect risks to preventive and detective controls
APD-104 · Version 1.1
Internal Controls Documentation and Audit Readiness
Design evidence-producing controls and files that let a qualified reviewer reconstruct what happened and why.
120 minCertificate included
Learning outcomes
Connect risks to preventive and detective controls
Distinguish control design from operation
Build review-ready documentation
Respond to exceptions and control changes
Course journey
7 modules. One practical action plan.
- 117 min
From risk to control
A control is useful only when it addresses a defined risk with a clear performer, frequency, evidence and escalation path.
- 217 min
Design versus operation
A well-designed control can fail in operation; a performed activity may not address the intended risk.
- 317 min
Documentation that tells the story
A qualified reviewer should understand the purpose, evidence, work performed, exceptions and conclusion without relying on memory.
- 417 min
Change and exception management
Controls degrade when systems, people or transaction volumes change and exceptions become normalized.
- 517 min
Applied case review
Newly authored derived practice: applied case review.
- 617 min
Decision record and peer challenge
Newly authored derived practice: decision record and peer challenge.
- 718 min
Practice implementation and follow-up
Newly authored derived practice: practice implementation and follow-up.
Regulatory positioning
Clear claims. No ambiguity.
Designed as relevant, quantifiable professional-development content. No CPA Ontario approval is claimed. CPA Ontario members remain responsible for determining relevance, classifying and reporting hours, and retaining supporting documentation. Ethics content is not guaranteed to qualify as ethics CPD for every participant.
