1. S7: Audit Planning

2. Session Objectives To explain the need for planning To explain the need for planning To outline the essential elements of planning process To outline the essential elements of planning process To finalise the audit approach To finalise the audit approach To lay down specific audit procedures To lay down specific audit procedures To communicate audit plan to the auditee To communicate audit plan to the auditee

3. Why Planning? Planning for financial (attest) audits helps to develop an audit approach that will ensure that sufficient appropriate evidence is gathered to support the audit opinion in the most cost-effective manner, i.e. in an economic, efficient and effective way and in a timely manner. Planning for financial (attest) audits helps to develop an audit approach that will ensure that sufficient appropriate evidence is gathered to support the audit opinion in the most cost-effective manner, i.e. in an economic, efficient and effective way and in a timely manner. The Audit Plan should be documented and kept as a part of audit working papers. The Audit Plan should be documented and kept as a part of audit working papers. The planning process encompasses several steps and it should be carefully noted that the steps are all inter- related and not considered as ends in themselves. The planning process encompasses several steps and it should be carefully noted that the steps are all inter- related and not considered as ends in themselves.

4. Basis for audit planning Audit planning should be based on a thorough understanding of the auditee entity and its operations and the knowledge should be used to: Audit planning should be based on a thorough understanding of the auditee entity and its operations and the knowledge should be used to: determining the materiality i.e. the magnitude of misstatements which might reasonably influence the users of the C&AG's certificate on the financial statements; determining the materiality i.e. the magnitude of misstatements which might reasonably influence the users of the C&AG's certificate on the financial statements; identifying those factors that might lead to an increased risk of material misstatement or irregularity. identifying those factors that might lead to an increased risk of material misstatement or irregularity. risks are first identified at the entity level and then to pinpoint them in terms of their effect on particular account areas and audit objectives; risks are first identified at the entity level and then to pinpoint them in terms of their effect on particular account areas and audit objectives; preparing an audit approach which focuses on testing of the specific risk factors while providing an acceptable level of assurance across the financial statements as a whole. preparing an audit approach which focuses on testing of the specific risk factors while providing an acceptable level of assurance across the financial statements as a whole.

5. Planning Process 1. Understanding the Entity 2. Determination of Materiality Levels 3. Assessment of Risk 4. Controls Testing and Evaluation 5. Determination of the Sampling Frame 6. Deciding on the Audit Approach and procedures 7. Drawing of the Audit plan 8. Communication of the Plan to the Auditee

6. 1. Understanding the Entity To study, analyse, record and comprehend Operations and organisation Operations and organisation Financial reporting requirements Financial reporting requirements Regularity and legal framework Regularity and legal framework Parliamentary and legislative interest Parliamentary and legislative interest Public interest Public interest Accounting processes and formations Accounting processes and formations e.g DDOs, PAOs, Treasuries, Works & Forest Divisions for Government Accounts etc. e.g DDOs, PAOs, Treasuries, Works & Forest Divisions for Government Accounts etc. Computer involvement Computer involvement Control environment Control environment Analytical review Analytical review Account areas Account areas

7. 2. Determination of Materiality Materiality is the Tolerable Error Level Materiality is the Tolerable Error Level One essential step in planning is to determine materiality by value, nature and context One essential step in planning is to determine materiality by value, nature and context Materiality should take into account the concerns of the users of audit certificate Materiality should take into account the concerns of the users of audit certificate The reasons and bases on which the materiality is calculated should be documented. The reasons and bases on which the materiality is calculated should be documented. At the planning stage, the audit team is concerned primarily with materiality by value. At the planning stage, the audit team is concerned primarily with materiality by value. ‘Planning materiality’ may be set at a lower level than ‘Reporting materiality’ ‘Planning materiality’ may be set at a lower level than ‘Reporting materiality’

8. 3. Assessment of Risk Purpose of risk assessment to identify the factors that lead to an increased risk of misstatement or irregularity to identify the factors that lead to an increased risk of misstatement or irregularity to identify the controls which mitigate those risks to identify the controls which mitigate those risks Types of Risk Types of Risk Entity risks Entity risks Account area risks Account area risks

9. Assessment of Risk (Contd.) The audit team should use understanding of the entity and its operations to identify specific risk factors taking into account factors relevant at both the entity level and to specific areas as well as the audit objectives. The audit team should use understanding of the entity and its operations to identify specific risk factors taking into account factors relevant at both the entity level and to specific areas as well as the audit objectives. The audit approach of CAG seeks to reduce to an acceptable level the risk that audit work will not detect material error or irregularity. The audit approach of CAG seeks to reduce to an acceptable level the risk that audit work will not detect material error or irregularity. Decisions on the nature, extent and direction of audit tests depend upon assessment of the risk of material error or irregularity (inherent risk) and the risk that the entity’s controls will not detect such errors or irregularities in a timely manner (control risk). Decisions on the nature, extent and direction of audit tests depend upon assessment of the risk of material error or irregularity (inherent risk) and the risk that the entity’s controls will not detect such errors or irregularities in a timely manner (control risk).

10. Entity risks Entity Risks are risks that identified from top down review of entities that may affect a number of different account areas Entity Risks are risks that identified from top down review of entities that may affect a number of different account areas Entity Risks are to be measured in the context of : Entity Risks are to be measured in the context of : Overall control environment Overall control environment External pressures on the entity External pressures on the entity Experience and competence of staff Experience and competence of staff Reliability of accounting systems Reliability of accounting systems Stability of the entity Stability of the entity

11. Account area risks Account area risks are the risks identified from more detailed review of each account area and that may arise as a result of particular characteristics of the associated transaction streams. Account area risks are the risks identified from more detailed review of each account area and that may arise as a result of particular characteristics of the associated transaction streams. Account area risks mainly arise from: Account area risks mainly arise from: Transactions governed by complex regulations Transactions governed by complex regulations Services and programmes delivered through third parties Services and programmes delivered through third parties Payments and receipts made on the basis of claims or declarations rather than in exchange for goods and services Payments and receipts made on the basis of claims or declarations rather than in exchange for goods and services Transactions not in the normal course of business or operations Transactions not in the normal course of business or operations Transactions recording estimates Transactions recording estimates Multiple sources of funds Multiple sources of funds

12. 4. Controls Testing and Evaluation After identifying specific risk factors, the next step is to identify controls which effectively mitigate those risk factors. After identifying specific risk factors, the next step is to identify controls which effectively mitigate those risk factors. Audit should identify specific risk factors that increase the risk of material misstatement and relate them to account areas and objectives. Audit should identify specific risk factors that increase the risk of material misstatement and relate them to account areas and objectives.

13. Controls Testing and Evaluation (Contd.) For each specific risk factor, it should be seen whether management have mitigating controls in place. For each specific risk factor, it should be seen whether management have mitigating controls in place. For example: For example: in the area of complex regulations, management may ensure that the regulations are translated into clear desk instructions for all staff concerned; in the area of complex regulations, management may ensure that the regulations are translated into clear desk instructions for all staff concerned; for services delivered by third parties, management may require independent verification by external or internal inspectors or auditors; for services delivered by third parties, management may require independent verification by external or internal inspectors or auditors; All the cases where the audit team identifies specific risk factors without corresponding mitigating controls should be specially kept in view in deciding the audit approach. All the cases where the audit team identifies specific risk factors without corresponding mitigating controls should be specially kept in view in deciding the audit approach. Such cases should also be brought to the notice of the entity’s management for possible introduction of mitigating controls. Such cases should also be brought to the notice of the entity’s management for possible introduction of mitigating controls.

14. Controls Testing and Evaluation (Contd.) Steps in identifying material risk factors Establish Entity Objectives Establish Entity Objectives Detail business / operations characteristics Detail business / operations characteristics Identify risks Identify risks Risks screening and prioritisation Risks screening and prioritisation Assess implications for financial statements Assess implications for financial statements Determine entity management response to risk Determine entity management response to risk

15. 5. Determination of the Sampling Frame For each objective in each account area, the auditor should select methods for collecting audit evidence and a suitable sampling method. For each objective in each account area, the auditor should select methods for collecting audit evidence and a suitable sampling method. For testing the completeness of say either income or expenditure sampling may not be appropriate. In such a case careful application of analytical procedures in combination with other audit procedures can provide a better result. For testing the completeness of say either income or expenditure sampling may not be appropriate. In such a case careful application of analytical procedures in combination with other audit procedures can provide a better result.

16. Determination of the Sampling Frame (contd) Overall, the auditor needs to use audit judgement and experience to decide which combination of techniques is likely to provide the total required assurance in the most cost-effective way. Overall, the auditor needs to use audit judgement and experience to decide which combination of techniques is likely to provide the total required assurance in the most cost-effective way. The sampling efficiency can be improved by applying knowledge, experience and judgement, especially for transactions which carry higher levels of risk or sensitivity. The sampling efficiency can be improved by applying knowledge, experience and judgement, especially for transactions which carry higher levels of risk or sensitivity. By using such knowledge, experience and judgement at the planning stage of the audit, a more efficient sampling approach can be developed. By using such knowledge, experience and judgement at the planning stage of the audit, a more efficient sampling approach can be developed.

17. Determination of the Sampling Frame (Contd.) Steps in finalising a sampling frame are: Steps in finalising a sampling frame are: Determine materiality Determine materiality Assess Risk and Evaluate Mitigating Controls Assess Risk and Evaluate Mitigating Controls Determine the extent and nature of substantive tests Determine the extent and nature of substantive tests Determine Sample Size, i.e. extent of substantive testing Determine Sample Size, i.e. extent of substantive testing Identify sampling methods to be applied depending on the nature of substantive tests Identify sampling methods to be applied depending on the nature of substantive tests

18. 6. Deciding on the Audit Approach and Audit Procedures Audit approach should focus on specific risk factors while providing an acceptable level of assurance across the financial statements as a whole. Audit approach should focus on specific risk factors while providing an acceptable level of assurance across the financial statements as a whole. The audit approach chosen will: The audit approach chosen will: reflect understanding of the auditee entity and its business; reflect understanding of the auditee entity and its business; take account of audit judgement on ‘Planning materiality’; and take account of audit judgement on ‘Planning materiality’; and respond to the specific risk factors identified in the course of risk assessment. respond to the specific risk factors identified in the course of risk assessment.

19. Audit approach (Contd) A cost-effective audit approach is one that is an optimum mix of the following objectives: A cost-effective audit approach is one that is an optimum mix of the following objectives: minimising sampling risk - the risk that audit procedures will fail to detect material misstatement or irregularity due to drawing a non-representative sample; minimising sampling risk - the risk that audit procedures will fail to detect material misstatement or irregularity due to drawing a non-representative sample; minimising audit cost - by achieving the most efficient deployment of audit resources taking account the overall timetable and minimising potential disruption to the normal functioning of the auditee; minimising audit cost - by achieving the most efficient deployment of audit resources taking account the overall timetable and minimising potential disruption to the normal functioning of the auditee; maximising assurance on the audit objectives maximising assurance on the audit objectives

20. Audit procedures Testing of control by the audit team Testing of control by the audit team Using the work of internal audit Using the work of internal audit Applying direct substantive procedures Applying direct substantive procedures direct tests based on statistical or non-statistical samples direct tests based on statistical or non-statistical samples 100% testing or less? 100% testing or less? Applying predictive analytical procedures Applying predictive analytical procedures Using the work of other auditors Using the work of other auditors Consulting third party experts Consulting third party experts

21. Level of substantive procedures The substantive procedures can be performed at one of three levels, depending on the amount of assurance required. In decreasing order of assurance, they are: The substantive procedures can be performed at one of three levels, depending on the amount of assurance required. In decreasing order of assurance, they are: Focused Focused Standard Standard Minimum Minimum The lower the level of assurance required, the lesser will be the extent of audit procedures. The lower the level of assurance required, the lesser will be the extent of audit procedures.

22. 7. Drawing of the Audit plan An Audit Plan in the form of Audit Planning Memorandum detailing the results of all the processes discussed so far is then prepared. An Audit Plan in the form of Audit Planning Memorandum detailing the results of all the processes discussed so far is then prepared. This documents all the processes and analyses through which the final plan has been drawn. This documents all the processes and analyses through which the final plan has been drawn.

23. 8. Communication with auditee The audit planning memorandum is then communicated by the audit team to the auditee. Their suggestion may be taken before execution of the plan. The audit planning memorandum is then communicated by the audit team to the auditee. Their suggestion may be taken before execution of the plan.