MarcusWelcome back to VoraPrep Audio's Office Hours. I'm Marcus.

AvaAnd I'm Ava. Today, we're talking about engagement planning. This is the foundation of every successful audit.

MarcusAnd it can be the source of a lot of headaches if you get it wrong. If you don't plan correctly, you could perform a perfect audit on the wrong risk.

AvaExactly. Success isn't just about correct testing. It's about auditing the right things in the right way.

MarcusAnd that all starts with a risk-based engagement plan. Is this just a best practice?

AvaIt's a requirement. It's mandated by the Global Internal Audit Standards. The key standard here is 13.1. That standard requires a documented plan for each engagement.

MarcusOkay, so what does that standard require us to document in the plan?

AvaThe standard lists four core components. First, the engagement's objectives.

MarcusWhich answers the question, "What are we trying to achieve with this audit?"

AvaPrecisely. It’s the high-level goal. The second component is the scope.

MarcusThe scope defines the boundaries. It answers, "What's in and what's out of this review?"

AvaCorrect. Objectives are the 'what,' and scope is the 'where.' The other two components are more practical.

MarcusLet me guess: how long it will take and who will do the work?

AvaYou got it. The plan must include the timing and the resource allocations.

MarcusOkay, so the plan covers the 'what' and 'where'—that's objectives and scope. It also needs the 'when' and 'who'—the timing and resources. And this all has to happen before any testing begins.

AvaThat's right. To build that plan, you first have to understand the area you're auditing. You can't just walk in and start testing.

MarcusSo you need to do some initial information gathering first.

AvaYes, you have to understand the landscape. Think of it like a doctor's first consultation. A good doctor asks questions and reviews your history before ordering an expensive test.

MarcusThey gather context first. So what does that look like for an auditor?

AvaIt means talking to the people who run the process day-to-day. It means reviewing documentation, like process maps or org charts, to see how things are supposed to work.

MarcusAnd then comparing that to how things actually work?

AvaExactly. The goal isn't to find errors yet. The goal is to understand the process, the systems, and most importantly, the potential risks.

MarcusSo all of that initial work—the conversations, the document review—it all flows into defining the engagement's objectives and scope.

AvaCorrect. Once you have that context, you can set a clear objective and a specific scope. For example, the objective might be to evaluate controls in the procure-to-pay cycle.

MarcusAnd the scope would define the boundaries for that objective.

AvaYes. The scope defines the specific processes, locations, or time periods the audit will cover. Being specific is crucial.

MarcusSo once we have our objectives and scope, what's next? This is where the risk assessment comes in, right?

AvaYes, and this is the absolute core of risk-based planning. We perform an engagement-level risk assessment. But this is where a lot of auditors make a common mistake.

MarcusWhat's the mistake?

AvaThey only assess inherent risk. They ask, "What could go wrong?" But a proper plan must focus on residual risk.

MarcusResidual risk. That's the risk that's left over after management's controls are considered, right?

AvaExactly. We have to understand the controls management already has in place. Then we assess the risk that those controls might fail, or that there are gaps. That's the risk we're actually auditing.

MarcusAnd for each of those residual risks, we have to evaluate it.

AvaWe do. We assess its potential impact and its likelihood of occurring. A risk with a high impact and high likelihood demands more of your audit attention. It needs much more focus than one with a low impact and low likelihood.

MarcusThis assessment directly tells you where you need to spend your time and effort.

AvaIt has to. If you identify a high residual risk of unauthorized payments, your audit must include specific tests for that. You can't ignore it. That risk assessment becomes the blueprint for the final step in planning: developing the engagement work program.

MarcusThe work program is the detailed game plan.

AvaIt's the 'how, when, and who' of the audit. It translates the objectives, scope, and risk assessment into a concrete set of steps for the team. The program lists the specific audit procedures. And it links each one back to a risk you identified.

MarcusSo there are no "just because" steps. Every test has a purpose.

AvaEvery single one. The work program also details who is responsible for performing each specific test.

MarcusThis process seems really clear. Let's walk through that Procure-to-Pay example to see it in action.

AvaGreat idea. The scenario is this: The Chief Audit Executive has tasked a team with auditing the procure-to-pay process. This is happening right after the implementation of a new ERP system.

MarcusSo, first, the team needs to gather information. What do they do and what do they find?

AvaThey interview the Accounts Payable manager and review process maps. They discover the migration may have weakened controls over vendor master file changes. They also find that user access rights are not yet fully configured.

MarcusThat sounds like a potential risk. How does that finding shape their objectives and scope?

AvaIt helps them form a very specific objective. Their goal is to determine if controls over the vendor master file, invoice processing, and purchase order approval are effective.

MarcusAnd the scope?

AvaThe scope is defined as all vendor payments processed through the new ERP system from January 1st to June 30th of the current year.

MarcusVery specific. Now for the crucial part: the risk assessment. What did they identify as the biggest risks within that scope?

AvaThey identified the risk of adding a fraudulent vendor to the master file. They rated this as having a High potential impact, even if the likelihood was only moderate.

MarcusWhat else?

AvaThey also noted a risk of duplicate payments. This had a lower impact per event, but it had a High likelihood of occurring due to system limitations in the new ERP..

MarcusSo based on that prioritization, how did they build the work program?

AvaThey allocated their resources to match the risk. For the highest priority risk—fraudulent vendors—they planned detailed testing. This included selecting a sample of new vendors and verifying their existence independently.

MarcusAnd for the duplicate payment risk?

AvaThey planned to use data analytics to scan one hundred percent of the payment file for potential duplicates. This is an efficient way to address a high-likelihood risk. They spent the most time and effort on the areas that could cause the most damage.

MarcusThat is the essence of risk-based auditing. Now, I can see a point of confusion here. We do a risk assessment to build the annual audit plan. And we also do a risk assessment to plan a specific engagement. Are they the same thing?

AvaThat's a fantastic question, and a common pitfall. They are very different. The annual audit plan risk assessment is a macro-level view. It looks at the entire organization. Its purpose is to decide what to audit over the next year.

MarcusSo it helps you pick which projects to do from a list of hundreds of possibilities.

AvaExactly. The engagement-level risk assessment is micro. It's a detailed look at the specific process we're already reviewing. Its purpose is to decide how to audit it and where to focus our testing.

MarcusMacro versus micro. What to audit versus how to audit. That's a really clear distinction. Any final tips for exam day?

AvaYes. When you get a scenario question about planning, always focus on the 'Why'. Why is this audit being performed? What is the fundamental business risk it's trying to address?

MarcusSo don't just get lost in the details of the audit steps.

AvaRight. Understanding the 'Why' helps you identify the most critical objective. This is the key to cutting through distractor answer choices. Those choices might describe a valid audit step, but for the wrong reason.

MarcusThis has been incredibly useful. So, to summarize, effective engagement planning is a systematic, risk-based process. It's not optional; it's mandated by the standards.

AvaYou start by gathering information to understand the landscape. Then you use that knowledge to define clear objectives, a tight scope, and the timing and resources.

MarcusThat plan then drives your engagement-level risk assessment. This, in turn, dictates the procedures in your work program, ensuring you focus on what matters most.

AvaYou've got it. It’s the process that turns a broad mandate into a focused, actionable audit project that truly adds value.

MarcusVoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. Get started at Vora Prep dot com.