Definition
Under AU-C 300, the audit plan includes the nature, timing and extent of risk assessment and further audit procedures. The audit program is the working form of that plan. Each step names the procedure, the assertion it addresses, the sample or population, who performs it, and where the evidence is filed. A program is often organized by account area, such as cash, revenue or payroll.
Why it matters in an audit or review
A standard program copied from a prior year or a firm template may include steps that are irrelevant and miss steps the risks require. AU-C 330 requires further procedures to respond to the assessed risks at the assertion level, so each program should connect to the risk assessment. Changes made during the audit should be documented with the reason.
Example
A client has a new revenue stream, a subscription contract (illustrative). The standard revenue program has a shipping cutoff test but nothing on contract terms or ratable recognition. The senior adds steps to read a sample of 15 contracts, recompute deferred revenue and trace billings to deferral, each tagged to the occurrence and cutoff assertions.
Common mistakes
- Initialing every step without recording the results.
- Leaving not-applicable steps unmarked and unexplained.
- Not updating the program when the risk assessment changes.
FAQ
Is a firm template enough?
Only as a starting point. It must be tailored to this client's risks.
Sources
- AICPA, AU-C Section 300, Planning an Audit
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
- AICPA, AU-C Section 315 (as amended by SAS No. 145)
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error