Audit Planning, Engagement Objectives, and Scope
Planning items test whether objectives are answerable and scope boundaries explicit. Expect to convert a vague concern into objectives, criteria, scope and a work program.
Core rules
- The risk-based plan (Standard 2010) flows from a documented assessment of the audit universe performed at least annually, considers input from senior management and the board (2010.A2), and is approved by the board (2011). Significant interim changes are communicated (2012).
- Engagement planning (2200/2201) weighs objectives, significant risks, criteria, resources and reporting expectations.
- Objectives (2210) state what the engagement will achieve, normally an assessment of whether risk management, control and governance are working. They are not task lists. Fraud, IT and governance risks must be considered (2210.A2).
- Scope (2220) defines processes, locations, systems, periods and records included; exclusions should be stated so readers do not over-read the conclusion.
- The work program (2240) documents procedures that test controls against criteria. Criteria must be suitable, sufficient and relevant - statute, policy, contract or a recognized framework.
Worked example
A council member says procurement cards are "out of control". A fraud allegation is not an objective. The assurance objective becomes: determine whether controls over card issuance, transaction approval and reconciliation provide reasonable assurance that purchases are valid, authorized and within policy. Scope: 12 months, all 400 cardholders, card-system data plus reconciliations; contract-award decisions are expressly excluded. The work program then tests approvals against the card policy using full-population analytics and voucher samples.
Traps
Objectives written as verbs ("to review the policy"); missing period or system boundaries; scope creep without re-budgeting resources; drafting recommendations before criteria are agreed.