An audit plan is a critical area of the audit that is primarily performed at the start of the audit process to ensure that appropriate attention is devoted to important areas, potential problems are identified promptly, work is completed expeditiously, and work is properly coordinated. “Audit planning” entails developing a broad strategy as well as a detailed approach for the audit’s expected nature, timing, and scope. The auditor intends to complete the audit in a timely and efficient manner.
Audit Plan Definition
An audit plan is the specific guideline to be followed when conducting an audit. It assists the auditor in obtaining sufficient appropriate evidence for the circumstances, keeping audit costs reasonable, and avoiding misunderstandings with the client. Audit planning entails developing an overall strategy for the audit engagement, with a particular emphasis on planned risk assessment procedures and responses to identified material misstatement risks.
It goes into detail about what, where, who, when, and how:
What are the audit’s goals?
Where will the audit take place? (i.e. range)
When will the audit take place? (For how long?)
What are the auditors’ qualifications?
How will the audit be carried out?
Audit Planning Process
The Audit Plan process procedures listed below:
Understanding of the client’s business, including financing, legal framework, government norms, investments, accounting policies, business risk, and financial risk.Creating audit strategies or an overall plan (who, when and how)Audit programmer preparation
Risk In Audit Planning
The responsibility for establishing and maintaining a system of internal controls within an entity is with management. The management of the organization plans accordingly and directs the performance of the required response to provide reasonable assurance that the objectives and goals of the entity will be met.
Structures, activities, processes, and systems that help management effectively reduce the risk levels are all examples of internal controls. Internal controls are an important part of risk management.
As the internal auditors are experts in understanding risks and internal controls of an organization available to reduce such risks, they are in a distinct position to help management in safeguarding their organizations from risk exposures present and future.
Risk Management
These are ranging from minor effects to major accidents. The internal audit activity aid both management and the oversight body (such as the board or its audit committee) in enterprise risk management by:
Helping the organization management to understand internal controls and risk management processes;Preparing and implementing a risk assessment framework for internal audit planning;Bringing a systematic, disciplined auditing approach and technique to assess the effectiveness of internal controls and risk management processes in place;Giving objective and independent assurance that the organization’s risks have been accordingly reduced; and Preparing recommendations for the improvements, as needed.
The chief audit executive of the organization is responsible for developing the risk-based plan. He considers the organization’s risk management framework including those using risk appetite levels set by management for the different activities or parts of the organization.
Potential Scope and Engagement on Internal Audit
If a framework is not existing, the chief audit executive is required to exercise his/her judgment of risks after considering the input from senior management and the board. He must scrutinize and adjust the plan, as needed, in response to changes in the organization’s business, risks, operations, programs, systems, and controls.
Management may have special projects that may also be included in the audit plan. The chief audit executive should consider accepting recommended consulting engagements based on the engagement’s potential to revamp the management of risks, add value, and improve the organization’s operations.
The engagements that have been accepted should be part of the plan. Special requests can come in many forms and cover tangible and intangible assets. For example, the Head of information technology might request an internal audit to be carried out of a newly installed mainframe computer. Risks could range from physical harm to the mainframe or burglary of the hardware and the aftermath of such damage or loss.
In essence, internal auditors cannot evaluate every possible risk facing an organization. The multiple sources of potential engagements together with the related scope of work require the efficient use of limited internal audit resources available. The chief audit executive must develop a risk-based plan to determine the priorities of the internal audit activity.
Final Thoughts
Planning the audit entails developing an audit plan and establishing the overall audit strategy for the engagement, which includes, in particular, planned risk assessment procedures and planned responses to the risks of material misstatement. Planning is not a discrete phase of an audit, but rather a continuous and iterative process that may begin soon after (or in conjunction with) the completion of the previous audit and continue until the completion of the current audit.
By developing an audit plan at the beginning of an audit, an auditor is better able to anticipate problems that may arise during the engagement while also conducting the audit efficiently. Furthermore, an audit plan aids in maintaining control over the audit team’s costs. Finally, it is useful for defining the scope of the engagement so that audit work does not stray outside of this defined area.
