An audit plan template is a reusable document that sets out, before fieldwork begins, the scope and objectives of the engagement, the risks and materiality driving the testing, the criteria being tested against, the sampling method, the people and hours assigned, the timeline, and the review and retention rules the finished plan will follow. A usable template forces those decisions up front rather than letting them accumulate mid-audit. The sections below cover what each part of the template should capture and where authoritative standards dictate specific content.
Preliminary Work Before You Fill Anything In
The template itself is the second step. The first is gathering prior audit reports, internal policy manuals, and the regulations that apply to the entity. Prior reports show recurring issues and unresolved findings, and PCAOB Auditing Standard 2110 requires auditors to fold knowledge from past audits into their risk identification.1Public Company Accounting Oversight Board. AS 2110 Identifying and Assessing Risks of Material Misstatement
Build a prepared-by-client (PBC) request into the template so it goes out early. A workable PBC list covers:
- Organizational documents: current org chart, key personnel list, and contacts for department heads and legal counsel
- Financial records: final trial balance, general ledger detail, draft financial statements with footnotes, and support for non-standard journal entries
- Balance sheet support: bank reconciliations, AR and AP aging, inventory counts, and fixed asset schedules with additions and disposals
- Legal and governance records: board minutes, material contracts, leases, and a draft legal representation letter on pending litigation
- Internal control documentation: a memo describing any significant changes to controls, systems, or accounting policies since the last audit
Late PBC requests are the most common cause of fieldwork delays. Building the request into the template forces it out on schedule.
For public company audits, the template also needs an independence confirmation block. PCAOB Rule 3520 requires the firm and every associated person to remain independent of the client throughout the engagement period, which rules out contingent fees, marketing aggressive tax positions to the audit client, and (with limited exceptions) tax services for people in financial reporting oversight roles.2Public Company Accounting Oversight Board. Section 3 – Auditing and Related Professional Practice Standards PCAOB AS 2101 treats confirming independence as a preliminary engagement activity, not a later step.3Public Company Accounting Oversight Board. AS 2101 Audit Planning Team members should sign the block before any work starts.
Scope and Objectives Fields
The scope section names what’s in and what’s out. A useful entry reads like “accounts receivable and revenue recognition for the fiscal year ending December 31, 2025” and explicitly excludes areas outside the engagement, such as inventory or capital expenditures. Being specific about exclusions is what actually prevents scope creep.
Objectives describe what the audit is meant to prove. A financial statement audit aims to determine whether balances are free of material misstatement. An operational audit might test whether procurement controls work as designed. An internal audit might evaluate governance, risk management, and compliance across a division, consistent with the IIA’s Global Internal Audit Standards.4The Institute of Internal Auditors. Global Internal Audit Standards Write each objective in testable form. “Evaluate the finance department” is too vague. “Determine whether disbursements over $10,000 followed the three-bid requirement during Q1 through Q3” gives the team something to test.
For public company engagements, PCAOB AS 2101 requires the plan to describe the planned nature, timing, and extent of risk assessment procedures and substantive procedures, and it requires an overall audit strategy that sets scope, timing, and direction before the detailed plan is developed.3Public Company Accounting Oversight Board. AS 2101 Audit Planning The template needs a place for both.
Risk Assessment and Materiality Fields
Risk assessment decides where testing concentrates. PCAOB AS 2110 sets out the sequence: identify risks from planning-phase information, evaluate whether they affect the statements broadly or hit specific assertions, consider the types of misstatements that could result, and assess the likelihood and potential magnitude of each.1Public Company Accounting Oversight Board. AS 2110 Identifying and Assessing Risks of Material Misstatement The template should carry each identified risk through to the testing plan so higher-risk areas visibly get more samples or more detailed procedures.
Materiality sets the dollar threshold below which misstatements aren’t large enough to influence a reasonable user’s decisions. Benchmarks used in practice include 5% of pre-tax income, 0.5% to 1% of total revenue, and 1% to 2% of total assets, with the choice depending on the entity’s size, industry, and the stability of the benchmark. A startup with volatile earnings often anchors to revenue rather than net income. The template needs a field for the materiality figure and a separate field for the rationale.
Internal audit plans work from the same logic. The IIA standards require auditors to weigh the complexity, materiality, and significance of the risks facing the activity under review, along with the probability of significant errors, fraud, or noncompliance.4The Institute of Internal Auditors. Global Internal Audit Standards
Criteria and Standards
Every audit needs a measuring stick, and the template should name it. Financial statement audits measure against GAAP or IFRS. Compliance audits reference regulations, contract terms, or internal policies. Management system audits use ISO 19011 as the framework for auditing program objectives and review procedures.5International Organization for Standardization. ISO 19011 Guidelines for Auditing Management Systems
Translate the criteria into concrete benchmarks in the template. Instead of “compliance with applicable procurement regulations,” write “all purchase orders above $25,000 must include documented competitive bids from at least three vendors per Policy 4.3.2.” Specific criteria leave less room to argue about whether a finding is a deviation.
Sampling Methodology
The template should record how items get selected for testing. PCAOB AS 2315 recognizes two categories: statistical sampling and non-statistical sampling, and both can produce sufficient evidence when applied correctly.6Public Company Accounting Oversight Board. AS 2315 Audit Sampling
Statistical sampling uses probability theory to select items and lets you quantify the risk that the sample results differ from a full-population test. It fits large, homogeneous populations like payroll or vendor payments. Non-statistical sampling relies on judgment to target items by risk characteristics (high-dollar transactions, unusual entries, new vendors), and its results can’t be mathematically projected to the full population.
For each audit area, the template needs the approach chosen, the population sampled, the sample size, the selection method, and the tolerable error rate. Documenting these fields prevents later disputes over why the team tested 25 invoices instead of 60.
Resources, Staffing, and Timeline
This section answers how long the work takes and what it costs. Break the engagement into phases and assign hours to each: planning, fieldwork, analysis, reporting, and follow-up. The template should list team members by name and credentials, which shows the assigned staff have the expertise for the work.
Cost estimates should include external specialists. A small internal audit may take 40 to 80 labor hours. Building a 10% to 15% buffer into the timeline is realistic; late document requests and scheduling conflicts are routine.
Set specific milestone dates in the template: PBC request issued, fieldwork start, fieldwork end, draft report delivered, management response due, and final report issued. These dates hold both the audit team and the auditee to the schedule.
Regulatory Add-Ons That Change the Template
Some frameworks add required content beyond general practice.
Sarbanes-Oxley for Public Companies
Public company plans must address internal controls over financial reporting. SOX Section 404 requires management to assess control effectiveness annually and the external auditor to attest to that assessment. For integrated audits, the engagement letter must state that the objective includes an opinion on both internal control effectiveness and the financial statements.7Public Company Accounting Oversight Board. AS 1301 Communications with Audit Committees Executives who knowingly certify a non-compliant financial report face up to $1 million in fines and 10 years in prison under 18 U.S.C. ยง 1350, rising to $5 million and 20 years for willful certification.8Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports A SOX template needs a dedicated internal control testing section listing each control tested, the testing method, and the sample size per control.
Employee Benefit Plan Audits
The Department of Labor requires most 401(k) plans with 100 or more participants holding account balances to include an independent audit with the annual Form 5500 filing. If your organization sponsors a plan approaching that threshold, the template needs fields for testing participant data, contribution accuracy, and investment allocations.
Management System Audits
Organizations with ISO certifications for quality, environmental, or information security management rely on ISO 19011 for audit program guidance. It covers program objectives, roles, and the scope, location, and duration of individual audits.5International Organization for Standardization. ISO 19011 Guidelines for Auditing Management Systems For recurring management system audits, ISO 19011 is the template’s structural foundation.
Review, Sign-Off, Distribution, and Retention
Once populated, the plan needs review. The lead auditor and relevant department managers should confirm the scope, objectives, and testing approach fit the organization’s needs. Reviews often surface a testing timeline that overlaps with the auditee’s fiscal close or a staffing plan that depends on an unavailable specialist.
For public company audits, PCAOB AS 1301 requires the auditor to record the engagement terms in a formal letter, provide it to the audit committee annually, and have it signed by the appropriate parties.7Public Company Accounting Oversight Board. AS 1301 Communications with Audit Committees For internal audits, the IIA standards require objectives, scope, and timing to be communicated to management, with subsequent changes communicated promptly.4The Institute of Internal Auditors. Global Internal Audit Standards The finalized plan should carry sign-off signatures from the people who authorized it.
Distribute the approved plan through secure channels (an internal portal or encrypted file share) and give the auditee enough lead time to prepare the PBC documents.
PCAOB AS 1215 requires audit documentation detailed enough that an experienced auditor with no prior connection to the engagement could understand the work performed, the evidence obtained, and the conclusions reached. Acceptable formats include electronic files, paper memoranda, schedules, and correspondence.9Public Company Accounting Oversight Board. AS 1215 Audit Documentation
On retention, SEC regulations require accounting firms to retain audit records for seven years after the auditor concludes the engagement.10eCFR. 17 CFR 210.2-06 – Retention of Audit and Review Records PCAOB AS 1215 mirrors that seven-year period, measured from the date the auditor grants permission to use the audit report.9Public Company Accounting Oversight Board. AS 1215 Audit Documentation Seven years is a safe default for most organizations, though counsel may recommend longer retention for specific document categories.