Advanced Audit and Assurance (International) · Planning, materiality and assessing the risk of material misstatement

Audit Strategy, Plan and Analytical Procedures (ISA 300, ISA 520)

Updated 11 October 2026 · Fact-checked

The audit strategy sets the scope, timing and direction of the audit. The audit plan sets out the detailed procedures to carry out. Under ISA 520, you use analytical procedures at planning to spot unusual relationships that signal risk, then tailor the plan to those risks.

Understand Audit Strategy, Plan and Analytical Procedures

Planning is not a one-off task at the start. ISA 300 says the auditor plans so that the audit is performed in an effective manner. The work is iterative. You update the strategy and plan as you learn more during the audit.

The overall audit strategy is the high-level view. It covers the scope of the engagement, the reporting objectives, the timing of the audit and the nature of communications required. It also covers the important factors that shape the work, such as materiality, high-risk areas, the use of experts, other auditors and internal audit, and the resources needed. Think of it as the direction of travel.

The audit plan is more detailed. It covers the nature, timing and extent of risk assessment procedures, the further audit procedures at assertion level, and other procedures needed to comply with the ISAs. Think of it as the instructions for the team. The strategy comes first, and the plan follows from it. The two are closely linked and can be written together on small audits.

Analytical procedures (ISA 520) are evaluations of financial information through analysis of plausible relationships between financial and non-financial data. They include comparing with prior periods, budgets, industry data and expectations, and looking at ratios and trends. At planning, they are a required risk assessment procedure (ISA 315). They help you find unusual or unexpected items that point to a risk of material misstatement. The same technique is also used as a substantive procedure and in the final review at the end of the audit.

The strategy must also deal with reliance on others. You may use an auditor's expert (ISA 620), the work of component auditors in a group audit (ISA 600) and the work of the internal audit function (ISA 610). In each case you stay responsible for the opinion. You must assess competence, objectivity and the quality of the work, and you must not refer to their work in an unmodified opinion.

Key rules to remember

Strategy versus plan: Strategy = scope + timing + direction; Plan = nature + timing + extent of procedures; Use this to answer 'difference' questions. The strategy guides the plan.
Analytical procedure test: Expectation vs recorded amount; investigate if difference > threshold; Develop the expectation first. Set the threshold from performance materiality and the reliability of data.
Gross profit margin: Gross profit margin = (Revenue − Cost of sales) ÷ Revenue × 100; A sudden change may signal revenue or cost cut-off errors.
Receivables days: Receivables days = Trade receivables ÷ Revenue × 365; A rise may signal overstated receivables or weak recoverability.
Payables days: Payables days = Trade payables ÷ Cost of sales × 365; A fall may signal understated liabilities, or a cash-rich business.
Inventory days: Inventory days = Inventory ÷ Cost of sales × 365; A rise may signal obsolete stock or overstated inventory.
Current ratio: Current ratio = Current assets ÷ Current liabilities; Useful for going concern and liquidity risk.
Interest cover: Interest cover = Profit before interest and tax ÷ Finance costs; A low figure raises going concern and covenant risk.

How to solve Audit Strategy, Plan and Analytical Procedures questions

Planning questions give you a scenario and ask what to do or why. Use the same approach each time so you answer the requirement and use the facts given.

1Read the requirement and note the verb: explain, identify, evaluate, recommend. Note the number of marks to size your answer.
2Underline the key facts in the scenario: size, growth, new systems, new locations, related parties, financial pressure and staff changes.
3For analytical procedures, calculate only the key ratios and changes. Compare with the prior year, budget or industry. Calculate percentage changes for the biggest movements.
4For each unusual movement, state the possible cause, then the risk of material misstatement and the affected assertion.
5Link each risk to a response in the plan: nature, timing and extent of procedures, staffing, and supervision.
6For experts, other auditors and internal audit, assess competence, objectivity and quality of work. State what you will do to evaluate their work and how you retain responsibility.
7Finish with a point of professional judgement, such as a recommendation, a communication to the engagement partner, or a point of scepticism.

Quickest way: Ratio, risk, response in three lines

When to use it: Use this when a question gives a short set of financial figures and you have limited time.

Pick the three or four biggest changes in the figures. Ignore small ones.
For each, write one line: figure moved from X to Y, which suggests a possible risk, such as overstated revenue.
Add one line of response: for example, extended cut-off testing near year end.
Keep the same layout for each point so you can score quickly and the marker can follow it.

Common mistakes in Audit Strategy, Plan and Analytical Procedures

Treating the audit strategy and the audit plan as the same thing.
The two documents are linked and sometimes combined in practice, so the terms blur.
Fix: Say that the strategy sets scope, timing and direction, and the plan sets the detailed procedures. Show how the plan follows from the strategy.
Listing ratios without interpreting them.
Students are comfortable with calculations and run out of time for the analysis.
Fix: For every ratio, state the change, the likely cause, the risk and the assertion affected. Calculations alone earn few marks.
Giving generic risks that ignore the scenario.
Students learn lists of risks and repeat them.
Fix: Quote the facts from the scenario in each point, such as a new system or a rapid revenue rise, and tie the risk to them.
Saying the auditor can rely on the internal audit function or an expert with no checks.
Students forget that the auditor stays responsible for the opinion.
Fix: State that you evaluate competence, objectivity and quality of work, and that you perform your own procedures where needed.
Treating analytical procedures as proof that the figures are correct.
A result that looks reasonable feels like assurance.
Fix: Explain that at planning they only identify risk areas. Any substantive use needs a precise expectation and reliable data.
Forgetting that the plan is updated during the audit.
Students picture planning as a single early step.
Fix: Say that planning is continuous and changes in risks, results or events lead to a revised strategy and plan.

Worked examples

Example 1

Explain the difference between an overall audit strategy and an audit plan, and give two matters that you would include in each for a new audit client, a retail group.

Show the solution

Define the strategy: it sets the scope, timing and direction of the audit and guides the development of the plan.
Give two strategy matters: the group has many stores in different locations, so the scope includes which locations to visit and whether component auditors are needed; and the timing covers an inventory count date close to the year end, with deadlines for reporting set by the client.
Define the plan: it sets the detailed nature, timing and extent of the procedures the team will perform to respond to the assessed risks.
Give two plan matters: the specific procedures for inventory, such as attending counts at selected stores and testing cut-off; and the extent of testing of revenue, such as the sample size for testing till takings.
Link them: the strategy decisions on risk and resources drive what is written into the plan.

Answer: The strategy is the high-level approach covering scope, timing and direction, for example store coverage and the count date. The plan is the detailed set of procedures, for example attendance at counts and sample sizes for revenue testing. The plan follows from the strategy and both are updated as the audit progresses.

Example 2

For a manufacturing client, revenue rose from $40m to $46m (+15%). Cost of sales rose from $28m to $29.9m. Trade receivables rose from $6.0m to $9.2m. Calculate the gross profit margin and receivables days for both years, and explain the audit risks.

Show the solution

Prior year gross profit = 40 − 28 = $12m. Margin = 12 ÷ 40 = 30.0%.
Current year gross profit = 46 − 29.9 = $16.1m. Margin = 16.1 ÷ 46 = 35.0%.
Prior year receivables days = 6.0 ÷ 40 × 365 = 54.75, about 55 days.
Current year receivables days = 9.2 ÷ 46 × 365 = 73 days.
Interpret the margin: it rose by 5 percentage points while revenue grew 15%. Cost of sales grew by only 6.8%. This could indicate revenue overstated or cost of sales understated, for example through cut-off errors or capitalising costs wrongly.
Interpret the receivables: days rose by about 18 days. This may indicate fictitious or premature revenue, slower customer payment, or a need for a higher allowance for credit losses.
State the response: extended cut-off testing, confirmation of receivables, review of post year-end cash receipts, and testing of the allowance for credit losses.

Answer: Gross margin rose from 30.0% to 35.0% and receivables days from about 55 to 73. These point to a risk of overstated revenue, understated cost of sales and overstated receivables. The plan should include extended cut-off testing, receivables confirmations, subsequent cash receipts testing and review of the credit loss allowance.

Exam tips

Always answer the scenario. Name the client's facts in each point. Generic lists score poorly.
Show professional scepticism in planning questions: for example, question management's explanation for an unusual ratio and say you will seek corroboration.
In group questions, cover competence, independence from the group, communication and the group auditor's involvement in the component work.
Use the same structure for each point: observation, risk, assertion, response. It saves time and helps the marker.
Remember professional skills marks: present clear, concise and well-organised points, and give a reasoned recommendation.

Practice questions from Planning, materiality and assessing the risk of material misstatement

Audit Strategy, Plan and Analytical Procedures in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Audit Strategy, Plan and Analytical Procedures: frequently asked questions

What is the difference between the audit strategy and the audit plan?

The audit strategy sets the scope, timing and direction of the audit. The audit plan sets out the detailed nature, timing and extent of procedures. The plan is developed after the strategy and both can be revised.

Are analytical procedures required at the planning stage?

Yes. Under ISA 315, analytical procedures are a risk assessment procedure. ISA 520 also requires them in the overall review near the end of the audit. They are optional as a substantive procedure, where they are used if they are the best response to the risk.

Can the auditor rely on the work of the internal audit function?

Sometimes. You must evaluate the function's objectivity, competence and whether it applies a systematic and disciplined approach. You then evaluate and test its work. You remain solely responsible for the audit opinion.

What should I consider when using component auditors in a group audit?

Consider their professional competence, their understanding of ethical requirements and the level of oversight needed. You also need to agree what they will do and how they will communicate. The group engagement partner remains responsible for the group opinion.