Engagement Planning
Start with objectives, then risks, then procedures
Engagement planning turns the broad direction of the audit plan into a specific, achievable engagement. The internal auditor defines the engagement objectives (what the engagement is meant to accomplish), the scope (processes, locations, systems, and period included, plus explicit exclusions), and then performs a preliminary risk assessment to identify the significant risks facing the activity. The work program is built so that every step traces back to an objective and addresses an identified risk; procedures should never exist merely because they were done last year. Planning also covers resources (staff skills, IT or fraud specialists, budgeted hours), timing, communication with the engagement client, coordination with other assurance providers such as external audit, compliance, and risk management to avoid duplication and gaps, and explicit consideration of fraud risk and prior engagement results.
Traps that show up in questions
- Confusing engagement planning with the annual audit plan and audit universe.
- Copying last year's work program without refreshing the risk assessment.
- Accepting management's risk assessment without independent validation.
- Omitting fraud considerations or failing to disclose scope limitations.
- Treating planning as finished - it is continuous and must be revised when new information emerges.
- Forgetting that in consulting engagements objectives are agreed with the client and the work is advisory.
Rule of thumb: risk first. Ask what could go wrong and how we would know, then build only the procedures that would detect it.
Worked example: a preliminary survey reveals a newly implemented automated revenue system and a recent restatement. The auditor adds an IT specialist, a full-population analytics test of revenue recognition, and extends the scope period to cover the restatement. Each addition is documented against the specific risk it addresses.