Audit Planning and Risk Assessment
From risk to plan
Audit planning starts with understanding the organisation: its objectives, processes, systems, and the risks that threaten its objectives. Candidates must know the difference between inherent risk (before controls), control risk (that controls fail to prevent or detect), and residual risk (after controls). A risk-based plan prioritises engagements by residual risk and materiality, not by convenience or by who complained loudest.
Key planning tools
Know the audit universe (all auditable areas), the engagement plan (objectives, scope, criteria, resources, timetable), and the terms of reference. Understand materiality - the threshold at which an error would change a decision - and how it drives sample sizes and testing depth. Know how to use walkthroughs to confirm understanding of a process and how to set the scope boundary so the engagement is achievable.
Traps to watch
- Treating a high inherent risk as high residual risk without considering controls.
- Confusing a risk (uncertain event affecting objectives) with a control (action that mitigates risk).
- Setting scope so broad the engagement cannot be completed, or so narrow the conclusion is meaningless.
- Forgetting to update the plan when new information emerges during fieldwork.
Rule of thumb
Prioritise by residual risk and materiality. If a process has strong controls, it can be planned at lower frequency even if the underlying inherent risk is high.
Worked example
A payments process has high inherent risk but strong automated controls tested last year with no exceptions. Residual risk is moderate, so a reduced-scope engagement with a shorter sample is defensible - provided the auditor documents why the control environment is still reliable.