Planning decides how the audit will be done before the work starts. A weak plan wastes time on unimportant items and misses the areas where misstatement is most likely. This topic covers the overall objectives of the auditor under International Standard on Auditing (ISA) 200, why an audit is planned, what ISA 300 requires, what the audit strategy memorandum contains and what information the auditor needs in order to plan.
Examiners ask you to list the areas an audit planning memorandum should cover, and to say what further information the auditor should obtain from a scenario. In the May 2026 diet the memorandum for the audit of a bank was worth 5 marks. The list is easy to learn and the marks are easy to win.
In 30 seconds
Under ISA 200 the auditor aims to obtain reasonable assurance that the financial statements as a whole are free from material misstatement, whether from fraud or error, and to report on them. The auditor must comply with the ISAs and ethical requirements, plan and perform the audit with professional scepticism, use professional judgement and obtain sufficient appropriate evidence.
If reasonable assurance cannot be obtained and a qualified opinion is not enough, the auditor disclaims an opinion or resigns. A plan is needed so that the auditor decides in advance what to do to give an opinion on time. ISA 300 requires an audit that is planned to be effective, an overall audit strategy, and a plan that includes direction, supervision and review.
The strategy memorandum records the main planning decisions and is approved by the engagement partner. To plan, the auditor needs an understanding of the entity under ISA 315, and must judge which information is relevant to material misstatement.
ISA 200: the overall objectives of the auditor
ISA 200 sets the overall objectives of the independent auditor and the way an audit is conducted under the ISAs. The auditor’s objectives are:
- to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error. This allows the auditor to give an opinion on whether they are prepared, in all material respects, in accordance with the applicable financial reporting framework; and
- to report on the financial statements, and communicate as the ISAs require, in line with the auditor’s findings.
If the auditor cannot obtain reasonable assurance and a qualified opinion is not enough in the circumstances, the auditor must disclaim an opinion or resign. Types of opinion are dealt with in the reporting topics.
What ISA 200 requires
The auditor must:
- comply with all ISAs relevant to the audit;
- comply with relevant ethical requirements;
- plan and perform the audit with professional scepticism;
- exercise professional judgement in planning and performing the audit; and
- obtain sufficient appropriate audit evidence to be able to obtain reasonable assurance.
Background: Four ideas in ISA 200 help you explain these requirements. Reasonable assurance is a high level of assurance, but not absolute. Audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated. Professional scepticism is an attitude that includes a questioning mind and alertness to conditions that may show misstatement.
The audit also has inherent limitations, which come from the nature of financial reporting, the nature of audit procedures, and the need for the audit to be done within a reasonable time and at a reasonable cost.
Why an audit plan is needed
A plan is a course of action decided in advance to reach a stated goal. An audit needs one so that the auditor can decide in advance what must be done. By the date set for completion, the auditor must be able to give an opinion on whether the financial statements give a true and fair view, and to meet the objectives of ISA 200.
The extent and type of work are decided largely by the auditor’s professional judgement. Planning is how the auditor applies that judgement to the circumstances of the particular audit. The starting point is to decide which audit strategy to adopt. The auditor considers, among other things:
- audit risk, including control risk;
- materiality; and
- the use that might be made of computers, and the effect of the client’s computer-based system on the audit approach.
Background: Good planning also helps the auditor give proper attention to important areas, find potential problems early, organise and manage the work, choose a team with the right skills, direct and supervise it, and coordinate the work of component auditors and experts.
ISA 300: planning an audit of financial statements
ISA 300 regulates the auditor’s planning. It requires the auditor to plan so that the work is performed effectively, and to develop an overall audit plan setting out the expected scope of the audit and how it should be conducted. ISA 300 states that:
- the audit should be planned so that it is performed effectively;
- the auditor should establish an overall audit strategy; and
- the audit plan should include measures for the direction, supervision and review of audit work.
Background: “Audit plan (strategy document)” is often used as one heading. ISA 300 itself separates two documents, and the difference is useful in an exam answer.
| Document | What it sets |
|---|---|
| Overall audit strategy | The scope, timing and direction of the audit. It guides the development of the more detailed plan |
| Audit plan | The nature, timing and extent of the risk assessment procedures (ISA 315), of the further audit procedures that respond to assessed risks (ISA 330), and of other procedures needed to comply with the ISAs |
ISA 300 also treats planning as continuous and not a single phase at the start. The auditor updates the strategy and plan as the audit goes on. The engagement partner and key members of the team take part in planning, and the strategy, the plan and any significant changes are documented.
The audit strategy memorandum
Most auditors prepare an audit strategy memorandum. It is a document that sets out the main points in the planning process and the key planning decisions made. The engagement partner reviews and approves it.
| Area | What the memorandum records |
|---|---|
| 1. Objectives and reports | The objectives of the assignment and the reports to be issued |
| 2. Timetable | The audit timetable, set to meet the deadline for the auditor’s report |
| 3. Changes | Changes in the client’s organisation or business, and external changes affecting it, since the last audit |
| 4. Ratios | A summary of key financial ratios and other ratios from previous years |
| 5. Planning decisions | The decisions taken in planning, such as strategy and materiality |
| 6. Use of others | How the client’s staff (for example internal auditors) and external experts will be used |
| 7. Problem areas | Possible problem areas and how to deal with them |
| 8. Staffing | Staff needed, allocation of work among the team, time budgets and records of earlier audits |
| 9. Locations | Where the team will attend, if the client has more than one location |
| 10. Communication | How the auditor will communicate with the client, such as meetings and reports |
Further areas that the exam rewards
Background: The May 2026 model solution for the bank question adds the points below to the syllabus list. They agree with ISA 300 and ISA 315, and you should use them where the facts invite it.
- Risk assessment. The engagement is risk-based, so effort is directed at what could lead to material misstatement. Risk assessment is continuous and is revised as the audit proceeds.
- Objectives. Whether the engagement is statutory, a compliance review, an internal control review or a value for money study decides the areas to cover.
- Users of the financial statements. The needs of the board, the audit committee, management and regulators. A regulator may expect certain disclosures, and failure brings sanctions.
- Available resources. Time, budget, the competence of the team and specialists, so that expectations are realistic.
- Materiality and significance. Attention goes to balances that are material in size or nature.
- Compliance with laws, regulations and standards. Omitting a requirement can make the report misleading.
- Previous findings. Unresolved points from earlier audits, internal audit and regulators that need follow-up.
Information needed to plan
ISA 300 requires an overall strategy and an audit plan. ISA 315 requires enough understanding of the entity and its environment to understand the risks of material misstatement. To meet both, the auditor draws on many sources. Each client is different, so the auditor, and you in the exam, must use initiative and judgement to decide what is relevant and reliable.
Planning does not include the detailed tests. The responses to assessed risks happen later, under ISA 330. The auditor therefore balances efficiency and sufficiency, and does not spend time on information that does not help planning.
Missing information in a scenario
A common requirement gives a scenario that leaves out something the auditor needs, and asks what further information to obtain. Study the pattern in the table.
| Information to obtain | Why it matters |
|---|---|
| A copy of a new loan agreement | Overdraft limits and covenants; whether any have been breached; classification of the loan and going concern |
| Legal correspondence about an incident in the year | Effect on the financial statements: provisions, contingent liabilities and disclosure |
| Details of significant new sales contracts with key customers | Revenue recognition, penalty clauses and onerous contracts |
| Prior year financial statements | Accounting policies, provisions and contingent liabilities for financial instruments, pensions and legal cases |
Background: Other useful sources are board and audit committee minutes, budgets and forecasts, management accounts, correspondence with regulators and tax authorities, internal audit reports, and the previous year’s management letter and audit file.
Information that is not relevant
The objective of the audit is to find whether material misstatement exists. Information about immaterial matters, or about operations that do not help decide whether a material misstatement exists, may not be relevant to planning an audit. The same information can still matter for other engagements, such as reviews, compilations, agreed-upon procedures and assurance engagements.
Direction, supervision and review
ISA 300 requires the plan to include measures for the direction, supervision and review of the work.
Background: In practice this means briefing the team on the client and the main risks, giving each member work that fits their competence, supervising as the work proceeds, and reviewing the working papers, with the partner reviewing the significant areas and the opinion. The detailed duties of the engagement partner are in the earlier topic on ISA 220.
The rules in more depth
Why planning is continuous
Facts change during an audit. A debtor may go into liquidation, a new contract may come to light, or a control test may fail. Each can change the risk assessment, and therefore the planned work. So the strategy and plan are updated, and significant changes are recorded with the reasons.
Why the partner approves the memorandum
The engagement partner is responsible for the audit and its quality. The memorandum records the key decisions about risk, materiality, staffing and the use of others. These are the judgements the partner is accountable for, so the partner must agree them before the work is done.
Why users and objectives shape the plan
An audit exists to give users confidence in the financial statements. The users, and the reports they expect, show where the auditor must look hardest. For a bank, depositors and regulators care about capital adequacy, liquidity and loan quality. The plan will therefore give extra weight to loan loss provisions and regulatory compliance.
Why the timetable matters
The report must be issued by a date. If the time available is short, the auditor must decide early whether to add staff, adjust the approach or tell the client that the deadline is at risk. Planning that ignores the deadline risks unfinished work and a rushed opinion.
Worked example: a planning memorandum for a microfinance bank
Scenario. Okonkwo and Partners is to audit Prime Link Microfinance Bank Ltd for the year ended 31 December. The bank has 14 branches, loans of ₦9 billion and deposits of ₦12 billion. It is licensed and supervised by the Central Bank of Nigeria and its deposits are insured by the Nigeria Deposit Insurance Corporation (NDIC). A new core banking system started in six branches in August.
Two branch managers were dismissed during the year for suspected loan fraud. The previous management letter criticised weak loan documentation. The firm has three weeks before the date for submitting the audited accounts to the regulator. Required: (a) discuss the areas the planning memorandum should cover; (b) identify additional information the auditor should obtain.
- Objectives and reports. A statutory audit with an auditor’s report and a management letter, plus any regulatory reporting.
- Users and regulators. The board, audit committee, management, depositors, the Central Bank of Nigeria (CBN) and the NDIC. Regulatory ratios and disclosures need attention.
- Risk assessment. Loan fraud, loan loss provisions, the new core banking system, and weak loan documentation. Revisited as the audit goes on.
- Materiality. A basis suited to a bank, with lower thresholds for areas of regulatory sensitivity.
- Changes since last year. The new system and the dismissals.
- Key ratios. Loan to deposit, capital adequacy and liquidity ratios, compared with prior years.
- Resources and use of others. An information technology (IT) specialist for the system migration. The firm will decide whether to use internal audit work.
- Timetable and staffing. Three weeks is short for 14 branches, so extra staff and branch visits must be planned early.
- Previous findings. Follow up the loan documentation weaknesses.
- Communication. Regular meetings with the audit committee and management.
(b) Additional information. The latest CBN examination report; the investigation reports on the two dismissed managers and the branches they ran; reports on the system migration and data conversion; the loan classification and provisioning policy; the latest management accounts and regulatory returns; and the prior year financial statements and audit file.
How to score full marks
- Use the syllabus list as the skeleton and add the exam extras: risk assessment, users, resources, materiality, compliance and previous findings.
- Tie each area to the facts. “Timetable: three weeks for 14 branches, so extra staff” earns more than “timetable”.
- For “additional information”, give the document and the reason. Look for the gap in the scenario, such as a loan, a legal case or a new contract.
- Keep to planning. Do not describe detailed tests, which come after risk assessment.
- Do not list irrelevant items, such as operating details that cannot cause a material misstatement.
- For ISA 200, give the objective first and then the five requirements.
- Time. Spend time in proportion to marks. One mark is one well-made point.
Common mistakes in the exam
- Writing about audit procedures when the question asks about planning.
- Listing areas of the memorandum with no explanation or link to the client.
- Forgetting that the engagement partner approves the memorandum.
- Leaving out the timetable, staffing and use of experts.
- Confusing the objectives of ISA 200 with those of ISA 300.
- Asking for information that would not affect the financial statements.
- Saying planning is finished once the memorandum is signed.
Quick revision
- ISA 200 objectives: reasonable assurance that the financial statements are free from material misstatement, and report on them.
- ISA 200 requirements: comply with ISAs and ethics; scepticism; judgement; sufficient appropriate evidence.
- Cannot obtain reasonable assurance and qualification is not enough: disclaim or resign.
- ISA 300: effective planning; overall strategy; plan includes direction, supervision and review.
- Strategy memorandum: objectives and reports, timetable, changes, ratios, planning decisions, use of others, problem areas, staffing, locations, communication. Partner approves.
- Extras: risk assessment, users, resources, materiality, compliance, previous findings.
- Information to plan: understanding under ISA 315; loan agreements, legal letters, key contracts, prior year statements. Detailed responses come later under ISA 330.
Practice questions
These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.
Recall check: multiple choice
The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.
Question 1. Under ISA 200 the auditor aims to obtain:
- Absolute assurance on the financial statements
- Reasonable assurance that the financial statements as a whole are free from material misstatement
- Limited assurance on internal control
- Assurance on management’s performance
Show the answer
B. Reasonable assurance is high but not absolute.
Question 2. If the auditor cannot obtain reasonable assurance and a qualified opinion is not enough, the auditor should:
- Issue an unmodified opinion
- Disclaim an opinion or resign
- Ask the client to change the figures
- Ignore the problem
Show the answer
B. Resignation depends on the law allowing it.
Question 3. Which of the following is NOT a requirement of ISA 200?
- Comply with relevant ethical requirements
- Plan and perform the audit with professional scepticism
- Prepare the financial statements for the client
- Obtain sufficient appropriate audit evidence
Show the answer
C. Preparing the statements is management’s job.
Question 4. ISA 300 requires the auditor to establish:
- An overall audit strategy
- The client’s business strategy
- The board’s dividend policy
- The client’s marketing plan
Show the answer
A. The plan must also include direction, supervision and review.
Question 5. The audit strategy memorandum should be reviewed and approved by the:
- Audit junior
- Engagement partner
- Client’s directors
- Company secretary
Show the answer
B. The partner is responsible for the audit.
Question 6. Which of the following would NOT be in the audit strategy memorandum?
- The audit timetable
- Staffing and time budgets
- Changes in the client’s business since the last audit
- The final audit opinion
Show the answer
D. The opinion is formed at the end of the audit, not at planning.
Question 7. A client took out a large new bank loan during the year. Which information is most relevant to planning?
- A copy of the loan agreement
- The lender’s staff list
- The client’s holiday calendar
- A director’s home address
Show the answer
A. It shows covenants, limits and security.
Question 8. The detailed audit tests that respond to assessed risks are designed under:
- ISA 330
- ISA 200
- ISA 210
- ISA 260
Show the answer
A. ISA 330 deals with the auditor’s responses to assessed risks.
Question 9. Information is relevant to audit planning if it helps decide:
- Whether material misstatement may exist
- The auditor’s fee only
- The date of the client’s party
- The directors’ dividend
Show the answer
A. Immaterial or purely operational matters may not be relevant.
Question 10. A scenario mentions a legal dispute but gives no details. The best additional information to ask for is:
- Legal correspondence between the client and its lawyers
- The lawyers’ invoice only
- The client’s logo
- The chief executive’s biography
Show the answer
A. It shows the likely effect on provisions and disclosure.
Written questions
Question 11 (10 marks). Explain the overall objectives of the auditor and the requirements of ISA 200, and say why an audit plan is needed.
Question 12 (20 marks). (a) Describe the contents of an audit strategy memorandum. (10 marks) (b) Explain what ISA 300 requires of the auditor in planning an audit. (4 marks) (c) Explain how the auditor decides which information is relevant to planning, with examples of further information that may be needed. (6 marks)
Question 13 (10 marks). Ope and Co is planning the audit of Koko Fabrics Plc, a listed textile manufacturer.
The planning notes record that:
- a ₦3 billion bank loan was drawn in March
- an employee was injured in a factory fire in August and has threatened to sue
- a three-year supply contract with a national retailer was signed in June
- the finance director left in September and the new finance director has reviewed the inventory accounting policy
- the largest customer has been slow to pay since October
Identify the additional information the auditor should obtain and explain why each item matters. (10 marks)
Model answers
Show the model answer to Question 11
Objectives (3 marks). To obtain reasonable assurance that the financial statements as a whole are free from material misstatement, whether from fraud or error, so that the auditor can give an opinion on whether they are prepared in accordance with the applicable framework. (1.5) To report on the financial statements and communicate as the ISAs require.
(1) Where reasonable assurance cannot be obtained and a qualified opinion is not enough, the auditor disclaims or resigns. (0.5)
Requirements (5 marks). Comply with all relevant ISAs; comply with relevant ethical requirements; plan and perform the audit with professional scepticism; exercise professional judgement; obtain sufficient appropriate audit evidence to obtain reasonable assurance. (5, 1 each)
Need for a plan (2 marks). The auditor must decide in advance what to do so that an opinion can be given by the completion date and the objectives of ISA 200 are met. (1) Planning lets the auditor apply professional judgement to the circumstances of the audit, starting with the choice of strategy and consideration of audit risk, materiality and computers. (1)
Show the model answer to Question 12
(a) Contents of the memorandum (10 marks, any ten at 1). The objectives of the assignment and the reports to be issued. The audit timetable to meet the reporting deadline. Changes in the client’s organisation, business or environment since the last audit. A summary of key ratios from previous years. The planning decisions taken. Use of the client’s staff, such as internal audit, and of external experts.
Possible problem areas and how to deal with them. Staffing, allocation of work, time budgets and records of earlier audits. Attendance locations. Methods of communication with the client. Risk assessment. Users and their needs, including regulators. Materiality. Compliance with laws and standards. Previous findings for follow-up. The memorandum is approved by the engagement partner.
(b) ISA 300 (4 marks). The audit must be planned so that it is performed effectively. (1) The auditor must establish an overall audit strategy, setting the scope, timing and direction. (1) The plan must set out the expected scope and how the audit is conducted. (1) The plan must include measures for direction, supervision and review of the work. (1)
(c) Relevant information (6 marks). The auditor needs enough understanding of the entity and its environment under ISA 315 to understand the risks of material misstatement. (1) Information is relevant if it helps decide whether material misstatement may exist. Immaterial or purely operational matters may not be. (1) The detailed responses to risk come later, so the auditor balances efficiency against sufficiency.
(1) Examples: a new loan agreement, for limits, covenants and breaches (1); legal correspondence on incidents in the year, for provisions and contingent liabilities (1); new significant sales contracts, and prior year statements for policies, provisions and contingencies (1).
Show the model answer to Question 13
Bank loan (2 marks). Obtain the loan agreement. It shows the covenants, security, repayment terms and any breach, which affect classification, disclosure and going concern. (2)
Factory fire and threatened claim (2 marks). Obtain legal correspondence and the details of any insurance cover. This shows whether a provision or contingent liability is needed, whether an insurance recovery exists and whether damaged assets are impaired. (2)
Supply contract (2 marks). Obtain a copy of the contract. It shows the prices, volumes, penalties and delivery terms. These affect revenue recognition under International Financial Reporting Standard (IFRS) 15 and the risk of an onerous contract. (2)
Change of finance director (2 marks). Find out why the finance director left, whether there were any disagreements, and what the review of the inventory policy changed. Obtain the prior year financial statements and policies. A departure and a policy change may signal pressure or a change in estimates. (2)
Slow-paying customer (2 marks). Obtain an aged receivables analysis, correspondence with the customer, credit terms and receipts after the year end. These show whether the receivable is recoverable and whether an allowance for expected credit losses is enough. (2)
Pathfinder on audit planning and the strategy memorandum
These are the ICAN Pathfinder questions that test this topic. ICAN owns the questions and the suggested solutions, so we point you to them and do not copy them. Open your Pathfinder, attempt each question under exam conditions, then check your answer against the notes above.
For the audit of a bank, whose highlights of performance and many user groups are described, you discuss the areas the audit planning memorandum should cover (5 marks). The other parts of Question 2, on the expert, audit evidence and the materiality benchmark, are covered in later topics.
Revise first: The audit strategy memorandum
Section A is a single compulsory case with several requirements. It has drawn on ethics, quality management, group audits and reporting. Practise the scenario method in this topic before you attempt it.
Revise first: How to score full marks
Source: ICAN Pathfinder, Advanced Audit, Assurance and Forensics. Diets covered: May Diet, 2026 and November Diet, 2025.
Spotted a mistake? Tell us and we will check it.
