AU-C 300 Planning an Audit: Overall Audit Strategy, Audit Plan and Documentation

AU-C section 300, Planning an Audit, covers the auditor's responsibility to plan a GAAS audit of a nonissuer so that it is performed in an effective manner. It came out of SAS No. 122. SAS No. 146 amended it for audits of periods beginning on or after December 15, 2025, mainly to link planning to quality management and to move direction and supervision into AU-C 220.

This page paraphrases the standard as amended by SAS 146. The authoritative text is AU-C 300 in AICPA Professional Standards. A working draft is in the audit planning memo template.

What is the objective of AU-C 300?

The auditor's objective is to plan the audit so that it will be performed in an effective manner.

Planning is continual. The auditor plans at the start and revises as the audit goes on. New information from risk assessment procedures, results of testing and changes at the entity all feed back into the plan.

Why plan?

Planning benefits the audit in several ways. As amended by SAS 146, the standard says adequate planning, together with quality management at the engagement level under SAS 146, helps the auditor to:

• identify and give appropriate attention to important areas of the audit
• identify and resolve potential problems on a timely basis
• organize and manage the engagement so it is performed effectively and efficiently
• select team members with the right capabilities and competence for the expected risks and allocate responsibilities
• facilitate direction and supervision of the team and review of its work
• coordinate work done by component auditors and specialists, where applicable

The size and complexity of the entity, the team's experience with the entity and changes during the audit all affect how much planning is needed. In a small, simple audit, the plan may be short.

Preliminary engagement activities

At the beginning of the current audit engagement, the auditor undertakes these activities (paragraph .06, as amended by SAS 146):

1. perform procedures required by AU-C 220 on acceptance and continuance of the client relationship and the specific audit engagement
2. evaluate compliance with relevant ethical requirements in accordance with AU-C 220
3. establish an understanding of the terms of the engagement as required by AU-C 210

These activities help the auditor identify events or circumstances that could affect the ability to plan and perform the audit, and confirm that independence and competence are in place before significant work starts. See AU-C 220 and AU-C 210.

The overall audit strategy

The overall audit strategy sets the scope, timing and direction of the audit and guides the audit plan. In establishing it, the auditor considers the information obtained from complying with SAS 146 and then does the following (paragraph .08, as amended):

• identifies the characteristics of the engagement that define its scope, such as the financial reporting framework, industry reporting requirements, the locations and components, and the use of service organizations or specialists
• ascertains the reporting objectives of the engagement to plan the timing of the audit and the nature of the required communications, such as deadlines for the report, lender or regulator requirements and expected communication dates
• considers the factors that, in the auditor's judgment, are significant in directing the team's efforts, such as materiality, areas of higher risk, the results of previous audits and knowledge gained on other engagements for the entity
• considers the results of preliminary engagement activities and where applicable whether knowledge gained on other engagements performed by the engagement partner for the entity is relevant
• ascertains the nature, timing and extent of resources necessary to perform the engagement

SAS 146 notes that its requirement for the engagement partner to determine that resources are sufficient and appropriate is directly relevant to the last point. See AU-C 320 materiality for the materiality side.

The audit plan

The auditor develops an audit plan. As amended by SAS 146, it describes (paragraph .09):

• the nature and extent of planned risk assessment procedures, as determined under AU-C 315
• the nature, timing and extent of planned further audit procedures at the relevant assertion level, as determined under AU-C 330
• other planned audit procedures required to be carried out so that the engagement complies with GAAS

The audit strategy answers "what is this audit and what are its priorities?" The audit plan answers "what specific work will we perform?" They are related, and in a small audit they may be combined in one planning memo.

Risk assessment procedures come first in time. The detailed further audit procedures in the plan cannot be completed until the assessment is done, so the plan is typically updated after the AU-C 315 work. See AU-C 315 and AU-C 330.

Partner review of the strategy and plan

As amended by SAS 146, paragraph .11 now requires that the engagement partner review the overall audit strategy and audit plan. The requirement for the auditor to plan the nature, timing and extent of direction, supervision and review moved to SAS 146 (AU-C 220). The partner's review is evidence that the planning was appropriate to the risks and the entity. See AU-C 220.

The file should show when the partner reviewed the strategy and plan, so that the review can be tied to the timing of fieldwork.

Changes during the audit

The auditor updates and changes the overall audit strategy and the audit plan as necessary during the course of the audit. For example, if the auditor finds unexpected information, such as new risks, a misstatement or a control deficiency, the nature, timing and extent of the planned procedures may change. The documentation records significant changes and the reasons.

Discussion with management

The auditor may discuss elements of planning with management to help manage and achieve quality, for example to coordinate some audit procedures with entity personnel. The overall audit strategy and the audit plan remain the auditor's responsibility, and the auditor takes care not to compromise the effectiveness of the audit. Sharing the nature and timing of detailed procedures, for example, can make them predictable.

The PBC process is one example. A PBC list and its timing are normally agreed with the client, but the testing details are the auditor's own.

Additional considerations on initial engagements

On an initial audit engagement, the auditor performs additional activities before starting the audit. These include the acceptance procedures for an initial audit and communicating with the predecessor auditor (see AU-C 210). Work on opening balances is covered by AU-C 510.

Documentation

The auditor includes in the audit documentation (paragraph .14, as amended):

• the overall audit strategy
• the audit plan
• any significant changes made during the engagement to the strategy or plan, including significant changes in planned direction, supervision and review, and the reasons for the changes

AU-C 230 provides the general documentation rules.

What belongs in a planning memo?

The standard does not set a format. Common content, as practice:

• entity and industry background, framework, and reporting deadlines
• engagement team, roles, and any specialists or other firms involved
• materiality and how it was determined
• significant risks, including presumed fraud risks, and planned responses
• areas of expected reliance on controls, and planned substantive work
• use of data analytics or other automated tools in the audit
• timetable, PBC requests and communication plan
• partner review sign-off

File checks on planning

These are practice checks, not requirements of the standard. Weaknesses to look for:

• Planning memos carried forward from prior year with the names changed
• No evidence of partner review of the plan before fieldwork
• Audit programs that do not follow from the assessed risks
• Significant changes in risks or scope during the year with no record in the plan
• Planning that reflects busy season staffing rather than the risks

Related

• Audit planning memo template
• PBC list template
• AU-C 315 risk assessment and SAS 145
• AU-C 320 materiality

Sources

• AICPA, AU-C Section 300, Planning an Audit (AICPA Professional Standards), as amended by SAS No. 146 (periods beginning on or after December 15, 2025)
• AICPA, AU-C Sections 210, 220, 230, 315, 320, 330 and 510 (cross-referenced sections)

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error