Audit and Assurance Engagement Planning
This domain tests whether you can turn a broad request into a scoped, risk-based engagement with clear objectives, criteria, and a work program that supports a conclusion.
Core rules and concepts
- Engagement planning establishes objectives, scope, criteria, risks, resources, and communication. The engagement objective states what will be concluded; procedures state how evidence will be gathered.
- Criteria are the standards used to evaluate the activity, such as policy, law, contract terms, or a control framework. If criteria are unclear, agree them with management before fieldwork.
- Scope defines boundaries, period, locations, systems, and limitations. Exclusions and scope limitations must be documented and communicated.
- Planning includes fraud risk consideration and may be updated as new information emerges.
- Internal audit materiality is judged by significance to the engagement objective, not only by financial amount.
Worked example
A request to "review procurement" is not an objective. A workable objective is: assess whether vendor selection from January to December complied with procurement policy and whether approval controls operated effectively. Criteria are the policy sections on competitive quotes and approval thresholds. Risks include split purchase orders and undocumented vendors. The work program then specifies samples, system access tests, and interviews, with a budget and milestone dates.
Traps that cost marks
Starting fieldwork before criteria are agreed; confusing the audit program with the engagement plan; allowing scope creep without documenting a change; and failing to revise the plan when a significant risk emerges.