Planning the audit: overall strategy and audit plan (AU-C 300)

• Distinguish the overall audit strategy from the audit plan.
• List the required contents of the audit plan under AU-C 300.09.
• Identify the planning documentation AU-C 300.14 requires.
• Update the strategy and plan when circumstances change.

Planning is continuous

AU-C 300.02 describes planning as establishing the overall audit strategy and developing an audit plan. It is not a phase that ends when fieldwork starts. AU-C 300.10 requires you to update and change both as necessary during the audit. A plan that still shows the original risk assessment after a significant misstatement was found is a planning failure.

AU-C 300.05 requires the engagement partner and other key engagement team members to be involved in planning, including planning and participating in the team discussion on susceptibility to material misstatement. AU-C 300.11 requires you to plan the nature, timing and extent of direction and supervision of team members and the review of their work.

Preliminary engagement activities

At the start of each engagement, AU-C 300.06 requires you to perform the AU-C 220 procedures on acceptance and continuance, evaluate compliance with relevant ethical requirements including independence, and establish an understanding of the terms of the engagement under AU-C 210. For an initial audit, AU-C 300.13 adds communicating with the predecessor auditor under AU-C 210.

The overall audit strategy

AU-C 300.07 requires a strategy that sets the scope, timing and direction of the audit and guides the plan. Under AU-C 300.08 you:

• identify the characteristics of the engagement that define its scope (framework, industry reporting, locations, components);
• ascertain reporting objectives to plan timing and required communications (deadlines, governance meetings, single audit reports);
• consider the factors significant in directing the team's efforts (materiality, high-risk areas, significant changes);
• consider results of preliminary activities and knowledge from other engagements for the entity; and
• ascertain the nature, timing and extent of resources needed: who, when and how many hours. AU-C 300.12 adds that you consider whether specialized skills are needed and, if so, bring in a professional who has them.

For a small entity, the strategy can be a short memo. Size does not remove the requirement.

The audit plan

AU-C 300.09 requires an audit plan describing:

• (a) the nature, timing and extent of planned direction and supervision of team members and review of their work;
• (b) the nature and extent of planned risk assessment procedures under AU-C 315;
• (c) the nature, timing and extent of planned further audit procedures at the relevant assertion level under AU-C 330; and
• (d) other planned procedures required for GAAS compliance, such as related party, going concern, subsequent events and laws and regulations work.

The plan is more detailed than the strategy. In practice it is the set of tailored audit programs linked to the risk assessment. Generic programs that do not change from client to client fail (c), because the procedures are not responsive to assessed risks.

Documentation

AU-C 300.14 requires documentation of the overall audit strategy, the audit plan, and any significant changes made during the engagement with the reasons for them. The audit planning memo guide shows a format, and the AU-C 300 planning checklist walks the requirements.

Common planning findings

• Strategy memo carried forward with last year's date and materiality.
• Programs not tailored to the risks identified under AU-C 315.
• No plan for direction, supervision and review of the team's work.
• Significant changes, such as a new revenue stream found mid-audit, not reflected in the plan.
• No consideration of specialist needs for valuations, pensions or IT.

Building a strategy for a growing manufacturer