Internal Audit Engagements and Planning: formula sheet

Key formulas

Acceptance checks

Independence + Competence + Resources + Authority/Access

Accept only when all four are satisfied, or when threats are reduced to an acceptable level.

Core contents of an engagement letter

Objectives + Scope + Period + Responsibilities + Access + Reporting + Fees + Timelines

Add confidentiality, use of experts, and termination terms where relevant.

Objectivity factors (SA 610 A32)

Organisational status + Family/personal ties + Association with the area + Significant financial interest

These are factors that may be relevant when judging threats to objectivity.

Statutory auditor as internal auditor

Statutory auditor of an entity ≠ its internal auditor

Per the ICAI Code of Ethics as quoted in SA 610 (Revised), para A14.

SA 300 start-of-engagement activities

Client continuance procedures + Ethics and independence evaluation + Understanding of engagement terms

SA 300 para 5. Use as the model for internal audit acceptance.

Charter purpose

Charter = purpose + scope + authority + independence and reporting line + responsibilities + standards

Use this as a memory frame for contents. Adapt it to the entity; the exact list is not fixed by law.

Audit universe to plan

Audit universe → risk assessment → ranking → annual audit plan

The plan covers the high-risk part of the universe within available resources. Low-risk areas are covered on a rotation.

Objectivity test (SA 610 Revised, A7)

Reporting line + freedom from conflicting duties + governance oversight of employment + no restrictions on communication + professional membership

These are factors an external auditor may evaluate. They are not a closed list.

Resources in planning (SA 300, A9)

Which resources + how much + when deployed + how managed and supervised

A similar thinking applies when internal audit allocates effort across the universe.

Risk score (common scoring approach)

Risk score = Likelihood score × Impact score

This is a common practice, not a prescribed formula. Use the scale your entity uses, for example 1 to 5 each. Say so in your answer.

Control-adjusted risk (common approach)

Residual risk rating = Inherent risk rating adjusted for the strength of controls

Strong controls lower the rating, weak controls keep it high. Explain this in words; do not present it as a fixed arithmetic rule.

Audit strategy vs audit plan (SA 300)

Overall audit strategy = scope, timing, direction and resources; Audit plan = more detailed nature, timing and extent of procedures

SA 300 (A13) says the audit plan is more detailed than the overall audit strategy.

Planning activities in strategy (SA 300, para 7)

Identify scope characteristics; ascertain reporting objectives and timing; consider significant factors directing the team; consider preliminary activities; ascertain resources

Use as a checklist of what the plan must cover.

Elements of an engagement plan

Objectives + Scope + Risks + Resources + Timing + Audit programme + Approval

Use this as a checklist skeleton for any planning question.

Audit programme line

Objective → Procedure → Sample/extent → Auditor → Working paper reference → Done/review sign-off

Each step should be traceable to an objective and to evidence.

SA 300 para 7: overall audit strategy (external audit)

Scope characteristics; reporting objectives and timing; significant factors; preliminary activities; nature, timing and extent of resources

A useful parallel for internal audit planning; do not present it as an internal audit standard.

Budget variance

Variance (hours) = Actual hours − Budgeted hours

A positive value means an overrun, and the reason must be recorded.

Initial engagement (SA 300 para A21)

More planning for a first-time engagement: predecessor arrangements, opening balances, quality control requirements

For a first-time internal audit area, plan to spend more effort understanding it.

Scope of internal audit activities (SA 610, A1)

Governance + Risk management + Internal control (evaluation of controls, examination of financial and operating information, review of operating activities, review of compliance)

Use this list to show what an internal audit function typically covers and so what you must understand about the auditee.

Overall audit strategy (SA 300, para 7)

Scope characteristics + Reporting objectives and timing + Significant factors directing the team + Preliminary activities + Resources (nature, timing, extent)

Understanding the entity feeds each of these five items.

Audit plan contents (SA 300, para 8)

Risk assessment procedures + Further audit procedures at assertion level + Other procedures required by the SAs

Strategy sets direction. The plan details the procedures.

Control evaluation sequence

Understand → Document → Assess design → Test operation → Conclude on reliance → Adjust the audit programme

A working order, not a quoted rule. Always keep design and operation separate.

Competence and objectivity factors (SA 610, A8, A32)

Competence: resources, hiring and training policies, technical proficiency, knowledge of the framework, professional bodies. Objectivity: organisational status, family or personal relationships, association with the area audited, significant financial interests

Apply when judging whether an internal audit function's work can be relied on.

Test of evidence

Good evidence = Sufficient (enough in quantity) + Appropriate (relevant and reliable)

State both parts in every answer. Higher risk needs more and better evidence.

Sampling approaches

Sampling = Statistical (random, measured risk) or Non-statistical (judgmental)

Both are valid if the sample supports the conclusion. Statistical lets you quantify sampling risk.

Risks in sampling

Audit risk from testing = Sampling risk + Non-sampling risk

Sampling risk falls with a larger sample. Non-sampling risk falls with better procedures and review.

Working paper content

Working paper = Objective + Procedure + Source/evidence + Findings + Conclusion + Preparer and reviewer sign-off with dates

Use this as a checklist when asked what a working paper should contain.

Reliance on internal audit work (SA 610 Revised, para 23)

Work properly planned, performed, supervised, reviewed and documented; evidence sufficient and appropriate; conclusions appropriate

Three checks an external auditor applies before using internal audit work.

Engagement life-cycle under the standards

Plan → Understand entity and controls → Assess risk → Gather evidence → Document → Report → Follow up

Use this order to place any SIA in your answer. Do not quote SIA numbers unless you are sure of them.

SA 610 (Revised) test of an internal audit function

Objectivity + Competence + Systematic and disciplined approach

These are the three factors an external auditor evaluates before using internal audit work.

Competence factors (SA 610 A8)

Resources + hiring/training policies + technical proficiency + financial reporting knowledge + professional body membership

Professional bodies oblige members to follow standards and continuing professional development.

Extent of reliance (SA 610 para 18)

More judgment, higher assessed risk, weaker objectivity, lower competence → use less internal audit work and do more directly

The external auditor makes all significant judgments, so reliance is never total.

SA 300 overall strategy (para 7)

Scope + reporting objectives and timing + significant factors + preliminary activities + resources

Planning is a strategy first, then a detailed plan.

Quick revision

• The charter sets the purpose, authority and responsibility of the internal audit function.
• The audit universe is the full set of auditable areas, which is then ranked by risk.
• Risk-based planning directs effort to the areas with higher risk first.
• The engagement letter records scope, responsibilities, access and reporting for one assignment.
• Plan the engagement before fieldwork: objectives, scope, team, timing and programme.
• Understanding the entity and its controls comes before you decide the nature and extent of tests.
• The audit programme turns objectives and risks into specific procedures.
• Evidence must be sufficient and appropriate, and working papers must support every conclusion.
• Sampling is a way to test part of a population, and the sample must suit the objective and risk.
• SA 300: initial audits may need expanded planning, including communication with the predecessor auditor.
• SA 300: change the strategy and plan when new evidence differs significantly from what you expected.
• SA 610 (Revised): the external auditor uses less internal audit work when judgment is high, risk is higher, or objectivity or competence is weaker.

Common mistakes

• Treating the engagement letter as a mere formality and listing only fees and dates. Fix: Lead with objectives, scope and responsibilities. These prevent disputes. Fees come last.
• Skipping independence checks and accepting at once. Fix: Always scan the facts for conflicts: prior roles, family ties, financial interest, association with the area.
• Saying the charter is approved by management or the head of finance. Fix: Say it is approved by the board or audit committee, so that the function stays objective.
• Confusing the charter with the audit plan or audit programme. Fix: The charter is the standing mandate. The plan is periodic. The programme is the step list for one engagement.
• Treating risk based planning as auditing only high-risk areas and ignoring the rest. Fix: Say low-risk areas get lighter or less frequent coverage, not none. Every area stays in the universe.
• Presenting a risk score formula as a legal or standard-prescribed rule. Fix: Describe it as a common practice and say the entity may use its own scale.
• Writing a generic audit programme not linked to the facts Fix: Pick the risks in the question and make each procedure address one of them.
• Confusing the engagement plan with the annual audit plan Fix: The annual plan covers the whole audit universe; the engagement plan covers one assignment in detail.
• Treating understanding the entity as a one-line formality. Fix: Spend a paragraph on business, industry, regulation, systems and past findings, and show how each shapes the plan.
• Mixing design evaluation with operating effectiveness. Fix: Answer in two parts: is the control suitably designed, and does it work throughout the period.

Exam tips

• Open with the acceptance checks, then the letter. Many answers lose marks by jumping to contents.
• In case questions, scan for hidden conflicts such as a prior statutory role, family ties or financial interest in the audited area.
• Use bullets for letter contents and tie each to the facts. Generic lists score less.
• Quote the Code of Ethics point from SA 610 (Revised) para A14 only for the statutory-auditor case. Do not stretch it to other cases.
• Close every answer with a one-line conclusion: accept, accept with safeguards, or decline.
• Write the approving authority and the independence point in every charter answer. They are easy marks.
• For a case question, tie the charter scope or universe items to the entity's sector in the facts.
• Use short bullet lists for contents, then a sentence on why each matters.