CIA engagement planning: from business risk to a work program
Engagement planning connects the business objective and risk to an audit objective, scope, criteria, resources and work program. Choose the evidence-gathering procedure after defining what the engagement must establish. In the current CIA Part 2 syllabus, planning carries 50%.
- 1
Risk
What could prevent the business objective?
Output: Unauthorized supplier payments
- 2
Objective
What assurance is needed?
Output: Supplier creation and payment approval operate
- 3
Scope and criteria
What is covered and what should happen?
Output: Defined period, systems and approval policy
- 4
Work program
How will you obtain evidence?
Output: Inspect and test the relevant records
A worked procurement planning grid
A useful plan makes the chain reviewable. Each procedure should support an objective, and each objective should respond to a risk. A large sample of irrelevant transactions still does not answer the audit question.
| Element | Decision | Reason |
|---|---|---|
| Business objective | Pay only legitimate suppliers for authorized purchases | Defines the outcome at risk |
| Risk | Unauthorized supplier setup permits improper payments | Specifies what can go wrong |
| Audit objective | Evaluate setup and payment-approval controls | Targets the controls addressing that risk |
| Scope | Selected entities, system and review period | Defines the boundary of the conclusion |
| Criteria | Approved authorization rules and access requirements | Provides a defensible benchmark |
| Procedure | Test setup permissions and approval evidence | Connects evidence to the objective |
Business objective
- Decision
- Pay only legitimate suppliers for authorized purchases
- Reason
- Defines the outcome at risk
Risk
- Decision
- Unauthorized supplier setup permits improper payments
- Reason
- Specifies what can go wrong
Audit objective
- Decision
- Evaluate setup and payment-approval controls
- Reason
- Targets the controls addressing that risk
Scope
- Decision
- Selected entities, system and review period
- Reason
- Defines the boundary of the conclusion
Criteria
- Decision
- Approved authorization rules and access requirements
- Reason
- Provides a defensible benchmark
Procedure
- Decision
- Test setup permissions and approval evidence
- Reason
- Connects evidence to the objective
Start the case with facts and an assurance question
A distributor has opened a second purchasing office. Supplier setup is centralized, but emergency payment approval can be performed locally. Management is concerned about payments to unauthorized suppliers. The proposed review covers the last quarter at both offices. These facts suggest a chain from setup permissions to emergency approvals and payment release.
A useful objective is to evaluate whether the relevant controls prevent or detect unauthorized supplier payments within the defined scope. “Audit procurement” is too broad to guide the work. “Check that forms look consistent” is specific but does not address the stated risk. Write the intended conclusion before selecting a procedure.
Turn each risk into evidence you can obtain
For unauthorized supplier creation, consider setup access and approval records. For bypass through emergency payments, examine who can invoke the exception and what subsequent review occurs. Determine the relevant population, period and systems before selecting records. Testing only the ordinary workflow would leave the emergency route unanswered.
Document why each procedure exists. Inspection of approvals may address authorization, but it does not automatically show that the supplier exists or that every payment is recorded. A procedure can be competently performed and still be irrelevant to the intended conclusion. The planning grid should expose that mismatch before fieldwork.
Agree suitable criteria before evaluating exceptions
If a process says approvals must be “timely,” determine what timely means before scoring transactions. Consider the applicable policy, requirement or suitable benchmark and discuss it with the relevant parties. Choosing a convenient threshold after seeing results weakens the conclusion.
Make the benchmark precise enough to apply consistently
Suppose policy requires emergency approvals to be reviewed “promptly.” One reviewer treats the same day as acceptable and another allows a month. Before classifying exceptions, establish suitable criteria using the applicable requirements and discussion with the relevant parties. Do not select a convenient definition after seeing which threshold makes the results look better.
Record the criterion, its source and how it applies to the population. If a policy was revised during the quarter, determine which version applied to which transactions. A current rule should not silently become the benchmark for an earlier period when a different authorized requirement governed the activity.
Reject a weak procedure and replace it
A proposed step says, “Ask the manager whether emergency approvals work.” Inquiry may help explain the process, but an unsupported answer does not by itself establish how it operated. Combine understanding of the process with relevant records and testing aligned to the objective.
Another proposed step selects only transactions that already have approval documents attached. That population can exclude the very failures you are looking for. Start from a defensible complete population of relevant activity and explain how the selection supports the conclusion. Selection convenience is not the same as audit relevance.
Address scope and resource limits explicitly
If required records are withheld or the team lacks a necessary skill, document the effect on the objective and escalate through audit leadership. Silently omitting a system while reporting on the whole process overstates the work.
| Problem | Response |
|---|---|
| Missing source records | Identify the resulting evidence limitation |
| Unclear scope | Specify period, entities, systems and exclusions |
| Insufficient expertise | Arrange qualified resources or revise the plan appropriately |
| Procedure unrelated to objective | Replace it with a test of the named risk and control |
Missing source records
- Response
- Identify the resulting evidence limitation
Unclear scope
- Response
- Specify period, entities, systems and exclusions
Insufficient expertise
- Response
- Arrange qualified resources or revise the plan appropriately
Procedure unrelated to objective
- Response
- Replace it with a test of the named risk and control
Revise the plan when an important record is unavailable
During planning, the team learns that emergency-payment logs were overwritten for half the quarter. First determine what is missing and whether other reliable evidence can address the objective. A bank record may establish that a payment occurred, but not necessarily that the required approval happened before release.
Bring the limitation and alternatives to audit leadership. Revise procedures or scope through the appropriate process and document the effect on the intended conclusion. Reporting that the full-quarter control operated effectively while silently testing only the available half would overstate the evidence.
Match skills and time to the actual work
If identifying bypass permissions requires system expertise the team lacks, recognize the gap before relying on an incomplete configuration review. Consider suitable specialist support and its resource implications. Adding more generalist hours does not necessarily replace the missing capability.
A sound revision names what will be covered, what remains uncertain, who will perform the work and what evidence the reviewer should expect. It also explains the tradeoff to the relevant stakeholders. This keeps the plan reviewable when constraints force a change rather than treating a deadline as permission to weaken the conclusion.
Review the plan before fieldwork starts
Use these questions to test the complete chain. The example decisions are illustrative; the applicable criteria and procedures depend on the engagement.
| Gate | Evidence of a coherent plan | Reason to revise |
|---|---|---|
| Objective | Names the assurance question and relevant risk | Only names a department or a document |
| Scope | Identifies period, systems, locations and boundaries | Conclusion would cover untested activity |
| Criteria | Provides an applicable and defensible benchmark | Threshold chosen after results are known |
| Work program | Connects each step to the evidence needed | Large amounts of irrelevant testing |
| Resources | Has the access, skills and capacity needed | Missing capability is hidden by extra hours |
Objective
- Evidence of a coherent plan
- Names the assurance question and relevant risk
- Reason to revise
- Only names a department or a document
Scope
- Evidence of a coherent plan
- Identifies period, systems, locations and boundaries
- Reason to revise
- Conclusion would cover untested activity
Criteria
- Evidence of a coherent plan
- Provides an applicable and defensible benchmark
- Reason to revise
- Threshold chosen after results are known
Work program
- Evidence of a coherent plan
- Connects each step to the evidence needed
- Reason to revise
- Large amounts of irrelevant testing
Resources
- Evidence of a coherent plan
- Has the access, skills and capacity needed
- Reason to revise
- Missing capability is hidden by extra hours
A final self-check
Change the original risk from unauthorized suppliers to late payment of valid suppliers. The objective, criterion and evidence should change too. If your plan remains identical except for its title, it may be a generic checklist rather than a response to the risk.
That variation is a useful CIA learning exercise: keep the process, change the decision and rebuild the reasoning. The quality of the plan lies in its connected logic, not in how many rows it contains.
Original worked case
A test that answers the wrong question
The objective is to detect liabilities omitted at year-end. The auditor selects only transactions already recorded in accounts payable.
Reveal the decision and reasoning
Start from evidence of goods or services received and trace to payable or accrual records for the relevant period.
A population of recorded payables can support testing recorded items, but it excludes the omissions the objective is seeking.
An editorial teaching example, not an official IIA question or a prediction of exam content.
Common questions
- Is an engagement plan the same as the annual audit plan?
- No. The audit plan prioritizes engagements across the organization. Engagement planning defines objectives and work within one selected engagement.
- Why does the objective come before the procedure?
- You need to know what conclusion the evidence must support. A technically valid procedure can still be irrelevant to the stated risk.
Sources and editorial notes
Official exam facts and provider package descriptions are supported by the references below. Study schedules, scenarios and fit judgments are our editorial work. They do not establish a required study duration, a pass probability or comparative learning outcomes.
- The IIA: Part 2 expanded syllabus
- Section A, Engagement Planning.
- Planning outcomes on evaluation criteria.
- The IIA: Global Internal Audit Standards
- Planning engagements and obtaining resources.
MiloPrep is independent and is not affiliated with or endorsed by The IIA or the providers discussed. Product comparisons describe our own offering alongside provider information. Names and marks belong to their owners.