The planning letter sets the tone for the engagement. It tells governance what the audit will and will not do, what the firm plans to look at, when it needs them and what the firm wants from them. Written well, it prevents arguments in March. This post gives a full example for an illustrative client and drafting notes beside each paragraph.
What the letter must cover
The planning communication under AU-C 260 requires the auditor's responsibilities and an overview of planned scope and timing, including significant risks. Because the standard also calls for two-way communication, the letter asks governance for input. That gives three jobs:
- State the auditor's responsibilities in the audit.
- Give an overview of the planned scope and timing, including significant risks.
- Ask governance for information relevant to the audit.
The full calendar is in the AU-C 260 communications post. Here is a letter that does the three jobs for a company with a December year end.
The example letter
To the Audit Committee of Cedar Ridge Components, Inc.
Purpose. This letter describes our responsibilities and the planned scope and timing of our audit of the financial statements of Cedar Ridge Components, Inc. for the year ending December 31. It is intended solely for the audit committee and management and is not suitable for any other purpose.
Our responsibilities. We will form and express an opinion on whether the financial statements, prepared by management with your oversight, are presented fairly in all material respects in accordance with accounting principles generally accepted in the United States of America. An audit is designed to obtain reasonable assurance, not absolute assurance, about whether the statements are free of material misstatement. The audit does not relieve management or the audit committee of their responsibilities. These responsibilities are set out in our engagement letter dated September 14.
Planned scope and timing. We will perform interim procedures in November, including testing of selected controls over revenue and purchasing, and year-end procedures beginning February 17. We expect to deliver our report by March 20 if the client-prepared schedules are provided by February 10.
Significant risks. From our risk assessment, we have identified the following as significant risks:
- Revenue recognition, particularly cutoff on shipments in the last week of December.
- Inventory valuation, including the reserve for slow-moving stock.
- Management override of controls, a presumed risk in every audit.
Matters we ask of you. We would like to hear your views on:
- Business risks and objectives that you consider significant for the year.
- Areas where you want the audit to focus attention.
- Your knowledge of any actual, suspected or alleged fraud, or noncompliance with laws and regulations.
- How the committee oversees management's processes for identifying and responding to fraud risk.
- Any related parties or significant unusual transactions you are aware of.
Independence. We are not aware of relationships between the firm and the company that bear on independence, and we will tell you if any arise.
Drafting notes
Purpose paragraph
The "not suitable for any other purpose" sentence belongs in every written communication. The completion letter carries the same sentence.
Responsibilities paragraph
Quote the engagement letter, not a different version of it. If the engagement letter contains a limit on the firm's liability or an arbitration clause, the planning letter does not repeat it and does not contradict it. See engagement letter indemnification and liability limits.
Scope and timing paragraph
Give dates the client can plan around and the dependencies the firm needs, such as the trial balance date and the schedules due. Do not give the list of procedures. The aim is to avoid giving a predictable pattern that management could exploit. Naming "interim testing of controls over revenue and purchasing" tells governance where the work is without scripting it.
Significant risks paragraph
Name the risks from the risk assessment under AU-C 315. If the file's planning memo identifies five significant risks, the letter does not need all five by name. It needs enough that governance can see the audit is aimed at the right places. Always include the presumed risks of fraud in revenue recognition (unless rebutted and the rebuttal documented) and management override.
Matters-we-ask paragraph
This paragraph is the start of two-way communication. If you leave it out, governance's silence is not evidence of anything. If you include it, you can record the answers, or the lack of any, in the planning file. For an owner-manager client, convert the questions to a conversation and write the answers in a memo.
Independence paragraph
If the firm prepares the financial statements or posts adjusting entries as a nonattest service, say so here and cross-reference the safeguards. See independence and nonattest services for small firms.
Delivery and follow-up
| Step | Owner | Evidence in the file |
|---|---|---|
| Identify governance contacts | Senior | Planning workpaper listing names, roles |
| Draft letter from risk assessment | Senior, reviewed by manager | Draft and review notes |
| Partner approves | Engagement partner | Sign-off |
| Send to governance | Partner or manager | Transmittal email and the final letter |
| Record responses | Senior | Memo of discussions, answers to the questions |
| Update after significant changes | Manager | Revised letter or a memo |
If governance does not reply, record that the questions were asked and when. The silence also goes in the file, and it feeds the later evaluation of whether two-way communication was adequate.
When to send a second planning letter
Revise the communication if the risk assessment changes materially during fieldwork. A new significant risk, such as a loan covenant breach discovered in December, goes to governance as an interim communication rather than waiting for the completion letter. Mid-engagement changes to scope, timing or fees go in writing too, tied back to the engagement letter.
Using the example
Adapt the example to the client. Remove sentences that are not true for the engagement. A planning letter that promises interim control testing when the audit plan is fully substantive creates a documentation gap that a peer reviewer will find.
CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.
Sources
- AICPA, AU-C Section 260, The Auditor's Communication With Those Charged With Governance
- AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement; AU-C Section 210, Terms of Engagement
- U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026, sections 215 and 550: gao.gov
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error