The first engagement you run is the first time you are responsible for an outcome rather than a task. The plan is yours to keep, the budget is yours to burn, the auditee relationship has your name on it, and the work you used to do is now being done by someone else, slower and differently. Most new in-charges do the work themselves for the first three weeks, fall behind on the plan, and discover in week five that they have been doing two jobs badly. This playbook is for the staff-to-lead leap: owning the plan, directing work you used to do, the daily rhythm that keeps an engagement on its rails, managing the auditee as the face of the audit, and the mistakes every first-time lead makes at least once. It assumes you are leading a conventional process or controls engagement of 300 to 600 hours with one to three staff; the same shape scales.
In this guide
- What changes when you are in charge
- Owning the plan: budget, milestones, scope discipline
- Directing work you used to do
- The daily and weekly lead rhythm
- Managing the auditee relationship as the face of the audit
- Working with your manager as an in-charge
- Reviewing as a lead: fast and developmental
- Owning the report
- The first-engagement mistakes, in order of frequency
- The in-charge’s week-one checklist
- Worked example: a first in-charge at Brightwater Foods
- Frequently asked questions
- Related guides
What changes when you are in charge
As a senior you were measured on the quality and timeliness of your workpapers. As an in-charge you are measured on the engagement: did it deliver what the plan promised, on budget, with a report the manager could issue and an auditee who would work with the function again. Every one of those outcomes depends on other people, which is the change.
| Dimension | As a senior | As in-charge | What catches people out |
|---|---|---|---|
| Unit of accountability | The workpaper | The engagement | Nobody tells you the unit changed; you keep polishing workpapers while the engagement drifts |
| Time | Your own hours | The team’s hours against a budget | Your own productivity no longer moves the number much |
| Quality | Your work, reviewed by someone else | Everyone’s work, reviewed by you before the manager sees it | You are now the first reviewer and the last line before the manager |
| Relationship | One or two control owners | The sponsor, the main contact and every control owner | The sponsor expects to hear from you, not from your manager |
| Information | Told what to do | Deciding what the team does next, every day | Decisions you used to escalate are now yours |
| Visibility | Low; your manager carried the engagement | High; the manager, the sponsor and the function see the engagement through you | The first slip is public |
The shift is from doing to deciding. A good senior who becomes an in-charge and keeps doing will produce excellent workpapers on an engagement that is late, over budget and unreported, because the deciding did not happen. The hardest part of the leap is tolerating the discomfort of watching work you could do faster being done more slowly by someone else, while you spend the saved time on the things only you can do: the plan, the relationship, the review and the report.
Owning the plan: budget, milestones, scope discipline
The engagement plan you inherit from the planning memo is a promise made to the sponsor and the audit committee about scope, hours and dates. Owning it means three things: converting the budget into a schedule, breaking the schedule into milestones you can see slipping, and defending the scope against the forces that will try to change it.
| Element | What ownership looks like | Tool | Early-warning sign |
|---|---|---|---|
| Budget | Hours allocated by phase and by person before fieldwork starts; tracked weekly against actuals | A one-page budget table: phase × person, planned vs actual, remaining | Week-two actuals above 30% of budget with fieldwork less than 20% complete |
| Milestones | Six to eight dated checkpoints: planning memo issued, PBC received, walkthroughs complete, testing 50%, testing complete, findings agreed, draft report, closing meeting | A milestone line in the status note | Any milestone missed by more than three working days |
| Scope | The scope statement from the memo, re-read weekly; changes only by agreement with the manager and the sponsor | A scope-change log, even if empty | Requests to “just look at” something adjacent; evidence requests that drift outside the scope |
| Test plan | The work program with each step assigned, dated and sized | The work program with owner and hours columns | Steps with no owner in week two |
| Risks to delivery | Named in week one: a key contact’s holiday, a system cutover, a co-source dependency | Three lines in the planning memo | Surprises that were foreseeable |
The budget table is the instrument most first-time leads skip, because it looks like administration. It is the only early warning the engagement has. An engagement burns most of its hours in testing, and testing starts late; by the time the overrun is obvious it is unrecoverable. A lead who looks at the table every Friday knows by week two whether the plan will hold and can re-plan while re-planning is cheap: tighten a sample, drop a non-key control with the manager’s agreement, or ask for hours before they are spent. The guide to audit fieldwork week by week describes the phase shape; the budget table makes it visible.
Scope discipline is the other half. Everyone involved in an engagement has a reason to change its scope: the sponsor wants a pet problem looked at, a control owner wants an area excluded, your own staff find something interesting next door. The rule is simple and must be held from day one: the scope is what the memo says, changes are agreed with the manager and recorded, and anything interesting outside scope goes in a note for the next plan. The scoping memo guide explains how scope is set; the lead’s job is to keep it set.
One habit protects the plan more than any other: the lead keeps a short running list of things that would have been nice to look at but are not in scope, and hands it to the manager at the end as input to next year’s plan. The list is where the sponsor’s pet problem, the staff auditor’s interesting adjacent finding and the lead’s own curiosity all go, so that none of them lands in the engagement. It also makes the lead look thoughtful rather than rigid when declining a scope change, because the request is being recorded rather than refused.
Directing work you used to do
Delegation guilt is real and it has a mechanism: you know the test takes you four hours, you watch it take a staff auditor nine, and every instinct says to take it back. Taking it back is the single most common first-engagement failure, because it converts the lead into the most expensive staff auditor on the team and leaves the engagement without a lead. The craft is in how work is handed over.
| Handover element | Weak version | Strong version | Effect |
|---|---|---|---|
| The what | “Test the user access review” | The program step, the population, the sample basis, the attributes, the expected evidence, the workpaper template | The staff auditor can start without a second conversation |
| The why | Omitted | “This control is key because it is the only one that catches leavers; the exception we would worry about is an active account for a terminated user” | Judgment transfers; exceptions get recognised |
| The how much | Omitted | “Nine hours. If you are past six and not halfway, tell me” | Overruns surface at hour six, not hour fifteen |
| The when | “When you can” | “Draft by Thursday noon so I can review before the Friday status” | The engagement rhythm holds |
| The check-in | None until the workpaper arrives | A five-minute look at the first two items tested | Misunderstandings cost two items, not twenty-five |
| The standard | Assumed | A model workpaper from a prior engagement | Review comments fall by half |
The early check-in is the lever. A lead who looks at the first two sample items a staff auditor has tested, before they test the other twenty-three, catches the misread program step or the wrong population at a cost of ten minutes. A lead who waits for the finished workpaper catches it at a cost of a day. The review comments guide, written for the staff side, describes what a well-handed-over task looks like from below; the staff auditor who gets the why and the standard up front submits workpapers that come back with four comments instead of twenty.
Two more rules of direction. Give the interesting work away: a lead who keeps the analytics and the judgment-heavy tests for themselves and hands out the attribute testing has a bored team and a bottleneck. And match the person to the task deliberately: the auditor from depot finance understands the depot process; the one with the SQL course gets the population analytic. The manager’s portfolio guide covers the same allocation question one level up.
The daily and weekly lead rhythm
An engagement runs on its lead’s rhythm. The rhythm is a small set of recurring activities that take an hour or two a day and keep the plan, the team and the auditee aligned; when it lapses, the engagement drifts in days.
| Cadence | Activity | Duration | Output |
|---|---|---|---|
| Daily, morning | Stand-up with the team: what each person finishes today, what is blocking them, what evidence is outstanding | 10 minutes | Blockers you can clear today |
| Daily, as it arrives | First-look review of completed work; clear the quick comments; route the judgment questions to a conversation | 30–60 minutes | No workpaper waits more than a day for first review |
| Daily, afternoon | Auditee contact: evidence chasing, walkthrough scheduling, early discussion of any exception found | 20 minutes | No exception reaches the closing meeting unannounced |
| Daily, end | Update the exception log and the findings skeleton; note anything the manager needs to know tomorrow | 15 minutes | The report is being written from week one |
| Weekly, Friday | Budget and milestone check; status note to the manager and the sponsor | 45 minutes | A written record of plan vs actual; early re-planning |
| Weekly | One substantive conversation with the main contact that is not about evidence | 20 minutes | Relationship capital; early warning of what the business is worried about |
| Weekly | Team retrospective: what slowed us down, what to change next week | 15 minutes | Problems surface at week two, not in the post-mortem |
The status note deserves its own rule: it goes to the manager and the sponsor every Friday whether or not anything has changed, in the same format, and it contains the budget position, the milestones, the exceptions found so far in neutral language, and the one thing the lead needs from each reader. A sponsor who has read five Friday notes knows what the report will say before the draft arrives, which is how no surprises is achieved in practice rather than in principle.
Managing the auditee relationship as the face of the audit
To the business, you are now internal audit. The sponsor will judge the function by your opening meeting, your evidence requests, your handling of the first exception and your closing meeting, and the manager’s later involvement will not change the impression you created. The relationship has four moments that matter disproportionately.
- The opening meeting. You run it. The scope, the timetable, the evidence process, the escalation route and what happens when an exception is found are all stated by you, and the sponsor leaves knowing who to call. The opening meeting guide has the script.
- The evidence request. A PBC list issued complete, early, with the reason for each item and a realistic date, is the most visible competence signal in the engagement; a trickle of requests is the most visible incompetence signal. The auditee’s experience of a badly run request process is described in the PBC survival guide, and every lead should read it once from that side.
- The first exception. How you handle the first thing that is wrong sets the tone for every later finding. The rule is the same as the function’s: the control owner hears about it from you, in person, with the facts and no conclusion, before anyone else does. The handling test exceptions guide covers the technical question of what an exception means; the relationship question is simply who hears first.
- The closing meeting. No surprises, agreed facts, causes established with the owner, and a conversation about remedies rather than a presentation of findings. The closing meeting playbook covers it; the lead’s job is to have made it boring by then.
Between those moments, the weekly conversation that is not about evidence is where the relationship is built. A lead who asks the main contact what the business is worried about this month, and listens, will find the engagement’s scope better aimed and its findings better received. The trusted advisor guide explains why this matters over years; at engagement level it matters in weeks.
Working with your manager as an in-charge
The relationship above you changes as much as the one below. As a senior you received direction; as an in-charge you supply information and ask for decisions. Managers of first-time leads consistently describe the same two wishes: tell me early, and bring me a choice.
| Situation | What a new in-charge tends to do | What the manager wants | Form |
|---|---|---|---|
| Budget slipping at week two | Work harder and hope | A re-plan proposal: “tighten sample X, drop control Y, or add 20 hours; I recommend X” | Friday note, decision requested |
| Sponsor pushing on scope | Agree, then worry | “The sponsor asked for Z; it is outside the memo; I said it goes in the next-plan note unless you want it in” | Same day, two lines |
| A significant exception | Wait until certain | “We have found what looks like X; owner told; facts being confirmed; you should know before the sponsor calls you” | Same day, by phone if High |
| A staff auditor struggling | Quietly redo their work | “A is at 14 hours on a 9-hour test; I have checked the first items and re-briefed; may need to re-assign if not back on track by Wednesday” | Friday note or earlier |
| Emerging ratings | Present at the end | “At 50% testing I see two Mediums and a possible High; here is the rule applied” | Mid-engagement conversation |
| Something you do not know how to do | Guess | “I have not scoped a MUS sample before; can we spend twenty minutes?” | As soon as known |
The manager who is told early can help; the one who is told late can only absorb. First-time leads who adopt the “early and with a choice” habit find that their managers delegate more to them on the next engagement, because the manager has learned that nothing will arrive as a surprise. The difficult conversations guide has scripts for the harder versions of these exchanges, including telling a manager that the plan they signed will not hold.
Reviewing as a lead: fast and developmental
First review is now yours, and it has two purposes that pull against each other: catching the problems before the manager does, and teaching the staff auditor so that the problems stop recurring. Leads who optimise for the first produce clean files and discouraged teams; leads who optimise for the second produce developed staff and a manager who finds the problems instead. The balance has a method.
- Review in order. Program step matched, stranger could follow it, evidence supports the result, exceptions flow to the log, conclusion holds. Stop at the first failure and send it back; a judgment review of a workpaper that fails the form check is wasted.
- Write comments as questions a future reader would ask, not as instructions. “Source?” teaches the standard; “add the source” teaches obedience.
- Batch the pattern. If a workpaper has twelve comments of one kind, write one comment that names the rule and lists the instances. The staff auditor learns a rule, not twelve corrections.
- Talk through judgment comments. Anything about cause, significance or conclusion is a five-minute conversation, not a written comment; the conversation is where the staff auditor learns to think.
- Clear fast. A workpaper waiting three days for first review stalls the auditor and the plan; same-day first look is the standard.
- Keep the count. Comments per workpaper per person, over the engagement. Falling counts are the evidence of development you will cite at appraisal time; flat counts tell you to change how you are handing over.
The guide to review notes done right covers the reviewer’s craft in full. The lead’s particular constraint is time: with three staff producing workpapers and a sponsor expecting a Friday note, the review method has to be quick, which is why reviewing in order and stopping at the first failure matters more for a lead than for a manager.
Owning the report
The report is not written after fieldwork; it is assembled during it. A lead who keeps a findings skeleton from the first exception (condition, criteria, cause as understood, effect as estimated, owner, status of discussion) arrives at the end of testing with a draft that needs editing rather than writing. The anatomy of an internal audit report and the five C’s guide set the structure; the lead’s discipline is in timing.
| When | Report activity | Why then |
|---|---|---|
| Week one | Report shell created from the template; scope and background sections drafted from the memo | They do not change; writing them now removes them from the end |
| Each exception | Finding skeleton started; owner told; cause explored | Causes are easier to establish while the evidence is fresh and the owner is engaged |
| Testing 50% | Emerging findings discussed with the manager; ratings sketched against the rule | The manager’s view shapes the remaining fieldwork |
| Testing complete | Findings drafted in full; facts confirmed with owners | The closing meeting needs agreed facts |
| Closing meeting | Causes and required outcomes agreed; owners drafting actions | Ownership transfer, per getting recommendations adopted |
| Within five days of closing | Draft report to the manager | Timeliness is the reliability metric management notices most |
The first-engagement mistakes, in order of frequency
| Mistake | Why it happens | Cost | Prevention |
|---|---|---|---|
| Doing the work instead of directing it | Delegation guilt; it is faster to do it yourself | The engagement loses its lead; the budget overruns in testing | Hand over with the why, the how much and the early check-in; give the interesting work away |
| Not tracking the budget until it is gone | The table looks like administration | Overrun discovered at 90% spent | The Friday table, from week one |
| Letting the PBC list trickle | Requests made as the need arises | The auditee experiences chaos; evidence arrives late | Complete list at the opening meeting, with reasons and dates |
| Accepting scope creep to please the sponsor | Wanting to be helpful; not knowing how to say no | The report covers more and concludes less; the budget breaks | The scope-change log; “that goes in the note for the next plan” |
| Surprising the control owner with an exception | Waiting until the facts are “certain” | The closing meeting becomes a dispute | Owner hears first, in person, with facts and no conclusion |
| Reviewing late | Review feels less urgent than fieldwork | Staff stall; the manager finds what you should have | Same-day first look; review in order |
| Writing the report at the end | Habit from being a senior | Three late weeks and a draft the manager rewrites | The skeleton from the first exception |
| Status by exception | Nothing changed, so no note | The sponsor and manager lose sight; the first surprise is public | The Friday note, every Friday |
| Not asking for help | Fear that asking looks like failing | A recoverable problem becomes unrecoverable | The manager would rather hear at week two; say so in week one |
The in-charge’s week-one checklist
1. Planning memo re-read; scope statement copied to the top of my status note template.
2. Budget table built: phase × person, planned hours; actuals column ready.
3. Milestones dated: memo, PBC received, walkthroughs, testing 50%, testing complete, findings agreed, draft, closing.
4. Work program steps assigned, sized and dated; model workpaper identified for each test type.
5. PBC list complete, with reasons and dates; issued at or before the opening meeting.
6. Opening meeting run by me; sponsor knows the scope, the timetable, the escalation route and what happens when we find something.
7. Delivery risks named: holidays, cutovers, dependencies.
8. Daily stand-up and Friday note in the calendar for the whole engagement.
9. Report shell created; scope and background drafted.
10. Told the manager when I will ask for help, and that I will.
Week-one checklist for a first-time in-charge
Worked example: a first in-charge at Brightwater Foods
Brightwater Foods is a $180 million food manufacturer with three plants and about 600 staff. Its first chief audit executive, hired after the board formed an audit committee, rebuilt the co-sourced function and got a second in-house auditor funded in year one and a third approved for FY28. The second hire, a senior from a regional firm, ran her first engagement as in-charge on the FY28 fixed assets audit: 260 hours, 4,300 assets with a net book value of $61 million, one in-house staff auditor and 60 hours of co-source analytics.
Her first two weeks followed the senior’s reflex. She did the capitalisation testing herself because she knew it, handed the physical verification to the staff auditor with the instruction “pick 180 and go find them”, and did not build the budget table. At the end of week two, 38 percent of the hours were spent, the verification sample had been selected without reference to the asset register’s location field (which was blank for 214 assets, a fact that became a finding), and the plant controller had received eleven separate evidence requests. The CAE’s Friday question, “where are we against the plan?”, had no answer.
The recovery was the playbook. She built the table that weekend and found that testing had 120 hours left against 160 planned; she re-planned with the CAE’s agreement, tightening the repairs-and-maintenance sample from 60 to 40 and dropping a non-key control. She re-issued the PBC list as one document with reasons, and apologised to the controller for the trickle. She handed over the remaining tests with the why (“the exception we care about is an asset on the register that nobody can find; that is a Medium if it is more than a handful”), the hours, and a first-two-items check, and gave the staff auditor the idle-line analysis because he had asked a good question about it. She started a findings skeleton the day the first unlocated assets appeared and told the plant controller the same afternoon, before the count was finished.
The engagement finished at 268 hours against 260, with seven findings (four Medium, three Low), a report issued six working days after the closing meeting, and a controller who told the CAE the second half had been “like a different audit”. The 214 assets with unknown locations, the nine of 180 sampled that could not be found, the two idle construction-in-progress projects and the $912,000 refrigeration upgrade with $41,000 wrongly expensed all went into the report as the fixed assets guide describes. The lead’s own retrospective listed three lessons: build the table before the first hour is spent, issue the list once, and hand over the why. Her second engagement, the FY28 third-party resilience review, ran to budget from week one.
Frequently asked questions
What is the biggest change when you lead your first audit engagement?
The unit of accountability moves from the workpaper to the engagement: scope, budget, timetable, team output, the auditee relationship and the report are now outcomes you own, and all of them depend on other people. The hardest adjustment is directing work you could do faster yourself.
How do I stop doing the work and start leading it?
Hand over properly: the program step, the population and sample basis, the expected evidence, the why (which exception matters), the hours, the date, and a model workpaper; then check the first two items tested rather than waiting for the finished workpaper. Give the interesting work away so the team is engaged and you are not the bottleneck.
How do I keep an audit engagement on budget?
Build a phase-by-person hours table before fieldwork, record actuals every Friday, and re-plan while it is cheap: tighten a sample, drop a non-key control with the manager’s agreement, or ask for hours before they are spent. Overruns discovered at 90 percent spent are unrecoverable; at week two they are a conversation.
What should a first-time in-charge do in week one?
Re-read the planning memo and fix the scope; build the budget table and date the milestones; assign, size and date every program step; issue a complete PBC list with reasons; run the opening meeting yourself; name the delivery risks; put the daily stand-up and the Friday status note in the calendar; create the report shell.
How should an in-charge handle the first exception found?
Tell the control owner in person, with the facts and no conclusion, before anyone else hears; start the finding skeleton the same day; explore the cause while the evidence is fresh. The way the first exception is handled sets the tone for every later finding and for the closing meeting.
What are the most common mistakes new audit leads make?
Doing the work instead of directing it, not tracking the budget until it is spent, letting the evidence request trickle, accepting scope creep, surprising the control owner, reviewing late, writing the report at the end, sending status only by exception, and not asking for help until the problem is unrecoverable.
Related guides
- Audit fieldwork — what happens, how to run it week by week, what good looks like.
- The engagement planning memo template — eight sections mapped to GIAS 13.1 to 13.6.
- The internal audit work program — the template, two worked programs and a change log.
- The audit opening meeting — scripts and stagecraft for starting an engagement right.
- The audit closing meeting playbook — no surprises, no ambushes, no retreat.
- Audit review notes done right — giving, receiving and clearing them.
- How to receive review comments — the staff side of the exchange.
- Managing multiple concurrent audits — the portfolio view from the manager’s chair.
- The internal audit career ladder — staff to CAE, level by level.
Leave a Reply