Audit Planning and Risk-Based Engagement Planning
From strategy to engagement
Planning operates at three levels: the multi-year strategic audit plan, the annual risk-based audit plan, and the engagement plan for each audit. The annual plan is derived from a risk assessment of the audit universe, considering materiality, risk exposure, prior audit results, changes in the environment, and available resources. Candidates must understand the audit universe, risk scoring, prioritisation, and the need for the annual plan to be approved by the head of the organisation (with input from the audit committee where one exists).
Engagement planning
For each engagement, the auditor defines objectives, scope, criteria, and approach; performs a preliminary risk assessment; determines materiality; allocates resources and time; and prepares a work programme. The engagement plan is documented and approved before fieldwork, and updated if significant issues arise.
Traps
A common trap is treating the annual plan as fixed - it should be revised when significant risks emerge. Another is confusing engagement objectives (what the audit will achieve) with scope (the boundaries). Questions also test that planning is risk-based, not cyclical or request-driven alone, and that resource constraints must be documented rather than silently narrowing scope.
Rule of thumb
Plan risk-first: identify the audit universe, score risks, allocate resources to the highest residual risks, then define objectives, scope and criteria per engagement. If scope is limited, say so in the report.
Worked example
A ministry has 40 processes and resources for 8 audits. Risk scoring ranks procurement and EU-fund management highest on impact and likelihood. The annual plan selects those, documents the rationale, and notes the residual risk of un-audited areas for the head of the organisation.