The planning memo is usually one of the first things a partner, an engagement quality reviewer or a peer reviewer reads. It shows how the team understands the client, where it sees risk, and what it plans to do about it. A good memo is short enough to read in one sitting and specific enough that someone who has never seen the file can see why the work was designed the way it was.
The requirement comes from AU-C section 300, Planning an Audit. This guide covers what the standard asks for, what to put in the memo, how to write it and how to keep it current. A starting document is available as the audit planning memo template.
What AU-C 300 requires
AU-C 300 has the auditor plan the audit so it is performed in an effective manner. The main requirements are:
- the engagement partner and other key members of the engagement team are involved in planning, including planning and participating in the engagement team discussion
- the auditor undertakes preliminary engagement activities: procedures on acceptance and continuance of the relationship, evaluation of compliance with relevant ethical requirements including independence, and establishing an understanding of the terms of the engagement
- the auditor establishes an overall audit strategy that sets the scope, timing and direction of the audit and guides the development of the audit plan
- the auditor develops an audit plan that includes the nature, timing and extent of planned risk assessment procedures, the planned further audit procedures at the assertion level, and other planned audit procedures needed to comply with GAAS
- the auditor updates the strategy and plan as necessary during the audit
- the auditor plans the nature, timing and extent of direction and supervision of team members and the review of their work, which AU-C 220, as replaced by SAS No. 146, covers at the engagement level
The standard also requires documentation of the overall audit strategy, the audit plan and any significant changes made during the audit and the reasons for them, in line with AU-C 230.
The standard does not require a particular document called a planning memo. Many firms use one memo for the strategy and a separate set of programs for the plan. Others use a single memo with both.
What the overall audit strategy covers
AU-C 300 describes the strategy in terms of matters the auditor considers. In a memo, they translate into sections.
Engagement characteristics
The framework (US GAAP, tax basis or other), the form of the report, the entity's structure, locations, industry and whether the engagement is an audit of a group or includes component auditors. The audit may also include supplementary information, compliance reporting or a specific regulatory requirement such as a single audit. State whether the engagement is an initial one. See first-year audits and opening balances.
Reporting objectives and timing
The deadline for the report and any earlier milestones, the required communications with management and those charged with governance, and the other reports the client expects, such as a management letter. See management letters.
Significant factors in directing the team's efforts
Materiality, areas of high risk, significant changes in the business, new accounting standards, the accounting system and controls, and whether the audit will rely on controls. The materiality determination under AU-C 320 goes here, with the benchmark, the percentage, performance materiality and a short reason for each choice. The materiality calculator can document the calculation.
Results of preliminary activities
Acceptance and independence conclusions, prior-year findings and uncorrected misstatements, the prior-year management letter points and any matters from the predecessor.
Resources
Who is on the team, their roles, the planned hours, the use of specialists or experts, outsourced staff, and the engagement quality reviewer, if there is one. See the engagement quality review guide.
What the audit plan covers
The plan turns the risks into procedures.
Risk assessment
AU-C 315, as revised by SAS No. 145, requires understanding of the entity and its environment, the applicable framework, and the components of the entity's system of internal control, and the identification and assessment of risks of material misstatement at the financial statement and assertion levels. The memo should summarize this, not copy it. See SAS 145 and risk assessment, AU-C 315 and the audit risk assessment worksheet.
A useful format is a table listing each significant account or class of transactions, the relevant assertions, the assessed risk, whether it is a significant risk, and the planned response with a reference to the audit program.
Fraud
AU-C 240 requires the engagement team discussion about how and where the financial statements may be susceptible to material misstatement due to fraud, and presumes a risk of fraud in revenue recognition, which may be rebutted with documented reasons. Management override of controls is always a risk. Record the discussion, the participants, the date and what was concluded. See fraud risk assessment.
Significant risks and responses
For each significant risk, record the planned response. A response that says "perform substantive procedures" is not a response; name the procedures, such as testing cutoff for revenue on a sample of shipping documents before and after year-end, or confirming the largest receivables. Link to AU-C 330 responses.
Specific areas that often need a paragraph
- Going concern. Preliminary evaluation and planned procedures. See going concern and the going concern checklist.
- Related parties. Identification and plans for testing. See related party transactions.
- Estimates. Accounting estimates such as allowances, impairment, inventory reserves and deferred taxes under AU-C 540.
- Service organizations. Use of SOC reports under AU-C 402.
- Group audits. Component auditors and scope, if applicable.
- Laws and regulations. Compliance with laws and regulations under AU-C 250.
- Sampling approach. The method and expected sample sizes. See audit sampling methods.
- Technology and data. Whether data analytics or full-population testing will be used, and how the data will be validated.
Timing
A calendar from planning through the report date: interim work, PBC deadlines, fieldwork dates, inventory count, review stages, EQR, client closing meeting and report release. It is a good place to record the client's PBC deadlines. See the PBC list guide.
Communications
The plan for communications with those charged with governance under AU-C 260, including the planned scope and timing, which must be communicated. See the communication with those charged with governance template.
How to write it
Write for a reader who has not seen the file. A reviewer will read the memo with the engagement letter and the risk assessment and ask whether the work performed responds to the risks identified.
Be specific to the client. A planning memo that could be used for any client with the name changed does not show an understanding of this client. Name the products, the systems, the customers and the changes this year.
Explain the judgments. Why is revenue not rebutted? Why was this benchmark chosen? Why is a reserve not a significant risk? The reason is what makes the memo evidence.
Carry forward carefully. Rolling last year's memo forward saves time but can carry stale facts. Change the dates, update every section and delete what no longer applies. A memo that still says the client has two locations when it closed one will contradict the rest of the file.
Keep it proportionate. A small, low-complexity audit may need a memo of a few pages. A complex one, with several risks and specialists, needs more. Length is not the measure; whether the plan addresses the risks is.
Cross-reference. Each risk should point to the audit program step and workpaper that respond to it. The reviewer should be able to move from the risk to the work.
Approval and updates
As a matter of practice, the engagement partner approves the memo before fieldwork begins, and the approval is dated; AU-C 300 requires the strategy and plan to be established and documented but does not prescribe a sign-off. Planning is iterative: when something significant changes, such as a new risk, a change in materiality, a loss of a key control or a delay in the client's closing, update the memo or add a dated addendum with the reason. AU-C 300 requires documentation of significant changes to the strategy and plan, and the reasons.
The final materiality should be consistent with the planning materiality, or the change explained. This connects to the summary of uncorrected misstatements.
Common documentation gaps
- Planning memo signed after fieldwork began.
- Boilerplate text with no client-specific risks.
- Risks identified in the memo that do not appear in the audit programs.
- Presumed revenue fraud risk rebutted with no reason, or not addressed.
- Materiality calculated without a documented benchmark.
- No record of the engagement team discussion.
- Changes during the audit not documented.
- No consideration of the engagement quality review, when firm policy requires one.
The peer review readiness checklist and the AICPA peer review guide describe what reviewers look for in a file.
Frequently asked questions
Is a planning memo required by GAAS?
AU-C 300 requires an overall audit strategy and an audit plan, and requires them to be documented. It does not require a document with a specific name. Most firms use a planning memo for the strategy.
How long should a planning memo be?
Long enough to show the understanding of the client, the risks and the response, and no longer. A low-complexity audit may take a few pages. Quality is judged by specificity and by whether the audit programs respond to the risks.
Who approves the planning memo?
By firm practice, the engagement partner, before fieldwork begins. AU-C 300 does not prescribe the sign-off, but the approval should be dated and later changes documented.
What is the difference between the audit strategy and the audit plan?
The strategy sets the scope, timing and direction of the audit. The plan translates it into the nature, timing and extent of risk assessment and further audit procedures.
Can I reuse last year's planning memo?
You can use it as a base, but it must be updated for this year's facts, risks and materiality. Stale text undermines the memo.
Sources
- AICPA, AU-C Section 300, Planning an Audit
- AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (as revised by SAS No. 145)
- AICPA, AU-C Section 320, Materiality in Planning and Performing an Audit
- AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit
- AICPA, AU-C Section 260, The Auditor's Communication With Those Charged With Governance
- AICPA, AU-C Section 230, Audit Documentation
- AICPA, SAS No. 146, Quality Management for an Engagement Conducted in Accordance With Generally Accepted Auditing Standards
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Planning and risk assessment: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error