An engagement partner copies last year's audit plan into the new file and sends staff to fieldwork. Three weeks in, the team finds a new enterprise resource planning (ERP), a divested subsidiary, and revenue up $22 million on flat headcount. Last year's plan is wrong in every way that matters.
The audit strategy gives scope, timing, and direction. The engagement plan is the next layer. AU-C 300 requires you to document the planned nature, timing, and extent of risk assessment procedures, further audit procedures (tests of controls + substantive), and other procedures required to comply with GAAS.
KEY: Nature = type of procedure. Timing = when. Extent = how much. Every line in the plan answers all three.
You write a sub-plan for each significant financial-statement area, revenue, receivables, inventory, fixed assets, payables, debt, equity. Each area gets its own NTE block plus a staffing assignment.
TRAP: A choice that says "confirm receivables, sample of 60" is incomplete, missing timing (interim or year-end) and who performs it.
Common mistakes
- Treating NTE as a checkbox. Each plan line must explicitly address all three. "Confirm receivables" without sample size and timing is incomplete.
- Reusing last year's plan without reassessment. AU-C 300 requires the plan to reflect current-year risks. Divestitures, system changes, or management changes force revisions.
- Planning to rely on controls without testing them. You cannot reduce substantive procedures based on assumed effectiveness. Reliance requires tests of controls.
Bottom line
- The engagement plan specifies the nature, timing, and extent (NTE) of every audit procedure, broken down by financial-statement area.
- Three procedure types exist: risk assessment, tests of controls, and substantive procedures (tests of details plus substantive analytics).
- Substantive procedures are required for every material area regardless of control reliance.
- Tests of controls are required only when you plan to rely on them or substantive procedures alone cannot provide sufficient evidence.
Exam shortcut
When the question asks what the engagement plan contains, the answer must include nature, timing, extent, by FS area, with staffing. A choice that describes scope and direction is the strategy, not the plan. For risk assessment, the trio is fixed: inquiry plus analytics plus observation/inspection. Inquiry alone is always wrong. For tests of controls, ask: do we plan to rely? Yes = test them. No = skip them.
The full lesson (about 1,911 words, 13 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- II.A2
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.