Plan an engagement around objectives and risk

Turn a concern into an auditable question

“Review procurement” is too broad to guide an engagement. A clearer objective might be: assess whether supplier changes and payments are authorised, accurate and protected from diversion. The scope identifies the activities, systems, locations and period to examine. Criteria describe the basis for deciding whether the process is satisfactory.

Keep these distinct. The objective is what the engagement seeks to establish; the scope sets its boundaries; procedures describe the work.

Build a risk and control assessment

Begin with the process objective and understand how work actually flows. Consult process owners, policies, earlier findings and relevant data. Consider changes, fraud exposures and dependencies on suppliers or technology.

Objective	Risk	Expected response	Possible procedure
Pay genuine suppliers	Bank details diverted	Independent verification and approval	Examine changes and supporting verification
Record complete liabilities	Invoices omitted	Reconcile relevant receiving and invoice records	Trace selected receipts into accounting records
Maintain critical services	Supplier interruption	Continuity arrangements and monitoring	Evaluate dependencies and recovery evidence

These are examples, not a universal work programme. Adapt them to the business, its obligations and the engagement purpose.

Choose suitable criteria

A policy may provide criteria, but first consider whether it is current and appropriate. Other criteria can come from contracts, agreed performance measures, applicable requirements or a suitable framework.

For example, an agreement that “orders should be prompt” is difficult to evaluate consistently. An agreed service measure specifying the start point, end point and allowable time gives the work a clearer basis. Do not invent a benchmark after seeing results merely to produce a finding.

Case: a requested scope restriction

The purchasing manager agrees to an audit but excludes all changes approved by senior executives. Those transactions may contain the greatest override risk.

Establish the reason, assess the effect and seek resolution. Document and communicate a remaining limitation and its consequences. Testing lower-risk transactions does not automatically compensate for excluding the area central to the objective.

Plan resources and procedures

The work needs suitable skills, time, tools and supervision. A complex system review may require specialist support. Resource pressure should lead to a reasoned discussion of scope and alternatives, rather than an unsupported promise to cover everything.

A useful procedure specifies the population, selection approach, evidence, evaluation and documentation. “Check approvals” leaves too much unspecified. “For selected supplier-bank changes in the period, compare approval and independent verification with the effective change time” gives clearer direction.

Changes during the engagement

New evidence can change risk priorities. An unexpected migration problem may justify further work or a revised scope. Assess the impact, obtain appropriate review and communicate the change. Continuing the original programme mechanically can miss the most significant issue.

Self-check

A manager asks for ten extra tests outside the objective. What should happen? Assess their relevance, risk and resource impact; agree and document any justified change.

Does a complete checklist prove adequate planning? No. The choices should respond to the engagement's actual objectives and risks.

Where does applied business knowledge fit? Accounting, process, IT and continuity concepts help identify relevant risks and controls; they are tools for planning meaningful work.

Follow the Part 2 syllabus alongside these examples.