Audit Planning and Preparation
Planning converts an audit assignment into a feasible, defensible engagement. Key concepts: defining audit objectives, scope, and criteria; understanding the auditee's context, processes, significant aspects, and applicable legal and other requirements; reviewing prior findings and corrective actions; and preparing an audit plan and working documents. Stage 1 (documentation/readiness review) and Stage 2 (implementation/effectiveness) have different purposes - know which evidence belongs to which.
Preparation includes sampling strategy, time allocation, checklist or process-tracing tools, and logistics. The audit plan should be communicated and agreed with the auditee, while the auditor retains independence over methods and evidence selection. Risk-based planning focuses effort where failure would matter most: high-impact aspects, complex processes, weak controls, regulatory exposure.
Traps: treating a checklist as a substitute for understanding the process; letting the auditee dictate scope or sampling; planning only to documents and ignoring operational reality; confusing audit criteria (the standard against which you judge) with audit evidence (what you observe). Also watch for questions implying the audit plan cannot change - plans are living documents updated as evidence emerges.
Rule of thumb: Spend planning time proportional to risk and complexity. A useful check: for every planned activity, ask "what would I accept as objective evidence of conformity here?" If you cannot answer, the plan is incomplete.