Audit Planning, Scoping and Risk Assessment
Domain 3 tests how you turn an annual plan into a specific engagement: what question you will answer, where the boundaries lie, what criteria you measure against, and how risk drives the depth of work.
From the audit universe to the annual plan
- Score the universe on change, complexity, transaction volume, regulatory exposure, third-party dependency and prior findings.
- The risk-based plan goes to the audit committee for approval; the charter and engagement letter supply authority and access.
Objectives, scope and criteria
- An objective is a question, for example: are access controls over the payroll system designed and operating to prevent unauthorised payments?
- Scope sets boundaries (entities, locations, applications, infrastructure, period, processes) and states exclusions explicitly.
- Criteria are the yardstick: policy, regulation, COBIT or ISO requirements. A finding without criteria is only an opinion.
Risk-based scoping
- Start from significant business processes and accounts, identify supporting applications, interfaces, reports and infrastructure, then confirm with walkthroughs.
- Include shared service centres, cloud providers, end-user computing and any report a control depends on (information produced by the entity).
- Set materiality for financial and non-financial dimensions; performance materiality is lower than overall materiality.
- Assess whether other assurance providers can be relied on. Competence, objectivity, scope and timing must all be documented.
- Hold a fraud-risk discussion that covers management override.
Worked example
An ERP upgrade goes live mid-year with a three-month parallel run. The objective covers completeness and accuracy of migration and change control over the new environment. Scope: migration events, interfaces feeding the general ledger, the parallel reconciliation, and change management for the go-live window; the marketing website is excluded and the exclusion is stated. The parallel-run reconciliation is in scope because it is the control that detects migration error. Reasoning: scope follows the risk of material misstatement, not the size or visibility of the project.
Traps
- Writing procedures where objectives belong.
- Silent scope creep: testing beyond the stated population and reporting it as if in scope.
- Relying on another assurance provider without a documented assessment.
- Planning from last year's file instead of a current walkthrough.
- Setting materiality as a single number with no rationale.