Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CIA] CIA2: Risk-Based Engagement Planning: From Audit Universe to Work Program
Transcript
- Marcus: Ava, let's talk about the moment an audit manager gets their assignment. The annual audit plan is done. The CAE says, "You're auditing the Procure-to-Pay process." Now what? Where do you even begin? Ava: That’s the critical handoff, Marcus. The annual plan tells you *what* to audit, but engagement planning is where you figure out *how*. It's about translating that high-level, strategic risk into a detailed, tactical audit plan that can actually find something meaningful. Marcus: So, we've already done a risk assessment to build the annual plan. Are we just doing another one? It feels redundant. Ava: It's a great question, because they sound similar but they operate at totally different altitudes. The risk assessment for the annual plan is a macro-level view of the whole organization. The one for the engagement is a micro-level deep dive into one specific process. Marcus: Okay, so different altitudes. Can you give me an analogy? Ava: Think of the annual audit plan as a world map that highlights countries with a high risk of hurricanes. It tells you where the danger zones are. The engagement plan is the detailed, street-level map of a specific city in one of those countries. It shows you exactly which roads are likely to flood and where you need to place the sandbags. Marcus: I like that. One is the 30,000-foot view of the whole 'audit universe,' the other is on the ground, in the specific process. Ava: Exactly. The annual plan asks, "Which areas pose the greatest risk to our strategic objectives?" The engagement plan asks, "What are the specific risks within this procure-to-pay process, and how will we test the controls designed to manage them?" Marcus: And is this process just a good idea, a best practice, or is it formally required by the Standards? Ava: It's absolutely mandated. The Global Internal Audit Standards, or GIAS, are very clear on this. While the annual plan falls under Domain IV, which is about managing the audit function, the moment you start an individual audit, you're in Domain V: Performing Internal Audit Services. Marcus: And what does Domain V say about planning? Ava: The cornerstone is Guiding Principle 13, which states that we have to plan our engagements in a structured and disciplined way. It’s not an informal process. Marcus: So what does a structured, disciplined plan look like according to GIAS? Ava: That principle is put into action by two key standards. First is Standard 13.1, on Planning Engagements. It requires a documented plan for every single audit. That plan has to lay out the objectives, scope, timing, and resources. And critically, it must be based on a risk assessment of the specific activity you're reviewing. Marcus: A documented plan based on risk. What's the second standard? Ava: Standard 13.2, which covers the Engagement Work Program. This says your plan has to result in a work program that details the specific procedures you'll perform to meet your objectives. The work program is your recipe for the audit. It ensures there's a logical thread connecting the risk, to the objective, to the test you perform. Marcus: Okay, so let's walk through creating that plan. I'm the audit manager for that Procure-to-Pay audit. What is my first concrete action? Ava: Your first step is to understand the context. Before you can assess risk, you need to know why this audit is on the plan in the first place. You’ll meet with the process owners—the accounts payable manager, for example—to understand their objectives, the key steps in their process, the systems they use, and who does what. Marcus: I'm gathering intelligence. I'm learning the terrain before I draw the map. Once I have that context, what's next? Ava: Now you perform your detailed, engagement-level risk assessment. This is where you identify the specific things that could go wrong within that process. For procure-to-pay, you might identify risks like fictitious vendors being added to the system, or duplicate invoices being paid, or employees approving purchases they aren't authorized to. Marcus: And I assume we don't treat all those risks equally? Ava: Correct. You assess their potential impact and likelihood to prioritize them. You have to ask yourself, "Is this risk significant enough to threaten the achievement of the process's objectives?" You want to focus your audit effort on the risks that truly matter. Marcus: Okay, I have my prioritized list of specific risks. How do I use that to guide the audit? Ava: That list becomes the foundation for your engagement objectives and scope. The objectives state exactly what the audit intends to achieve. For instance, "To evaluate the effectiveness of controls preventing duplicate vendor payments." Notice how that's tied directly to one of the high-priority risks we identified. Marcus: And the scope? I hear a lot about "scope creep." How does this step prevent that? Ava: A well-defined scope sets the boundaries. It will specify the time period, like the first two quarters of the year. It will name the specific locations, systems, and processes to be reviewed. This focus is crucial. It keeps the team from getting distracted and ensures the audit stays on track to address the key risks. Marcus: So I have my context, my prioritized risks, and my objectives and scope are set. Now am I ready to start testing? Ava: Almost. The final step in planning is to develop the work program. This is the detailed list of audit procedures—the "how." It's your step-by-step guide. Each procedure in that program should be linked directly to a specific objective and a specific risk you identified earlier. Marcus: Let's make this really concrete with that full example from the source material. The annual plan flagged the Procure-to-Pay process because of a high risk of fraudulent vendor payments after a rushed system migration. Walk me through the planning. Ava: Perfect. Step one, understand the context. You meet with the Accounts Payable Manager. She confirms your fears: the migration may have weakened controls over adding new vendors, and user access rights are a mess. Marcus: Okay, context confirmed. Now for the engagement-level risk assessment. Ava: Right. Based on that context, you identify specific, high-priority risks. Risk A: Fictitious vendors are added to the master file. Risk B: Duplicate invoices are processed due to system glitches. Risk C: Purchase orders are approved by people without the proper authority. Marcus: Those are very specific. So what would the objective and scope be? Ava: The objective would be something like: "To determine if controls over the vendor master file, invoice processing, and purchase order approval are effective in preventing fraudulent or erroneous payments in the new system." The scope would be all payments made through that new system from January 1st to June 30th. Marcus: That's incredibly focused. And what would a few procedures in the work program look like? Ava: Each procedure would target one of those risks. To address the fictitious vendor risk, you'd select a sample of new vendors and independently verify they're legitimate—check business registration databases, for example. Marcus: And for the duplicate invoice risk? Ava: For that one, you'd use data analytics. You'd scan all the payments in your scope period, looking for tell-tale signs of duplicates, like the same invoice number, amount, and date. Marcus: And the unauthorized approvals? Ava: You'd take a sample of purchase orders and check that the person who approved it in the system actually has the authority to do so according to the company's official delegation of authority matrix. Marcus: That makes perfect sense. There's a crystal-clear line from the high-level risk in the annual plan all the way down to the specific audit test you're performing. Ava: That's the goal. A purposeful, risk-based audit. Marcus: What's the common mistake here? What's the tempting-but-wrong approach that auditors can fall into? Ava: The biggest trap is inertia. Just pulling out last year's audit program and repeating it without considering the current risks—like that new system migration. Another trap is auditing what's easy. For example, testing travel and entertainment expenses just because the data is clean and accessible, while completely ignoring the more complex and significant risk of vendor fraud. Marcus: So it’s about prioritizing significant risks over convenience. The source also mentions a pitfall about confusing inherent and residual risk. Can you break that down? Ava: This is a critical distinction. Inherent risk is the risk that exists before any controls are put in place. It's what gets an area like procure-to-pay onto the annual plan. But the engagement's job is to focus on residual risk. Marcus: And residual risk is... Ava: It's the risk that remains *after* management has implemented controls. The purpose of our audit is to provide assurance that those controls are working effectively to keep that residual risk at an acceptable level. Planning to test a control that doesn't exist, or one that doesn't address the key risk, is a complete waste of time. Marcus: So, the annual plan is often triggered by high inherent risk, but the engagement work program is designed to test the controls that are supposed to manage it down to an acceptable residual risk. Ava: You've got it. That's the conceptual leap. Marcus: This is a great framework. Is there a simple way to remember these planning steps for the exam? Ava: There is. You can use the mnemonic RAPID. R-A-P-I-D. Marcus: Okay, let's hear it. What does RAPID stand for? Ava: The 'R' is for Review the Annual Plan context and stakeholder concerns. 'A' is for Assess the specific risks of the activity. 'P' is for Project the engagement's objectives and scope. 'I' is for Identify the resources needed. And 'D' is for Develop the detailed work program. Marcus: RAPID. Review, Assess, Project, Identify, Develop. That's good. What about an exam-day tip for questions on this topic? Ava: On the exam, when you get a scenario about planning, always ask yourself one question: "Why is this audit being done?" The answer will point you to the core risk. The best answer choice for an objective, a scope, or a procedure will be the one that most directly and efficiently addresses that specific underlying risk. Marcus: This framework is incredibly helpful for structuring your thinking, not just for the exam but on the job. Ava: It really is. And for more frameworks like this, remember that VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. You can get started at Vora Prep dot com. It’s free to try. Marcus: Great advice, Ava. So the key takeaway: the annual plan is the 'what,' the engagement plan is the 'how,' and it all starts with a deep, micro-level understanding of the specific risks in the process you're auditing. Ava: You've got it. That's all the time we have for office hours today. Thanks for listening. Marcus: Keep up the great work. We'll talk to you next time.