An audit programme is the set of detailed procedures the audit team will perform for each area of the financial statements, tied to the risks of material misstatement the auditor has assessed. It sits beneath the audit strategy and audit plan required by SA 300 and puts into operation the further audit procedures that SA 330 requires, with the work recorded as SA 230 requires.
Facts checked: 10 October 2026. The SA 300 structure (overall audit strategy and audit plan, with the planned nature, timing and extent of procedures) and the SA 330 requirement that further procedures be responsive to assessed risks at the assertion level were checked against ICAI-hosted material and secondary commentary; I could not open the full ICAI standard texts, so paragraph numbers are deliberately not quoted. The SA 230 requirement to record identifying characteristics of items tested, and who performed and reviewed the work and when, was checked against ICAI-hosted training material. The 60-day file assembly period is from SQC 1 commentary. The sample programmes use invented facts.
Strategy, plan and programme: how they differ
| Document | Answers | Typical content |
|---|---|---|
| Overall audit strategy | How will the audit be scoped and resourced? | Scope, timing, materiality, significant areas, team, use of experts |
| Audit plan | What risk assessment and further procedures are planned, in what nature, timing and extent? | Risk assessment procedures, planned responses by area, direction and supervision |
| Audit programme | What exactly will each person do, and where is it recorded? | Step-by-step procedures by account or assertion, with references and sign-off |
In practice the plan and programmes are often one set of working papers. What matters is that every procedure traces back to a risk. For the full sequence see audit process step by step and the audit strategy memorandum template.
What each line of a programme should carry
- Objective and assertion. For example, existence and valuation of trade receivables.
- Risk reference. The assessed risk the procedure responds to.
- Procedure. Confirmation, subsequent receipts, ageing recomputation, cut-off test.
- Nature, timing, extent. Which type of procedure, interim or year-end, and sample size or coverage.
- Working paper reference.
- Prepared by, date; reviewed by, date.
A standard firm programme is a starting point, not the answer. Delete steps that no assessed risk calls for, and add steps where a risk is unusual: a customer concentration, a change in billing system, a disputed receivable.
Sample extract: trade receivables
Invented facts: a manufacturing company, year ended 31 March 2027, receivables ₹18.4 crore, three customers making up 58% of the balance, ageing deteriorating in one segment. Receivables are assessed as a significant risk for valuation.
| Assertion | Procedure | Nature / timing / extent | W/P ref | Done by / reviewed by |
|---|---|---|---|---|
| Existence | Send positive confirmations to the three largest customers and a sample of others | Substantive; year-end; the three largest plus items selected by monetary unit | TR-2 | |
| Existence | For non-replies, examine post-year-end receipts and dispatch documents | Alternative procedure; April to May | TR-3 | |
| Valuation | Recompute ageing and test 15 invoices to date of invoice | Substantive; year-end; 15 items | TR-4 | |
| Valuation | Challenge expected credit loss: inspect post-year-end receipts, disputes, correspondence for the stressed segment | Substantive; before sign-off | TR-5 | |
| Cut-off | Match last 10 dispatches before and first 10 after year end to invoices and delivery proof | Substantive; year-end | TR-6 | |
| Presentation | Agree related-party balances to the related-party listing; check netting of advances | Substantive | TR-7 |
The trade receivables working paper template carries the layout for the paper behind these steps.
Sample extract: payroll
Invented facts: a services company with 420 employees, monthly payroll ₹2.1 crore, an in-house payroll system, a mid-year change in the salary structure.
| Assertion | Procedure | Nature / timing / extent | W/P ref |
|---|---|---|---|
| Occurrence | Agree 25 salary records to appointment letter, attendance and bank credit | Test of details; interim | PR-2 |
| Completeness | Reconcile payroll register to general ledger for each month; investigate differences | Analytical and reconciliation; year-end | PR-3 |
| Accuracy | Recompute 20 salaries after the structure change, including deductions | Test of details; year-end | PR-4 |
| Classification | Check provident fund, ESI, professional tax and TDS on salary are posted to statutory liability accounts and paid | Test of details; year-end and subsequent | PR-5 |
| Existence | Select ten joiners and ten leavers; confirm approval and full-and-final settlement | Test of details | PR-6 |
If the auditor intends to rely on payroll controls, the programme must also include tests of controls over master data changes and approval of the payroll run, with enough extent to support reliance.
Tailoring and updating
- Start from the prior-year file and the firm template.
- Remove or reduce steps where risk and materiality are low.
- Add steps for new risks: an acquisition, a new ERP, a going-concern indicator.
- Record why the extent differs from last year.
- Revisit the programme when fieldwork findings change the risk assessment; SA 330 expects the auditor to evaluate before concluding whether the assessments remain appropriate.
Documentation
SA 230 asks for the nature, timing and extent of procedures performed, the results, and the identifying characteristics of the items tested (invoice number, customer, date), along with who did the work and when, and who reviewed it and when. The final file is ordinarily assembled within 60 days of the auditor's report, a period set by ICAI's quality control standard. SQC 1 continues to apply: ICAI deferred the mandatory date of SQM 1 and SQM 2 on 31 March 2026. Confirm the current wording in the standard. A programme that is signed off line by line but does not identify the items tested will not meet this test. Teams that use audit software can have the programme, working papers and sign-offs sit together, which makes review trails easier to evidence.
Frequently asked questions
Is an audit programme mandatory?
The standards do not use the word "programme" as a mandatory document. They require a plan and further procedures responsive to assessed risks, and documentation of both. A written programme is how most firms meet that.
What is the difference between an audit plan and an audit programme?
The plan sets planned procedures and their nature, timing and extent at engagement level. The programme lists the detailed steps for each area and is the document the team signs off.
Can we use the same programme every year?
You can start from it, but SA 300 planning is done for each audit. Update it for new risks, changes in the entity and last year's findings.
Who approves the programme?
The engagement partner is responsible for the overall audit strategy and plan; the programme is normally prepared by the manager or senior and reviewed by the partner on significant areas.
Should the programme be changed during fieldwork?
Yes, if findings change the risk assessment. Record the change and the reason.
For the planning stage and the other steps of the engagement, see audit process step by step and the audit glossary.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error