Advanced Audit and Assurance (International) · The audit of performance information (pre-determined objectives) in the public sector

Planning the Audit of Performance Information in the Public Sector

Updated 11 October 2026 · Fact-checked

Planning an audit of performance information means deciding how you will check reported results against a public body's pre-determined objectives. You understand the entity, confirm the criteria are suitable, assess the risk that reported results are misstated, set materiality, and agree the engagement terms before you begin testing.

Understand Planning the Audit of Performance Information

Performance information is what a public body reports about what it achieved, compared with the objectives it set in advance. Examples are the number of clinics built, the share of applications processed within 30 days, or the cost per student. The objectives, indicators and targets are called pre-determined objectives because they are set before the period starts, usually in a plan or budget.

The auditor does not judge whether the objectives were good policy. You give assurance on whether the reported results are reliable and properly presented against the stated objectives. This is usually an assurance engagement under ISAE 3000 (Revised) or a mandate set by law for a state audit body. Your work is similar to a financial statement audit, but there are no standard accounting rules to measure against. You must therefore judge whether the criteria themselves are suitable.

Planning has four connected parts. First, understand the entity: its mandate, strategic plan, how objectives flow into indicators, who collects the data, and what systems and controls produce the numbers. Second, assess risk: where could the reported result be materially wrong or misleading? Third, set materiality, using both amount and nature. Fourth, agree the engagement terms: scope, criteria, responsibilities, access, reporting form and timetable.

Risks are different from those in financial audits. Data is often collected manually in many remote sites. Indicators may be vague, such as 'improved access'. Targets may not be measurable, or may be changed during the year. Managers may feel pressure to show success, because funding or bonuses can depend on results. Systems may be new, and the same result may be defined differently across units.

Good planning links each risk to an audit response. Your plan should show which indicators matter most, which assertions are at risk (occurrence, completeness, accuracy, presentation and consistency with the plan) and what evidence you will need. That is what the examiner rewards.

Key rules to remember

Suitable criteria characteristics: Relevance, completeness, reliability, neutrality, understandability; These are the ISAE 3000 characteristics. Use them to test whether objectives and indicators can be audited. Many public sector frameworks add that indicators should be specific, measurable and time-bound.
Engagement risk: Assurance engagement risk = risk of material misstatement × detection risk; A conceptual relationship, not a calculation. Higher assessed risk means more or better evidence. This model applies to the engagement as a whole.
Materiality basis: Materiality = judgement of what would influence users, in amount and in nature; There is no fixed percentage for performance information. Often the benchmark is a tolerable error rate in reported results, or a qualitative test such as whether a target is met or missed.
Key engagement terms: Scope + criteria + responsibilities + access + reporting + timetable; Agree these in writing before starting. Management is responsible for the information and for suitable criteria and controls.

How to solve Planning the Audit of Performance Information questions

Use this order for any planning question. It keeps you tied to the scenario and covers the professional skills marks.

1Read the requirement and identify which planning area is asked for: understanding, risk, materiality, terms, or all of them.
2Pull out the facts from the scenario: the entity's mandate, the objectives and indicators, data sources, systems, staff changes and pressures.
3Test the criteria. Ask whether each indicator is relevant, measurable, complete, reliable and neutral. Say which fail and why.
4Identify risks tied to specific facts. State the risk, the assertion affected and why it matters, not just a generic list.
5Set materiality in both quantity and nature. Explain what a user would care about, such as a missed target reported as met.
6Give the audit response for each risk: nature, timing and extent of procedures, and staffing, such as site visits or testing of data systems.
7Cover engagement terms: scope, criteria, management responsibilities, access to records, form of report and deadlines. Mention any limits on scope.
8Finish with a short professional judgement point, such as whether you should accept the engagement or whether an expert is needed.

Quickest way: Entity, Criteria, Risk, Terms (ECRT)

When to use it: Use when time is short and the requirement asks for planning considerations or risks in a public sector scenario.

E: note two or three facts about the entity, its mandate and its data systems.
C: label each indicator as suitable or unsuitable, with one reason.
R: write each risk as fact, then consequence, then response.
T: list engagement terms in one line each: scope, criteria, responsibility, access, report, timing.
Add one sentence on materiality by nature, then check you have linked each point to the scenario.

Common mistakes in Planning the Audit of Performance Information

Applying financial statement materiality such as a percentage of revenue.
Students copy the usual audit approach without thinking about what users want from performance reports.
Fix: Explain that materiality here depends on user decisions. Consider the size of error in reported results and whether a target is met or missed.
Writing generic risks such as 'fraud' or 'poor controls' with no link to the scenario.
Students rely on memorised lists under time pressure.
Fix: Use the pattern fact, risk, assertion, response. Tie each risk to a detail given, such as manual data collection at rural offices.
Auditing the merit of the policy or objective.
Students confuse performance information assurance with a value-for-money audit of how well the entity performed.
Fix: State that you give assurance on whether reported results are reliable and fairly presented. Comment on the objectives only where they make criteria unsuitable.
Forgetting to assess whether the criteria are suitable.
In a financial audit, the framework such as IFRS is already given.
Fix: Always test indicators against relevance, completeness, reliability, neutrality and understandability before planning evidence.
Leaving out management's responsibilities and access rights in the engagement terms.
Students treat the terms as an administrative detail.
Fix: State that management is responsible for the information, the criteria and internal control, and that you need access to people, records and data systems.
Ignoring consistency between the plan, the budget and the report.
Students focus on the numbers and overlook that targets can be changed or dropped during the year.
Fix: Include a presentation risk: indicators or targets in the report differ from those approved in the original plan, so the reader is misled.

Worked examples

Example 1

A provincial health department reports that '95% of clinics provided adequate service' against an approved objective to 'improve access to primary healthcare'. Data is collected on paper at 240 clinics and typed into a central spreadsheet by regional clerks. Management say they want the audit started next week without a written agreement. Explain the planning issues you would raise. (10 marks)

Show the solution

Criteria: the objective 'improve access' is vague and 'adequate service' is not defined. The indicator is not specific or measurable, so it is not suitable criteria. Reliability and understandability are also weak.
Action on criteria: ask management to define 'adequate' and link the indicator to the approved plan. If they cannot, I may need to report a limitation or decline the engagement.
Risk: paper records at 240 sites, re-keyed into a spreadsheet, create accuracy and completeness risk, such as keying errors, lost forms and weak review of the spreadsheet.
Risk: management may be tempted to overstate success because the 95% figure is a headline result. This is a bias and occurrence risk, requiring scepticism.
Response: test a sample of clinics by visiting and agreeing source forms to the spreadsheet, test spreadsheet formulas, and reperform the 95% calculation. Use more clinics in regions with weak controls.
Materiality: errors that move the result across a target, or that change which clinics count as adequate, are material by nature even if numerically small.
Engagement terms: refuse to start without written terms. They should state scope, the criteria used, management's responsibility for the information and controls, access to clinics and data, the form of report and the timetable. Without them there is a risk of misunderstanding and no basis for a report.

Answer: The objective and indicator are unsuitable as drafted, so agree clear criteria first. Key risks are manual data capture, re-keying errors and management bias. Respond with site visits, source-to-spreadsheet testing and recalculation. Set materiality by nature as well as amount. Do not start until written engagement terms are agreed covering scope, criteria, responsibilities, access and reporting.

Example 2

You are planning the audit of a national roads agency's annual performance report. The approved plan had five indicators. The draft report shows only three, and one target (road kilometres resurfaced) was lowered from 800 to 600 during the year. Actual result: 620 km. Calculate the result against each target and explain the planning implications. (8 marks)

Show the solution

Against the original target: 620 ÷ 800 = 77.5%, so the target was missed by 180 km.
Against the revised target: 620 ÷ 600 = 103.3%, rounded to one decimal place, so the target appears exceeded by 20 km.
The change in target turns a missed result into an apparent success. This is a presentation and neutrality risk, and a risk of misleading users.
Two of the five approved indicators are missing. This raises a completeness risk, because poorly performing indicators may have been dropped.
Criteria: the approved plan is the pre-determined basis. Any change needs documented, authorised reasons and should be disclosed in the report.
Materiality: the shift from missed to met is material by nature, even though the 20 km is small against 800 km.
Planning response: obtain the approved plan, the amendment approvals and the reasons. Plan procedures to compare the report to the plan indicator by indicator, and to test the 620 km to contracts and completion certificates. Agree in the engagement terms that the report must be compared with the approved plan and that I will report on inconsistencies.

Answer: Against the original target the agency achieved 77.5% (a miss); against the revised target it achieved 103.3%. The lowered target and two missing indicators create completeness, presentation and neutrality risks that are material by nature. Plan to compare the report to the approved plan, check authorisation of changes, and test the 620 km to source evidence.

Exam tips

Always link each risk to a fact in the scenario. A generic list earns few marks, while fact, risk and response earns most.
Say clearly whether the criteria are suitable. Many students skip this, and it is the point that separates performance information from a financial audit.
Use the words 'by nature' when discussing materiality. Small errors that flip a target from missed to met are the classic example.
When engagement terms are asked, include management's responsibilities and access. Mention that a lack of agreed terms is a reason to delay or decline.
Use the professional skills marks: show scepticism about management's reported success, and keep your answer in a clear structure with short headed points.

Practice questions from The audit of performance information (pre-determined objectives) in the public sector

Planning the Audit of Performance Information in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

CS ProfessionalPerformance Audit: Concept and Approach

Planning the Audit of Performance Information: frequently asked questions

What is the difference between auditing performance information and a value-for-money audit?

Performance information audit gives assurance on whether reported results against pre-determined objectives are reliable and properly presented. A value-for-money audit examines whether the entity used resources economically, efficiently and effectively. The first checks the report, the second assesses how well the entity performed.

How do you set materiality for performance information?

There is no fixed percentage. You judge what would influence users, considering both the size of any error and its nature. A small error that changes a target from missed to met can be material.

What makes criteria suitable for performance information?

Under ISAE 3000, suitable criteria are relevant, complete, reliable, neutral and understandable. In practice, indicators should also be specific and measurable so that results can be tested. If criteria are vague, you must raise it with management before planning evidence.

Why must engagement terms be agreed before starting?

Terms set out scope, criteria, management's responsibilities, access to records, the form of the report and the timetable. They prevent misunderstanding and protect both sides. Without them, you have no clear basis for the work or the report.