Most weak audit reports were lost before fieldwork started. The objectives were copied from last year’s memo, the scope was whatever the process owner suggested at a thirty-minute kickoff, the document request went out on day one of fieldwork and came back on day nine, and the team spent the first week learning the process instead of testing it. By the time anyone knew which risks mattered, the budget was half gone and the sample sizes had been trimmed to fit. Preparation is where an engagement’s findings are decided: a team that arrives on day one with a risk assessment it can defend, a work program tied to those risks, a request list that came back a week ago, and a sponsor who has already agreed the scope will find what is there. A team that arrives to “get an understanding” will find what it is shown.
This guide is the preparation sequence for the internal audit department, from the day the engagement is confirmed on the annual plan to the morning fieldwork starts. It gives you a T-30 to T-0 timeline with owners and outputs, an engagement risk assessment worked on a real-shaped example, the information request list with 25 line items and due dates, a kickoff agenda and script, a staffing and budget table, a playbook for scope pushback, a table of the questions auditees ask and what to say, and the common failures. It was rewritten in September 2026 to reflect the Global Internal Audit Standards, which put engagement planning under Standards 13.1 to 13.6, and it pairs with the planning memo template and the work program guide, which hold the documents this sequence produces. If you are the one being audited, the companion guide on what to expect during an internal audit is written for you.
In this guide
- What preparation decides, and what the Standards require
- The T-30 to T-0 timeline
- The engagement risk assessment, worked
- Objectives, scope, and the planning memo
- The work program and the information request list
- The kickoff meeting: agenda and script
- Staffing, budget, access, and logistics
- What auditees will ask, and how to answer
- When management pushes back on scope
- Common preparation failures
- Adapting the sequence: small functions, co-sourcing, remote, regulated
What preparation decides, and what the Standards require
Preparation decides four things that cannot be recovered later. It decides which risks the engagement is about, which is the difference between a report on the risks that matter and a report on the controls that were easy to test. It decides the population and period, which sets what any sample can say. It decides the budget the team actually has, because hours spent learning the process during fieldwork are hours the testing no longer has. And it decides the relationship with the auditee, which is formed in the first two conversations and rarely changes afterward. A planning memo written on day three of fieldwork can be tidied into something that looks like planning; it cannot recover the sample that was cut, the location that was never visited, or the sponsor who learned the scope from the draft report.
The Global Internal Audit Standards make preparation a set of explicit requirements rather than good habits. Standard 13.1 requires engagement communication with management to be planned; 13.2 requires an engagement risk assessment that considers the objectives of the activity under review, its risks, and its controls; 13.3 requires objectives and scope that are documented and that reflect that assessment; 13.4 requires the evaluation criteria to be set and, where management’s criteria are inadequate, for internal audit to identify suitable ones; 13.5 requires the resources to be appropriate to the objectives and scope; and 13.6 requires a documented work program approved before the work starts. The Domain V guide walks through each. Every item in the timeline below maps to one of those six standards, which is also how an external quality assessor will read your planning file.
One framing rule before the sequence. Preparation is not a longer kickoff. It is a series of decisions, each with a written output, made in an order where each output feeds the next: the risk assessment feeds the objectives, the objectives feed the scope, the scope feeds the work program, the work program feeds the request list and the staffing, and all of them feed the kickoff. Teams that run the sequence backward, kickoff first and risk assessment last, produce memos that describe what they were already going to do.
The T-30 to T-0 timeline
Thirty working days is the right runway for a standard engagement of 300 to 500 hours; a two-week review can compress the same sequence into ten days, and a complex multi-site engagement needs forty-five. The days are working days before the first day of fieldwork (T-0). Owners are the roles in a typical function: the engagement lead (senior or manager), the audit manager who reviews, the CAE who approves, and the staff auditors who execute. The output column is what must exist before the next step starts, and it is the column an assessor will check.
| Day | Task | Owner | Output | Standard |
|---|---|---|---|---|
| T-30 | Confirm the engagement against the annual plan: entity, process, why it was planned, hours, and the risk-assessment score that put it there | Audit manager | Engagement charter line: one paragraph with the plan rationale and the budget | 13.5 |
| T-29 | Notify the executive sponsor and the process owner in writing; request the first meeting | Engagement lead | Notification email with the planned window and the names of the team | 13.1 |
| T-28 to T-25 | Desk research: prior reports and open issues, external audit and regulatory findings, policies and procedures, org charts, system inventory, volumes and values, prior-year narratives and RCMs, incident logs, management information | Engagement lead and staff | Background pack, no more than ten pages, with a “what changed since last time” section | 13.2 |
| T-24 | Sponsor meeting: the sponsor’s concerns, recent changes, known problems, what a useful report would answer | Engagement lead, audit manager | Meeting note; three to five sponsor concerns recorded verbatim | 13.1, 13.2 |
| T-23 to T-21 | Process owner meeting and a first process overview; identify systems, locations, key people, and reports | Engagement lead | Draft process map at the level of major steps; list of interviews and walkthroughs needed | 13.2 |
| T-20 to T-18 | Engagement risk assessment: risks scored on likelihood and impact, existing controls noted, residual view, fraud considerations | Engagement lead; challenged by audit manager | Scored risk table (see below) with the rationale for each score | 13.2 |
| T-17 | Draft objectives, scope, exclusions, period, locations; select criteria | Engagement lead | Draft planning memo sections 1 to 4 | 13.3, 13.4 |
| T-16 to T-13 | Draft the work program: procedures per risk, populations, sample sizes, analytics, evidence expected, hours per procedure | Engagement lead with staff | Draft work program with hours that foot to the budget | 13.6 |
| T-14 | Data request to IT or the data owner for full populations (the request that takes longest) | Engagement lead | Data request with fields, period, and format; delivery date agreed | 13.6 |
| T-12 | Information request list (PBC) issued to the process owner with due dates staggered from T-7 to T-2 | Engagement lead | PBC list, numbered, with owners and due dates | 13.1 |
| T-11 | Planning memo and work program reviewed and approved | Audit manager; CAE for high-risk engagements | Approved memo; approved work program; budget confirmed | 13.3 to 13.6 |
| T-10 | Staffing confirmed; specialist or co-source engaged; access requests submitted (systems, buildings, shared drives) | Audit manager | Staffing sheet; access tickets with reference numbers | 13.5 |
| T-9 | Kickoff meeting with sponsor, process owner, and key staff | Engagement lead | Kickoff note; scope confirmed or the disagreement recorded | 13.1 |
| T-8 to T-3 | PBC items arrive and are logged; data populations received and completeness-checked; walkthroughs scheduled with performers | Staff; engagement lead | PBC tracker with received dates; population completeness check documented | 13.6 |
| T-5 | Team briefing: each auditor can explain every procedure they own, its risk, its population, and its evidence | Engagement lead | Briefing note; procedure ownership confirmed on the work program | 13.5 |
| T-2 | Chase outstanding PBC items; escalate to the sponsor anything more than three days late | Engagement lead | Outstanding-items email to the process owner, copied to the sponsor if needed | 13.1 |
| T-1 | Final readiness check: access works, data loads, interview calendar full for week one, workpaper file structure created | Engagement lead | Readiness checklist signed off | 13.5 |
| T-0 | Fieldwork starts with testing, not learning | Team | First walkthrough at 9:00 on day one | — |
Two dates on that table carry most of the risk. The data request at T-14 is the one that slips: full-population extracts from an ERP take a data owner a week when nothing goes wrong, and a second week when the first extract arrives without the fields you asked for. Send it before the work program is final, from the draft, because the population you need is knowable before the sample size is. The PBC list at T-12 is the other; a request list issued at T-12 with staggered due dates arrives before fieldwork, and one issued at T-0 arrives in week two and turns week one into waiting.
The engagement risk assessment, worked
The annual risk assessment decided that the process deserved an engagement; the engagement risk assessment decides what the engagement is about. It is a different exercise at a different altitude: the annual assessment scores auditable entities, the engagement assessment scores the specific things that could go wrong inside one of them, and the scores drive which procedures get hours. Done well it takes two days and a page and a half; done badly it is a list of generic risks copied from a framework, each rated “medium,” which tells the work program nothing.
The method has five inputs: the process objectives (what the process is supposed to achieve, in the owner’s words); what could go wrong against each objective, stated as an event rather than a category (“counts are adjusted without approval,” not “inventory risk”); likelihood and impact scored on a scale the function uses everywhere, with the rationale written next to the score; the controls management says exist, noted rather than assessed, because assessing them is fieldwork; and a residual view that says where the engagement’s hours should go. Fraud gets its own line for every process that handles assets or numbers people are paid on; the fraud red flags library is the prompt list. The worked example below is the FY27 warehouse inventory engagement at MidState Beverage, the site’s running example: a three-state distributor with 12 depots, 300 routes, a 2013 ERP, two acquired distributors not yet integrated, and a six-person audit function that planned 380 hours for the engagement.
| # | Risk (what could go wrong) | Objective affected | Likelihood (1–5) and why | Impact (1–5) and why | Controls management describes | Residual view and hours |
|---|---|---|---|---|---|---|
| R1 | Physical inventory differs from the perpetual record because cycle counts are incomplete or adjustments are posted without investigation | Accurate inventory records; correct cost of sales | 4 — the ERP cycle-count module was disabled at four depots after the FY24 upgrade; counts are done on spreadsheets there | 4 — $18.6M inventory at cost; a 2% error is $370K, above the external auditor’s materiality for the segment | Weekly cycle counts; adjustments over $2,000 approved by the depot manager; month-end reconciliation by HQ | High. Full-population adjustment analytics plus counts at three depots: 140 hours |
| R2 | Product is diverted from depots (theft by staff or drivers) and covered by adjustments, write-offs, or breakage claims | Safeguarding of assets | 3 — FY26 breakage write-offs rose 41% at two depots with no change in volume; the FY26 route cash theft showed how weak detection is at depot level | 4 — loss plus the control environment signal to the board | Driver load-out sheets signed by the warehouse lead; breakage requires a photo and supervisor sign-off; monthly write-off report to the VP Operations | High. Write-off and breakage analytics by depot, route, and approver; load-out sheet testing: 90 hours |
| R3 | Receiving records quantities that were not delivered, or receives against the wrong PO, so payables are overstated and inventory is wrong from day one | Accurate records; valid liabilities | 3 — receiving at nine depots is keyed by the depot clerk, not by a separate warehouse role | 3 — the three-way match relies on it; overstatement rather than loss | Receipt keyed against PO in the ERP; carrier delivery note filed | Medium. Receipt-to-delivery-note sample of 40, weighted to the nine single-clerk depots: 50 hours |
| R4 | Slow-moving and short-dated product is not identified and written down, so inventory is carried above net realizable value | Valuation | 3 — no aging report exists in the 2013 module; the controller runs an annual spreadsheet | 3 — beverages have 6- to 12-month shelf life; the FY26 year-end write-down was $212K | Annual review by the controller; quarterly depot self-report of short-dated stock | Medium. Rebuild an aging from receipt dates for the full population; test the Q4 self-reports: 40 hours |
| R5 | The two acquired distributors count and value inventory on their own systems with unknown methods, and consolidation adjusts blindly | Accurate consolidated records | 4 — nobody at HQ has seen either count procedure | 3 — $2.1M combined inventory | Monthly inventory certification signed by each acquired-entity manager | Medium. One-day site visit to each; walkthrough of the count and the certification: 30 hours |
| R6 | ERP inventory roles allow the same user to receive, adjust, and approve adjustments | Safeguarding; accurate records | 3 — the FY27 user access engagement found role conflicts in route accounting; inventory roles were out of its scope | 3 — enabler of R1 and R2 rather than a loss in itself | Role design reviewed at go-live in 2013 | Medium. Role-conflict analysis for all 84 inventory users: 20 hours |
| — | Reserve for what the walkthroughs find, reporting, and review | — | — | — | — | Planning 30, reporting and review 60, contingency 20: 110 hours; total 380 |
Three things about that table are the method. The likelihood rationale cites a fact each time: a disabled module, a 41 percent rise, a role that was never re-examined. A score without a fact next to it is an opinion, and the audit manager’s challenge at T-18 should be to ask for the fact behind every 4. The impact rationale names a number and what it is compared with, so that “material” means something. And the hours column allocates the budget before the work program is written, which is the only way the work program ends up reflecting the risks rather than the habits of whoever wrote last year’s. When R1 and R2 take 230 of 380 hours, the memo can say why, and the sponsor can disagree with a decision rather than discover one.
Objectives, scope, and the planning memo
The objective is a sentence that says what the engagement will conclude on, written so that the report’s conclusion can be read against it. “To assess whether controls over depot inventory are designed and operating effectively to ensure that inventory records are accurate, product is safeguarded, and inventory is valued at the lower of cost and net realizable value” is an objective; “to review inventory” is a subject. Each objective should trace to the risks in the assessment, and each risk in the assessment should be covered by an objective or explicitly excluded, with the reason.
Scope is the set of boundaries: the process from where to where, the period, the locations and entities, the systems, and the exclusions. The exclusions are the part most memos skip and the part that causes the most trouble later, because an exclusion stated in the memo is a decision and one discovered at the closing meeting is a gap. Write them with the reason: the two acquired distributors are in scope for a walkthrough only because they are on separate systems and the integration engagement covers them in Q3; pricing and margin are out of scope because they belong to the revenue engagement; the period is the twelve months to 30 June because year-end counts fall outside it. Criteria come next: the policies, procedures, standards, and control-design principles the process will be measured against, named by document and version, so that a finding can quote its criterion. Where management has no adequate criteria for a risk, Standard 13.4 requires you to identify suitable ones and say so in the memo, which is where COSO’s 17 principles or an industry practice standard come in.
The memo assembles those decisions into the document the sponsor signs and the assessor reads. The planning memo template gives the full structure with model language; the checklist below is the review test before it goes for approval at T-11.
| Memo element | The test at review | The usual failure |
|---|---|---|
| Background | Quantified: volumes, values, locations, systems, what changed since the last engagement | Two pages of process description with no numbers |
| Why now | States the plan rationale and the sponsor’s concerns, verbatim where possible | “Per the annual audit plan” |
| Risk assessment | Every score has a fact; the hours follow the scores | All risks “medium”; hours split evenly |
| Objectives | One sentence each, conclusion-shaped, traceable to risks | Objectives are activities (“review,” “assess,” “evaluate”) |
| Scope and exclusions | Boundaries with reasons; period and locations stated; exclusions listed | No exclusions; period not stated |
| Criteria | Documents named with versions; gaps filled with named external criteria | “Company policies and best practice” |
| Approach | Procedures summarized by risk with populations and sample sizes | “Interviews, walkthroughs, and testing” |
| Resources and timing | Names, hours per procedure, milestones, specialist needs | Total hours only; no milestones |
| Communication plan | Who gets what, when: status updates, preliminary findings, draft, final | Absent; the sponsor first hears of findings in the draft |
| Approval | Audit manager and, for high-risk engagements, the CAE, dated before T-0 | Approved after fieldwork started |
The work program and the information request list
The work program converts each risk into procedures with a population, a sample or analytic, the evidence expected, and the hours; the work program guide covers the procedure-writing craft and the sample-size guide the sizing. Two preparation rules matter here. First, write the data request from the draft work program at T-14, not from the final one at T-11, because populations are knowable before sample sizes are and the extract takes longest. Second, make every procedure’s owner on the team able to explain it at the T-5 briefing: the risk it addresses, the population, the evidence, and what an exception would look like. An auditor who cannot explain the procedure will test what is convenient.
The information request list is the document that decides whether week one is testing or waiting. It goes out at T-12, numbered, with a named owner and a due date per item, staggered so that the items needed for walkthroughs arrive first. Ask for documents by their real names, as the process owner meeting revealed them, and ask for system reports by report name and parameters. Every item should be traceable to a procedure; an item nobody can trace is a fishing request and will be resented. The list below is the one MidState’s team issued for the inventory engagement; the due dates are relative to T-0.
| # | Item requested | Owner | Due | Procedure it serves |
|---|---|---|---|---|
| 1 | Inventory policy and the depot count procedure, current versions with revision history | Director of Route Accounting | T-8 | Criteria; all |
| 2 | Org charts for warehouse and depot operations, all 12 depots, with vacancies | VP Operations office | T-8 | Interviews; R6 |
| 3 | Inventory balance by depot and SKU at 30 June, at cost, from the ERP (report INV-104) | Controller | T-8 | Populations; R1, R4 |
| 4 | All inventory adjustment transactions, 1 July FY26 to 30 June FY27, with user, approver, reason code, quantity, and value (report INV-221) | IT data owner | T-7 | R1 analytics |
| 5 | Cycle count schedules and completed count sheets for the period, all depots, including the spreadsheet counts at the four depots without the module | Depot managers via Route Accounting | T-7 | R1 |
| 6 | Breakage and write-off log with photos and approvals, by depot, for the period | Director of Route Accounting | T-7 | R2 analytics |
| 7 | Driver load-out sheets for a week to be named at T-3 (we will select the week) | Depot managers | T-3 | R2 testing |
| 8 | Goods receipt transactions for the period with user, PO, and delivery-note reference (report PUR-310) | IT data owner | T-7 | R3 population |
| 9 | Carrier delivery notes for the 40 receipts we select (list issued T-4) | Depot clerks | T-1 | R3 sample |
| 10 | Receipt dates by SKU and depot to rebuild an aging (report INV-118 or an extract with first-receipt date) | IT data owner | T-6 | R4 |
| 11 | The controller’s FY26 year-end short-dated and slow-moving review spreadsheet and the write-down entry | Controller | T-6 | R4 |
| 12 | Q1 to Q4 depot short-dated self-reports | Route Accounting | T-6 | R4 |
| 13 | Monthly inventory certifications from both acquired distributors, all months in the period, with the count procedure each uses | Integration lead | T-5 | R5 |
| 14 | ERP inventory role definitions and user-role assignments for all inventory users (84 expected) | IT security | T-6 | R6 |
| 15 | Month-end depot inventory reconciliations, HQ to depot, for the period, with preparer and reviewer | Controller | T-5 | R1 |
| 16 | Prior-year external audit management letter points on inventory and their status | Controller | T-8 | Background |
| 17 | Open internal audit issues on inventory from the issue log, with current status | Internal audit (own) | T-8 | Background |
| 18 | Inventory insurance claims and police reports for the period, if any | Risk manager | T-5 | R2 |
| 19 | Depot layouts and access control lists (badge access to warehouse areas) | Facilities | T-4 | R2 site visits |
| 20 | Cycle-count module configuration and the FY24 upgrade change record that disabled it at four depots | IT | T-5 | R1 cause |
| 21 | Management information pack pages on inventory sent to the executive team for the last six months | FP&A | T-5 | Reporting controls |
| 22 | Vendor delivery schedules for the three depots to be visited (for planning counts) | Purchasing | T-3 | Site visits |
| 23 | Names and availability of depot managers and warehouse leads at the three visit depots for the week of T+5 | VP Operations office | T-4 | Logistics |
| 24 | ERP read-only access for the two auditors named (ticket reference) | IT security | T-6 | All |
| 25 | Warehouse safety induction requirements and PPE for site visits | Facilities | T-4 | Logistics |
Log every item as it arrives, with the date, and check the populations for completeness on receipt rather than in week two: row counts against a control total, value against the ledger, period boundaries against the request. An extract that is short by a month, discovered on day eight, costs the engagement a week; discovered at T-6 it costs an email. The IPE testing guide covers what “complete and accurate” means for a system report you intend to rely on.
The kickoff meeting: agenda and script
The kickoff is not where scope is discovered; by T-9 the memo is approved and the request list is out. It is where the sponsor and the process owner hear the scope from you, in one room, and either confirm it or disagree on the record. Forty-five minutes is enough. Invite the sponsor, the process owner, the people who will host the walkthroughs, and the person who owns the data extracts; do not invite the whole department, because a kickoff with twenty people produces no disagreement and no information. Send the agenda two days ahead with the scope paragraph from the memo attached, so that nobody is reading it for the first time in the meeting.
| Minutes | Item | What you are trying to get |
|---|---|---|
| 0–5 | Why this engagement, why now, in the plan’s words and the sponsor’s | Shared understanding that the engagement is about the sponsor’s risks, not audit’s habits |
| 5–15 | Objectives, scope, period, locations, exclusions, criteria | Explicit confirmation or explicit disagreement, recorded either way |
| 15–25 | Approach: what will be tested, which populations, which sites, what analytics will run on their data | No surprises later; the owner knows a full-population adjustment analysis is coming |
| 25–32 | Timeline: fieldwork dates, status updates, preliminary findings meeting, draft and final report dates, who gets each | Agreement on the communication plan from Standard 13.1 |
| 32–38 | Requests: the PBC status, the outstanding items, the walkthrough schedule, access | Named owners and dates for anything late |
| 38–43 | How findings are handled: facts cleared with performers, ratings against the published scale, management responses in the report, tracking in the issue log | The owner knows the rules before the first finding exists |
| 43–45 | Questions and the one thing each attendee wants the engagement to answer | Three sentences that go into the memo’s sponsor-concerns section if they are new |
Opening. “This engagement is on the FY27 plan because inventory is $18.6 million at cost across twelve depots, four of them count on spreadsheets since the upgrade, and breakage write-offs at two depots rose 41 percent last year without a volume change. Those are the three things the board’s risk assessment flagged. The objective is to conclude on whether the controls over depot inventory are designed and operating to keep the records accurate, safeguard the product, and value it correctly. We are not looking at pricing or margin; that is the revenue engagement in November.”
Scope confirmation. “The period is the twelve months to 30 June. We will visit Dayton, Columbus, and Fort Wayne in the week of the 14th; the other nine depots are covered by the analytics on the full adjustment and write-off populations, and by the reconciliation testing. The two acquired distributors get a one-day walkthrough each, not testing, because the integration engagement covers them in Q3. Is there anything in that scope you would draw differently, and is there a risk you would add?”
Approach. “Three things to know in advance. We will run analytics on every adjustment posted in the period, so if a depot has a pattern, we will see it before we visit. We will select the load-out week ourselves and tell you three days ahead. And we will count a sample at each visited depot on the day we arrive, unannounced as to which SKUs, so please do not prepare a count for us.”
How findings work. “When we find something, the first conversation is with the person who performs the step, about the facts, and the second is with you, before anything is written as a finding. Ratings follow the scale in the appendix, which you have seen. Your response goes into the report verbatim, and where we disagree, both positions are in the report. Nothing reaches the audit committee that you have not seen first.”
Closing. “Before we finish: what is the one thing you would want this engagement to tell you that you cannot find out yourself?”
The last question produces the best material in the engagement about a third of the time. Depot managers have said “whether the breakage rule is being gamed at Toledo” and “whether my counts are worse than everyone else’s or the module is wrong,” both of which became procedures. Record the answers verbatim in the kickoff note and add any new risk to the memo with a note that it came from the kickoff; an assessor reading the file should see that the risk assessment was still alive at T-9.
Staffing, budget, access, and logistics
Standard 13.5 asks for resources appropriate to the objectives and scope, and the honest test of that is whether the hours in the work program foot to the budget and the people on the engagement can do the procedures assigned to them. Match skills to risks rather than availability: the auditor who has never run a population analytic should not own R1, and the one who has never been in a warehouse should not lead the site counts. Where the function lacks a skill, the decision to bring in a specialist or a co-source partner is made at T-10, not in week two; the co-sourcing guide covers how to scope a specialist’s piece so it integrates with your file rather than arriving as a separate report.
| Role | Person | Procedures owned | Hours | Skill check |
|---|---|---|---|---|
| Engagement lead (senior) | Senior auditor A | Risk assessment, memo, R1 analytics design, R5 site visits, reporting | 150 | Has run full-population analytics; led two prior inventory engagements |
| Staff auditor | Auditor B | R1 count testing at three depots, R3 receipt sample, R4 aging rebuild | 120 | Comfortable in the ERP; needs a half-day on the aging query with A |
| Staff auditor | Auditor C | R2 write-off analytics and load-out testing, R6 role analysis | 70 | Ran the FY27 route-accounting SoD analysis; reuse the query |
| Audit manager | Manager D | Review at T-11, T-5, week two, and draft; sponsor relationship | 30 | — |
| Specialist | None needed | — | 0 | Inventory valuation is within the team’s competence; no co-source |
| Contingency and admin | — | Travel, delays, the walkthrough surprise | 10 | — |
| Total | 380 | Foots to the plan |
Access is the logistics item that fails silently. Submit system access requests at T-10 with the specific roles (read-only inventory, read-only purchasing, report execution), because a generic “auditor access” request comes back as whatever IT last gave an auditor, and confirm on T-1 that each login works by running the report you will need on day one. Physical access to depots needs badges, safety inductions, and PPE, all of which have lead times, and a count at a depot needs the depot manager to know the day but not the SKUs. Book the walkthrough performers at their desks, in transaction order, for the first three days of fieldwork; the walkthrough guide explains why you walk with the clerk and not the owner. Create the workpaper file structure before T-0 from the work program’s numbering, so that every procedure has a home on day one; the workpaper best practices guide gives the indexing convention.
What auditees will ask, and how to answer
The questions below arrive in the sponsor meeting, the kickoff, and the corridor. Each has a good answer and a bad one, and the bad ones are usually the reflexive ones. Answer plainly, in the first person, and never with “that’s our methodology,” which is the phrase that ends cooperation.
| What they ask | What they mean | What to say |
|---|---|---|
| “Why us, why now?” | Am I being singled out? | The plan rationale in one sentence with the numbers, and the fact that the process was last audited three years ago. Never “it came up in the rotation.” |
| “How long will this take my team?” | What will it cost me? | A real estimate: the request list is 25 items, the walkthroughs are six people for 45 minutes each, the site visit is two days with one host. Then keep to it. |
| “Can you use the counts we already do?” | Please do not duplicate our work. | Yes, as evidence of the control operating, and we will also count ourselves, because the objective includes whether the records are right, which only an independent count answers. |
| “We already know the module is off at four depots. Do you have to write that up?” | Can known problems be exempt? | A known problem with an approved remediation plan is reported as such, with the plan; a known problem with no plan is a finding. Tell me which one this is. |
| “Who sees the report?” | How much exposure is this? | The distribution list from the memo, by name, and the fact that they will see your response next to every finding. |
| “What if we disagree with a finding?” | Do I have any say? | Facts are cleared with your people before anything is written; ratings follow the published scale; if we still disagree, both positions go in the report and the audit committee decides. |
| “Can we see the findings before the closing meeting?” | I do not want to be ambushed. | Yes: preliminary findings weekly during fieldwork, in writing, and the full list before the closing meeting. That is the communication plan in the memo. |
| “Why do you need the whole population? Just take a sample.” | That extract is a lot of work for IT. | Because a sample of 40 adjustments tells us about 40 adjustments; the population tells us which depot has a pattern, and that is the question the board asked. The extract is one report with four parameters; we have named it. |
| “Is this about the theft last year?” | Is this an investigation? | No. The FY26 loss is background, and this engagement tests whether the controls would catch the next one. If we find evidence of a specific loss, it goes to the General Counsel under the charter, not into the report as a finding about a person. |
| “Can we move it to next quarter? Year-end is busy.” | Please go away. | The timing was set in the plan the audit committee approved; I can move the site visits by a week to avoid the count week, and I will tell the CAE you asked. A change of quarter needs the sponsor and the CAE. |
When management pushes back on scope
Pushback is information. A sponsor who wants a location out of scope, a period shortened, or a risk dropped is telling you something about that location, period, or risk, and the first response is to ask why in a way that lets them answer honestly. Some reasons are good: the depot is closing in October, the system is being replaced in Q3, the risk belongs to another engagement already on the plan. Some are not, and the difference is whether the reason is about the organization’s interests or the sponsor’s comfort. Either way, the decision belongs to internal audit under its charter, the reason and the decision go in the memo, and the sponsor sees both. What never happens is a scope change made verbally in a kickoff and discovered by the CAE in the draft report.
| The pushback | Reasonable response | The line you hold |
|---|---|---|
| “Leave the acquired distributors out; integration is handling it” | Confirm the integration engagement’s scope and timing in writing; reduce to a walkthrough with a stated hand-off | A risk on the annual assessment is covered by someone, somewhere, this year, in writing |
| “Don’t visit Toledo; the manager is new” | Ask what the previous manager left; a new manager is a reason to visit, not to skip | Location selection is audit’s, based on risk indicators, and the indicators say Toledo |
| “Use a three-month period; the earlier data is messy” | Ask what “messy” means; a system conversion in the period is a scope note, not an exclusion | The period covers a full cycle unless a documented event makes earlier data unreliable, in which case the unreliability is itself reported |
| “Don’t run analytics on adjustments; it will look like an investigation” | Explain the difference: a population analytic is a test of a control’s operation, reported at process level; a named-person pattern goes to counsel under the charter | Full-population testing of the risk rated highest in the assessment is not negotiable |
| “We’ll fix the module before you start, so drop R1” | Good; test the fix as an implemented action and keep the period’s exposure in scope | Remediation during the engagement is reported as remediation, not as absence of a problem |
| “The CFO wants revenue in scope too” | Explain the budget arithmetic; offer a scoped addition with hours from contingency or a separate engagement | Scope creep without hours produces two half-engagements; the CAE decides plan changes |
When a pushback is accepted, write the exclusion into the memo with the reason and the name of the person who requested it, and where it removes coverage of a risk on the annual assessment, tell the CAE at the time, because the annual plan’s coverage statement to the audit committee just changed. When it is refused, record that too. The memo’s exclusion section is the audit trail of every one of these conversations, and it is the section an external assessor reads to see whether the function’s independence is real.
Common preparation failures
| Failure | What it looks like | Why it matters | Fix |
|---|---|---|---|
| Last year’s memo with the dates changed | Objectives, scope, and risks identical to the prior engagement; no “what changed” section | The engagement tests the process that existed three years ago; new systems and new people are missed | Desk research at T-28 produces a written “what changed” list before the risk assessment starts |
| Generic risk assessment | Ten risks from a framework, all rated medium, no facts | Hours are spread evenly; the risks that matter get the same 30 hours as the ones that do not | A fact behind every score; hours allocated by score before the work program is written |
| Request list issued at T-0 | Week one is spent waiting; the team “gets an understanding” instead | A quarter of the budget produces no evidence | PBC at T-12 with staggered due dates; data request at T-14 |
| Populations not checked on receipt | The adjustment extract is missing two depots; nobody notices until the analytics look odd in week two | A week lost, and a sample drawn from an incomplete population is worthless | Row counts and value totals against a control total on the day the extract arrives |
| Kickoff as discovery | Scope is worked out in the meeting; the memo is written afterward to match | The sponsor sets the scope; the memo is a record, not a decision | Memo approved at T-11; the kickoff confirms it |
| Staffing by availability | The analytic is owned by the auditor who is free, not the one who can do it | The highest-rated risk gets the weakest test | Skills-to-risks matching at T-10; a skill gap is a co-source decision, not a hope |
| Verbal scope changes | A location dropped in a corridor conversation; the CAE learns from the draft | Coverage reported to the committee is wrong; independence looks negotiable | Every scope change written into the memo with reason and requester; CAE told at the time |
| No communication plan | The sponsor first hears of findings in the draft report | The closing meeting becomes a negotiation about surprises rather than a discussion of facts | Weekly written status; preliminary findings in writing; the plan in the memo and the kickoff |
| Access assumed | ERP login fails on day one; badge for the depot not issued | Days lost, and the auditee sees a team that was not ready | Access requests at T-10; every login tested at T-1 |
Adapting the sequence: small functions, co-sourcing, remote, regulated
Small functions and one-person shops
A one- or two-person function runs the same sequence with the same outputs and fewer meetings. The risk assessment is still a scored table, but it is a page; the memo is still approved before fieldwork, by the CAE who wrote it, with the audit committee chair copied for high-risk engagements as a substitute for a second reviewer; the request list is still numbered and dated. What a small function cannot do is compress the runway. The data request still takes IT a week, the PBC still takes the owner ten days, and a solo auditor who issues them at T-0 has nothing to do for two weeks. The small-company internal audit guide covers how a new function builds the templates once so that preparation is a fill-in rather than a rewrite.
Co-sourced and specialist engagements
When a co-source partner or a specialist owns part of the work, preparation includes a scoping document for their piece that names the procedures, the evidence standard, the workpaper format, the review process, and the dates, and it is agreed at T-10. The partner joins the T-5 briefing and the kickoff. What goes wrong is the partner running their own methodology in parallel and delivering a separate report in week four that has to be reconciled to yours; the fix is one work program, one file, one report, and the partner’s procedures numbered inside it.
Remote engagements
Remote preparation front-loads evidence. Everything that would be picked up in a site visit, the shared-drive spreadsheet, the count sheets in a binder, the badge list on the wall, has to be requested by name, so the process-owner meeting at T-23 becomes an inventory of where records physically live. Walkthroughs are scheduled with screen sharing of the live application and recorded with consent. Counts, cash, and custody steps are not remote; if the engagement’s risks include them, a site visit goes in the plan or the objective is narrowed and the memo says why.
Regulated entities and ICFR support
In a bank or insurer the preparation sequence gains a step: the regulatory expectations for the area, from examination manuals and outstanding supervisory findings, become criteria alongside management’s policies, and the memo maps them. The financial services guide sets out what examiners expect the third line’s planning file to show. For engagements that support the SOX program, the population and period decisions have to line up with management’s assessment timeline and the external auditor’s reliance plan, which means the T-24 sponsor meeting includes the SOX lead; the SOX scoping guide covers the mechanics.
Where preparation ends
Preparation ends when the first walkthrough starts, and the measure of whether it worked is the week-one status report. A prepared engagement’s first status report lists procedures completed and preliminary observations. An unprepared one lists documents received. From there the sequence continues into fieldwork with the walkthrough template, the evidence standards, the rating scale the kickoff promised, and the report whose objectives are the ones written at T-17. Every guide on the site is indexed on the Topics page.
Related guides
- The engagement planning memo template — the document this sequence produces, with model language
- The annual audit plan template — where the engagement came from
- The internal audit work program — procedure-writing craft and a worked example
- Internal audit risk assessment — the annual assessment that feeds engagement selection
- Audit sample sizes — sizing the samples the work program calls for
- GIAS Domain V: performing engagements — Standards 13.1 to 13.6 traced through an engagement
- Audit walkthroughs — the first thing fieldwork does
- What to expect during an internal audit — the auditee’s side of the same engagement
- All Guides — the full index
Leave a Reply