Planning an audit (ISA 300)

A firm wins the audit of a chain of supermarkets with a December year end. If it sends staff to the stores only in January, it will find that all its clients want audit staff at once, that the inventory count has already happened without an auditor present, and that the team has no idea which stores carry the highest risk.

A firm that plans, by contrast, will send a small senior team in October to learn the business and test controls, book staff for the year-end count, and bring a larger team in January for balance sheet work. Planning decides who does what, when, and with what priority.

This topic covers the purpose of an audit plan, professional scepticism at the planning stage, the objective and requirements of International Standard on Auditing (ISA) 300, the overall audit strategy and detailed audit plan, audit programmes, and the split into interim and final audit. The next topics deal with the inputs to the plan: understanding the entity, materiality and risk.

Key terms in plain English

Syllabus check

This topic is in syllabus area A, process of audit and assurance (20% of marks). It covers:

• planning (ISA 300 and ISA 320)
• the basic steps of the audit and assurance process
• professional scepticism

CAMA 2020 and audit planning

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

The purpose of an audit plan

A plan sets out what must be done to achieve an objective. In an audit the objective is a report containing an opinion on the information audited. The plan is prepared so that the objective is reached effectively and efficiently. It is the first stage of the engagement and answers three questions, the 3Ws:

• Who will do the work? (staffing)
• When will it be done? (timing)
• What work is to be done? (the scope of the audit)

To answer them the auditor needs a detailed knowledge of the entity and its environment, to assess the risk attached to the audit. Risk assessment is central to planning, and it affects the amount of work in general and the areas on which the auditor focuses. Planning is just as essential in internal audit and in other assurance engagements such as a review.

Professional scepticism at the planning stage

ISA 200 requires the auditor to plan and perform the audit with professional scepticism, defined as an attitude that includes a questioning mind, being alert to conditions that may indicate possible misstatement due to error or fraud, and a critical assessment of audit evidence. It does not mean disbelieving everything. It means asking whether what management says is reasonable and whether it conflicts with other evidence.

ISA 300: planning an audit of financial statements

The auditor's objective under ISA 300 is to plan the audit so that it will be performed in an effective manner. Good planning helps the auditor to:

1. give appropriate attention to important areas;
2. identify and resolve potential problems;
3. organise and manage the engagement so that it is efficient;
4. choose staff with suitable experience and assign work properly; and
5. direct and supervise staff and review their work.

ISA 300 requires the auditor to:

• involve the whole engagement team in planning;
• establish an understanding of the terms of the engagement under ISA 210;
• establish an overall audit strategy setting the scope, timing and direction of the audit and guiding the plan;
• develop an audit plan describing the nature, timing and extent of the planned risk assessment procedures and the planned further audit procedures; and
• document the strategy and the plan, including any significant changes made during the audit.

The overall audit strategy

Setting the strategy involves three things.

(a) The characteristics of the engagement that define its scope:

• the financial reporting framework, such as International Financial Reporting Standards, and any industry-specific reporting requirements
• the locations of the components of the entity, for example overseas branches
• the reporting objectives, such as deadlines and the communications required

(b) Factors that decide where the team's effort goes:

• materiality thresholds
• high-risk areas
• the audit approach, such as whether to rely on the entity's internal controls
• recent developments in the entity, the industry or the reporting requirements

(c) The resources needed, which means deciding:

• where experienced staff are needed, such as high-risk areas;
• how many staff go to specific areas, for example extra staff for the year-end inventory count;
• when resources are needed, such as more staff at the final audit than at the interim; and
• how they are managed, directed and supervised, including the timing of briefing meetings and of manager and partner reviews.

The audit plan and audit programmes

Once the strategy is set the auditor develops the more detailed audit plan. It sets out the procedures to assess the risk of misstatement in the accounting records and financial statements and the planned further procedures for each material area, which may respond to assessed risks or be specific procedures needed to comply with the ISAs.

The procedures are those needed to obtain sufficient appropriate audit evidence and to reduce audit risk to an acceptably low level. They are written in audit programmes, which are sets of instructions to the team that specify the procedures to be done in each area. The strategy is the map, the plan is the route and the programmes are the turn-by-turn directions.

Interim audit and final audit

Most large audits are split in two. The interim audit, perhaps two-thirds of the way through the year, covers much of the systems work and transaction testing. The final audit, shortly after the year end, covers the rest and the statement of financial position items. Spreading the work has four benefits:

• more flexible resource planning, since interim timing is more flexible and reduces the demand for staff in the busy season of the first months of the year;
• earlier identification of significant matters;
• users receive the audited accounts earlier; and
• greater efficiency.

ISA 330 notes that the higher the risk of material misstatement, the more likely it is that the auditor will do substantive procedures nearer to or at the period end.

ISA 330 says that some procedures can be done only at or after the period end:

• agreeing the financial statements to the accounting records
• examining adjustments made while preparing the statements
• procedures that respond to the risk that, at the period end, the entity has entered improper sales contracts or transactions are not finalised

Putting the plan together

A practical planning memorandum usually records:

• the client and its business
• the engagement terms and deadlines
• the framework
• the key risks
• materiality levels
• the audit approach
• the team and its budget in hours
• the timetable for interim and final visits and for the inventory count
• matters for specialists or experts
• the use of internal audit
• communications with those charged with governance

The partner approves it, and it is revised if circumstances change, because planning continues throughout the audit.

Worked examples

1. (a) Who: staffing.
2. (b) When: timing.
3. (c) What: scope.

1. The first is part of the overall strategy: the audit approach.
2. The second is a planned further audit procedure in the audit plan or programme.

1. The firm competes for staff with all clients in the busy season.
2. Moving systems work to an interim visit in October helps resource planning, finds problems earlier and lets the accounts be signed sooner.

1. That is a new component and a change in the entity.
2. The strategy and plan must be revised and the change documented.

How to score full marks

• State the 3Ws and ISA 300's objective at the start.
• Separate strategy (scope, timing, direction) from plan (procedures) from programme (instructions).
• Give a reason for each item in a resource question.
• Tie every planned procedure to a risk.

Common mistakes in the exam

• Treating planning as a step done only at the start.
• Confusing the overall strategy with the audit programme.
• Saying the interim audit is the whole audit.
• Writing a general list of audit steps with no link to risk.

Quick revision

• 3Ws: who, when, what.
• ISA 300: whole team, ISA 210, strategy, plan, documentation.
• Strategy sets scope, timing, direction.
• Interim: systems; final: balances and conclusions.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.