Internal and Forensic Audit · Internal Audit Engagements and Planning

Engagement Planning and Audit Programme in Internal Audit

Updated 11 October 2026 · Fact-checked

Engagement planning means deciding, before fieldwork, what an internal audit engagement will cover, why, who will do it, when and at what cost. The audit programme is the written list of procedures that turns the plan into work. To answer, state objectives, scope, risks, resources, programme steps and approval.

Understand Engagement Planning and Audit Programme

An internal audit engagement is one assignment, such as the audit of purchases at a plant. Before the team visits, the head of internal audit must plan it. Planning prevents wasted effort, missed risks and overruns.

Planning starts with the objectives: what the engagement must achieve, for example to assess whether purchase controls work. Then you fix the scope: which units, processes and period are covered, and what is left out. You gather background on the area, its risks, past findings and its key controls. Risks decide where the team spends its time.

The audit programme (work programme) is the detailed set of procedures. Each step says what to check, how (inspection, inquiry, re-performance, analytics), the sample or extent, who does it and where the result is recorded in the working papers. It is a guide, not a cage. You may add or drop steps when fieldwork shows new risks, but you record why.

Planning also covers work allocation and budgeting. Match tasks to the skills and experience of team members, give juniors routine tests and keep judgment-heavy areas for seniors. Budget time in hours for each area, with milestones for fieldwork, review and reporting. Compare actual with budget and explain variances.

The same logic appears in the external audit standard on planning, SA 300. It asks the auditor to identify the characteristics that define scope, the reporting objectives and timing, significant factors directing the team's efforts, and the nature, timing and extent of resources needed. Internal auditors apply the same thinking to each engagement, with the audit committee or management as the audience. Name the Standards on Internal Audit (SIA) in your answer only in general terms unless you are sure of the exact standard.

Key rules to remember

Elements of an engagement plan: Objectives + Scope + Risks + Resources + Timing + Audit programme + Approval; Use this as a checklist skeleton for any planning question.
Audit programme line: Objective → Procedure → Sample/extent → Auditor → Working paper reference → Done/review sign-off; Each step should be traceable to an objective and to evidence.
SA 300 para 7: overall audit strategy (external audit): Scope characteristics; reporting objectives and timing; significant factors; preliminary activities; nature, timing and extent of resources; A useful parallel for internal audit planning; do not present it as an internal audit standard.
Budget variance: Variance (hours) = Actual hours − Budgeted hours; A positive value means an overrun, and the reason must be recorded.
Initial engagement (SA 300 para A21): More planning for a first-time engagement: predecessor arrangements, opening balances, quality control requirements; For a first-time internal audit area, plan to spend more effort understanding it.

How to solve Engagement Planning and Audit Programme questions

Use this order for any question on planning an engagement or drafting an audit programme.

1Read the facts: the entity, function under audit, period, risks and constraints such as deadlines or staff.
2State the engagement objectives in one or two lines, linked to the key risk.
3Define scope: units, processes, period, and exclusions.
4Show how you will understand the area: prior reports, process flow, key controls, risk assessment.
5Draft the audit programme: procedures, sample extent, and working paper references, each tied to an objective.
6Allocate staff by skill and supervision, and set the time budget with milestones.
7Add approval, communication with the auditee, and how changes to the plan will be recorded.
8Conclude with how the plan helps meet the facts given in the question.

Quickest way: O-S-R-P-B-A under time pressure

When to use it: Use when you have about 10 minutes for a short note or a plan-based question.

O: write objectives in one line.
S: list scope and exclusions.
R: name the top two or three risks from the facts.
P: write five to seven programme steps with procedure and sample.
B: give team allocation and hours budget.
A: end with approval and plan revision on new findings.

Common mistakes in Engagement Planning and Audit Programme

Writing a generic audit programme not linked to the facts
Students recall a standard checklist and skip the case details.
Fix: Pick the risks in the question and make each procedure address one of them.
Confusing the engagement plan with the annual audit plan
Both use the word plan.
Fix: The annual plan covers the whole audit universe; the engagement plan covers one assignment in detail.
Treating the audit programme as fixed
Students think deviation is a failure.
Fix: Say the programme can be amended with documented reasons and approval.
Ignoring budgeting and allocation
Focus stays on procedures only.
Fix: Always add a line on who does what, supervision and time budget.
Mixing internal and external audit planning rules
SA 300 and internal audit practice look similar.
Fix: Use SA 300 only as a parallel or when the question is about the statutory auditor, for example in relying on internal audit under SA 610.
Vague scope with no period or exclusions
Students write 'audit of purchases' only.
Fix: State locations, period and what is excluded, so the team and auditee agree.

Worked examples

Example 1

Sunrise Foods Ltd asks its internal audit team to audit the purchase function at its Pune plant for 2026-27. Prepare the engagement plan in outline.

Show the solution

Objective: assess whether purchase controls ensure authorised, fairly priced and properly recorded purchases.
Scope: Pune plant, April 2026 to March 2027, requisition to payment; exclude capital purchases, which are covered by a separate engagement.
Risks: favouring certain vendors, purchases without approval, duplicate payments.
Programme: review the approved vendor list; test a sample of purchase orders for approvals; compare rates with quotations; match order, receipt and invoice on a sample; run a duplicate invoice analysis; review payment approvals.
Allocation: senior auditor on vendor selection and analytics; junior auditors on document matching; manager reviews.
Budget: hours set for each area with milestones for fieldwork, review and draft report.
Approval: head of internal audit approves; plan shared with the plant head.

Answer: The plan states objective, scope with exclusions, key risks, a risk-linked audit programme, skill-based allocation, a time budget and approval.

Example 2

During fieldwork on the Pune engagement, the team finds that several payments were made to a vendor not on the approved list. The programme did not cover this. What should the team do?

Show the solution

Treat it as a new risk indicator and inform the audit manager promptly.
Expand the programme: list all payments to unapproved vendors and check their approvals and relationships.
Document the change, its reason and the approval in the working papers.
Adjust staffing and budget: reassign a senior member and record extra hours.
Report the finding in line with the engagement reporting process.

Answer: The team should amend the audit programme with documented approval, extend testing on unapproved vendors, adjust allocation and budget, and report the results.

Exam tips

Link every programme step to a risk or objective in the facts; generic lists lose marks.
Present answers in the order objectives, scope, programme, allocation, budget, approval.
Do not cite SIA numbers unless sure; describe the requirement in words.
If the question involves a statutory auditor relying on internal audit, bring in SA 610: more judgment or higher risk means less reliance.
Keep a short sample programme table-like list, written as bullets, in long answers.

Practice questions from Internal Audit Engagements and Planning

Engagement Planning and Audit Programme in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Engagement Planning and Audit Programme: frequently asked questions

What is an audit programme in internal audit?

It is a written set of procedures for an engagement. Each step says what to test, how, to what extent, who does it and where the evidence is filed. It guides the team and helps supervision.

Is the audit programme fixed once approved?

No. It may be changed when fieldwork shows new risks or when a step is not useful. The change and its reason should be recorded and approved.

How is engagement planning different from the annual audit plan?

The annual plan decides which areas will be audited in the year, based on risk. Engagement planning prepares one assignment in detail: objectives, scope, programme, team and budget.

Does SA 300 apply to internal auditors?

SA 300 governs the statutory auditor's planning of a financial statement audit. Internal auditors follow their own standards, but the planning ideas are similar. The statutory auditor also plans how to use internal audit work and communicates this to those charged with governance under SA 610.