Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CIA] CIA2: The Auditor's Blueprint: Crafting and Executing the Engagement Work Program
Transcript
- Hey, welcome to VoraPrep Audio. Glad you could tune in. So, I want you to picture something. There's an internal audit team at a big retailer. They’re tasked with looking at inventory controls in the main warehouse. The manager is new, wants to make a good impression, so they grab last year's work program and just hit 'go'. For three weeks, the team works hard. They are testing every single control around the physical inventory counts. They're doing great work. Except... they're solving the wrong problem. The *real* risk, the one that cost the company two million dollars last quarter, was in how they write off old, obsolete inventory. The team gathered perfect evidence for the wrong objective. Three weeks of work, basically wasted. That’s what happens when you don't have a solid engagement work program. You're just working blind. To prevent exactly that kind of mess, we have the Global Internal Audit Standards, or GIAS. Specifically, Standard 2240, which says you *have* to develop and document a work program for every engagement. Think of it like an architect's blueprint for a building. The blueprint tells you exactly what steps to take, what materials you need, where everything goes, so the final building is sound. The work program does the same for an audit. It lays out every single procedure you need to perform to make sure your conclusion is solid and actually addresses the risks you’re supposed to be looking at. It’s really your roadmap. It tells the whole team what they're supposed to be doing, and it lets your supervisor see the plan and track your progress. It's also the official record of what you planned to do, which you’ll later compare against what you *actually* did. And for newer auditors? It's an incredible training tool, making sure everyone follows the same high-quality process. And here's a key detail from the standard: the work program has to be approved by your engagement supervisor *before* you start. Before. Not during, not after. And if you need to change it later, those changes need to get approved, too. That supervisory review is so important. It’s the final check to make sure your blueprint is pointed at the right building before you start pouring the concrete. So, what are these blueprints made of? The heart of any work program is the list of audit procedures. These are the actual, specific tasks you perform to gather evidence. Choosing the right procedure is a huge part of the job. You have a few tools in your toolkit here. The most straightforward is inquiry—just asking people questions. It’s great for getting context, but you can't really hang your hat on it. It’s never enough by itself. You always have to back it up. So, you might use observation. This is literally just watching someone perform a process. It gives you really persuasive evidence because you saw it with your own eyes. The only catch is, you only know it worked that way at that one moment you were watching. A procedure you'll use all the time is inspection of records or documents. This is the classic auditor task: digging into invoices, contracts, reports, whatever. It’s one of the most reliable ways to get evidence. You can also do an inspection of tangible assets—physically going and touching something. Counting inventory, verifying a piece of equipment exists... that kind of thing. Then there's reperformance. This is where you independently do a control or a process yourself. For example, if you're testing depreciation, you don't just ask how they did it; you recalculate the depreciation expense for a few assets yourself to see if you get the same number. And finally, you have analytical procedures. This is where you step back and look at the bigger picture by studying relationships in the data. You might do some ratio analysis or look at trends over time to see if anything looks strange or out of place. It’s all about finding things that just don’t add up. Now, the work program is the *plan*, and it has a partner: the working papers. The working papers are the *proof*. The program says what you're going to do; the papers show what you did, what you found, and what you concluded. Every single step in your work program should point to a specific spot in your working papers. This creates a clear audit trail. Anyone—your boss, a regulator—should be able to pick up your file and trace your work from the objective, through your procedures, to the evidence, and see exactly how you arrived at your conclusion. Here’s a good mental check: if someone who knows nothing about your audit reviewed your working papers six months from now, would they get it? Could they follow your logic and reach the same conclusion? If the answer is yes, you've done your job well. Let’s walk through a quick example. Imagine you're an auditor at a place called Axiom Manufacturing. Your objective is to verify that all big equipment purchases—anything over fifty thousand dollars—followed the company's competitive bidding policy. So, first, you’d identify your population. You’d get a data dump from the accounting system of all capital equipment bought in the last year. Step two, you filter that list down to just the purchases over your fifty-thousand-dollar threshold. Next, you can’t test everything, so you’d use some sampling to pick, say, 25 purchases to look at more closely. Now for the procedures. For each of those 25 purchases, you'd lay out the specific steps. Something like this: One, get the purchase order and check that the amount and description match what's in the ledger. Two, get the whole procurement file and look for proof of at least three competitive bids. Three, if you don't see three bids, ask the procurement manager why, and look for a special sole-source justification form that policy requires. Four, you’d reperform part of the process by tracing the winning bid amount to the final invoice to make sure nothing changed. After you've done that for all 25 items, you can form your conclusion about whether the bidding control is working effectively. See how each step is a specific, verifiable action? The wrong way would be to just go ask the procurement manager, "Hey, do you guys follow the bidding policy?" Relying only on inquiry is a classic mistake. It's weak evidence. The strength here is combining that inquiry with inspecting documents and reperforming their work. When you see questions about this on the exam, here's how to approach them. First, find the engagement objective. What is the goal? Are you testing if something exists? If it's complete? If it's accurate? The objective is everything. Second, identify the key risk. What's the main thing that could go wrong? Then, look at the answer choices. Which of these procedures gives you the most direct, reliable evidence to address that specific objective and risk? Finally, choose that most direct path. The best answer is almost always the one that involves looking at third-party documents, physically touching an asset, or redoing a calculation yourself—not just asking someone about it. It really comes down to this: an effective work program has procedures that are clearly tied to the objectives. The steps are specific. It's formally approved before you start. And it’s focused on high-risk areas. The ineffective ones are full of generic, vague steps like "review invoices," with no formal approval and a lot of time wasted on things that don't matter. A frequent hang-up for candidates is mixing up the objective with the procedure. Just remember, the objective is the 'what'—*what* you want to achieve. For example, "Determine if payroll calculations are accurate." The procedure is the 'how'—*how* you're going to do it. For instance, "Recalculate gross-to-net pay for a sample of 25 employees." If it sounds like a high-level goal, it’s an objective. If it sounds like a specific task on a to-do list, it’s a procedure. If you need a little something to help you remember the parts of a great work program, think of the word PROOF. P is for Procedures: the specific, step-by-step tasks. R is for Responsibility: who is going to do each task. O is for Objective Link: which objective this procedure helps satisfy. The second O is for Output: what kind of evidence you expect to get. And F is for Finish Date: the timeline for getting it done. PROOF. One last exam-day tip: if you get a scenario question asking you to pick the best procedure for a given objective, always, always choose the one that provides the most *direct* evidence. If the goal is to test the *existence* of inventory, the most direct evidence is going to be a physical count. Not reviewing records. Not asking the warehouse manager. It’s seeing it for yourself. If you find this way of breaking things down helpful, you should check out the full course. VoraPrep is a full exam-prep app with lessons, tons of practice questions, and even an AI tutor to help you when you're stuck. You can try it out for free. Just go to Vora Prep dot com to get started. Okay, let's try a couple of practice questions to see if this is sticking. First one: An auditor is planning an engagement to assess the adequacy of a company's business continuity plan. Which of the following is an engagement *objective*, and not an audit *procedure*? Is it A) Reviewing the results of the last disaster recovery test... B) Interviewing the IT director about backup protocols... C) Verifying the plan was updated and approved recently... or D) Determining whether key business functions can be recovered within established timeframes? ...The answer is D. A, B, and C are all specific 'how-to' tasks, they are procedures. D is the high-level 'what'—the overall goal you're trying to achieve. Alright, one more. According to GIAS Standard 2240, who has to approve the work program before it's implemented? Is it A) The Chief Audit Executive... B) The engagement client... C) The engagement supervisor... or D) The audit committee? ...That one is C, the engagement supervisor. Remember, that's the key control to make sure the plan is sound before the work begins. So, to wrap it all up, the work program is your blueprint. It’s what turns your audit objectives into a concrete, actionable plan, just like the standards require. It guides the team, helps your supervisor, and creates the foundation for your working papers. By choosing direct, reliable procedures and getting that all-important approval before you start, you make sure your audit is efficient, effective, and focused on what truly matters. You’ve got this. Keep up the great work, and I'll talk to you on the next one.