Engagement Basics: Planning, Evidence, Findings, and Follow-Up
Planning
Every engagement begins with objectives (what the audit will answer), scope (what is included and excluded), and criteria (the standards or expectations against which the area is measured). Planning outputs include the engagement plan, a work program, resource and time estimates, and communication with management. Understanding the process usually involves walkthroughs, inquiry, and review of prior audit work; a risk assessment determines how much testing is warranted.
Evidence and sampling
Sufficiency is quantity; appropriateness is relevance plus reliability. Reliability, strongest to weakest: the auditor's direct observation or reperformance, examination of original documents, external evidence, internal evidence, and inquiry alone. Always corroborate inquiry with another procedure. Statistical sampling permits quantified precision and defensible projections; nonstatistical sampling rests on judgment. Attribute sampling tests deviation rates for compliance; variable sampling tests monetary amounts. Documentation must let an experienced auditor with no prior connection to the engagement understand the work and support the conclusions; supervision and review are mandatory.
Findings and follow-up
A finding contains criteria (what should be), condition (what is), cause (why it happened), and effect (risk or impact), plus a recommendation. Discuss the draft with management for factual accuracy and agreed action plans. Management owns the risk decision and corrective action; the CAE escalates unremediated significant risk to the board. Follow-up confirms that action was implemented and is effective.
Traps and rule of thumb
Traps: management may correct facts, not soften findings; a scope restriction must be disclosed, not glossed over; inquiry alone never supports a conclusion. Rule of thumb: every finding must satisfy C-C-C-E before it reaches the report.