Example of an Audit Plan: Scope, Materiality, and Risk Assessment

An audit plan example follows a predictable shape: an internal working document that names what will be tested, how, by whom, and on what timeline, with materiality and risk assessments driving every choice. Under PCAOB standards, the plan must describe the nature, timing, and extent of planned risk assessment procedures, planned tests of controls and substantive procedures, and any other procedures needed to comply with professional standards.¹ Private-company audits follow a nearly identical structure under AICPA standards. The sections below walk through the parts of a typical plan in the order they appear.

Scope, Objectives, and Timeline

The first block of a plan sets the boundaries. Scope names the accounts, business units, and time periods in play. Objectives state what the audit is meant to accomplish: verifying compliance with federal tax regulations, testing the accuracy of financial reporting, or both. The timeline locks down start and end dates so fieldwork doesn’t collide with the client’s quarter-close or other operational bottlenecks.

The plan also lists what the client needs to produce. A standard documentation request includes general ledgers, bank statements, and tax filings from the prior fiscal year.² Prior audit reports go on the list too, because they flag recurring issues and show whether earlier recommendations were implemented. Organizational charts help the team understand who approves what, which becomes critical when testing segregation of duties later.

The PCAOB planning standard tells the auditor to look wider at this stage: industry-specific reporting practices, economic conditions, recent changes in operations or internal controls, legal or regulatory matters, and any control deficiencies previously communicated to the audit committee.¹ A company that just completed a major acquisition, for instance, introduces integration risks that wouldn’t appear in last year’s file.

Setting the Materiality Threshold

Materiality is the dollar threshold below which a misstatement is unlikely to change a reasonable investor’s or user’s decision. The auditor sets this number during planning, and it drives what gets heavy testing, how large a sample runs, and what counts as a finding worth reporting.

Common benchmarks include 5% of pre-tax income, 0.5% of total assets, 1% of total revenue, or 1% of shareholders’ equity. The choice depends on the entity’s industry and which metric best represents its scale. A bank might anchor materiality to total assets; a retailer might use revenue. These are starting points, and the auditor adjusts based on professional judgment.

The PCAOB also requires auditors to stay alert to misstatements that could be material for qualitative reasons even when they fall below the numeric threshold. A small misstatement in a related-party transaction involving a conflict of interest might influence an investor’s judgment in ways a similarly sized error in routine operating expenses would not.³ When smaller misstatements could matter for particular accounts or disclosures, the plan should establish a separate, lower materiality level for those areas.

Risk Assessment

The risk assessment section is where the plan earns its keep. Auditors use the audit risk model, which splits overall audit risk into three components:

Inherent risk: the chance a misstatement exists before any controls are applied. Complex transactions, subjective estimates, and cash-heavy businesses all carry higher inherent risk.
Control risk: the chance the company’s own controls won’t catch a misstatement. Weak segregation of duties or missing approval workflows push this higher.
Detection risk: the chance the auditor’s own procedures will miss a misstatement. This is the only component the auditor controls directly.

When inherent and control risk are both high for an account, the auditor lowers detection risk by designing more extensive procedures: larger samples, more third-party confirmations, or testing at several points during the year rather than only at year-end. When those risks are low, a lighter touch is defensible. The plan documents this logic for every significant account, so anyone reviewing the workpapers can trace the connection between the assessed risk and the procedures that followed.

This section also covers the internal control environment. Effective controls, such as dual authorization for disbursements above a set threshold or automatic reconciliation of subsidiary ledgers to the general ledger, reduce the direct testing the auditor needs to perform. The plan describes how the auditor evaluated those controls and whether they intend to rely on them.

Testing Procedures

Testing breaks into two categories. Substantive testing directly verifies dollar amounts and account balances: confirming receivables with third parties, physically counting inventory, recalculating depreciation schedules, or tracing a sample of journal entries back to source documents. Compliance testing checks whether the business follows its own policies and external legal requirements, for example verifying that payroll deductions align with current federal withholding methods⁴ or that employee records satisfy FLSA recordkeeping requirements.⁵

For each significant account, the plan specifies the type of testing, sample sizes, timing (interim versus year-end), and the source documents the auditor will examine. This level of detail prevents two team members from independently deciding to test the same account differently.

Common Account-Area Breakdown

Most plans organize testing procedures into functional categories. Common ones include:

Revenue and receivables: confirmation of balances, cutoff testing around period-end, and analytical procedures comparing current-year revenue to prior periods and budgets.
Inventory: observation of physical counts, test counts, comparison of recorded amounts to the balance sheet, and valuation testing for obsolescence.
Payroll: verification of employee records, benefit calculations, withholding accuracy, and compliance with wage and hour requirements.
Internal controls: walkthroughs of key transaction cycles, evaluation of segregation of duties, and testing of IT general controls over financial reporting systems.
Estimates and judgments: review of assumptions underlying fair-value measurements, allowances for doubtful accounts, and warranty reserves.

Each area gets its own subsection describing the specific procedures, the assertions being tested (existence, completeness, valuation, rights and obligations, presentation), and the link back to the risk assessment.

Staffing and Resources

The plan assigns hours and personnel to each task. Senior auditors typically take on high-judgment areas like revenue recognition, estimates, and related-party transactions. Staff auditors work through routine verifications such as vouching disbursements or reviewing bank reconciliations. Specialized software for data analytics or continuous auditing is noted here, alongside any outside specialists needed, such as actuaries for pension testing or IT auditors for system controls.

The PCAOB standard directs the auditor to consider the nature, timing, and extent of resources necessary to perform the engagement as part of the overall strategy.¹ Understaffing a complex area is one of the fastest ways to miss something, so this section deserves real thought rather than a copy-paste from last year’s plan.

Fraud Risk Procedures

Fraud gets its own treatment because professional standards require it. Before fieldwork begins, the engagement team holds a discussion about where and how the entity’s financial statements might be susceptible to material misstatement from fraud.⁶ The plan documents when the discussion happened, who participated, and what risks were identified.

Two fraud risks are presumed present on every engagement. Revenue recognition is always treated as a fraud risk unless the auditor has specific evidence to the contrary. Management override of controls is the other: no matter how strong the control environment looks, management can direct subordinates to record entries that bypass normal procedures. The plan must include procedures specifically designed to address these risks, including examining journal entries for unusual patterns, reviewing accounting estimates for bias, and evaluating whether significant unusual transactions have a legitimate business purpose.⁷

The plan also records inquiries directed at the audit committee, management, and internal auditors about their awareness of actual or suspected fraud. These conversations happen early because the responses shape where the auditor focuses additional testing.

Independence Confirmation and Documentation

Before the engagement reaches planning, the auditor confirms independence from the client. Independence requirements come from the AICPA Code of Professional Conduct, the state board of accountancy, the SEC for public company engagements, and the GAO’s Yellow Book for government audits. The auditor complies with whichever set is most restrictive, plus the firm’s own internal policies. Common threats include financial interests in the client, business relationships, providing certain non-audit services, and former employment at the client. The planning documentation confirms that these checks were performed and no impairments exist.

The completed plan then becomes part of the engagement’s permanent workpapers. PCAOB standards require audit documentation prepared in enough detail that an experienced auditor with no prior connection to the engagement could understand what was done, what evidence was gathered, and what conclusions were reached.⁸ A plan that clearly links assessed risks to testing procedures, and documents the reasoning behind materiality and staffing decisions, provides a defensible record long after fieldwork is over.

Which Standards Shape the Plan

The exact contents depend on who is being audited, and this changes what the plan must include. PCAOB standards apply to audits of public companies registered with the SEC and are the most prescriptive, with specific requirements for integrated audits covering both financial statements and internal controls.¹⁹¹⁰ The core structure holds across all three: define the strategy, assess the risks, and document procedures that respond to those risks. Differences show up in how internal controls must be evaluated and what additional compliance testing is needed.

1
Public Company Accounting Oversight Board. AS 2101: Audit Planning
2
Internal Revenue Service. What Kind of Records Should I Keep
3
Public Company Accounting Oversight Board. AS 2105: Consideration of Materiality in Planning and Performing an Audit
4
Internal Revenue Service. Publication 15-T – Federal Income Tax Withholding Methods
5
U.S. Department of Labor. Fact Sheet 21: Recordkeeping Requirements Under the Fair Labor Standards Act
6
Public Company Accounting Oversight Board. AS 2401: Consideration of Fraud in a Financial Statement Audit
7
Public Company Accounting Oversight Board. Fraud Risk Resources
8
Public Company Accounting Oversight Board. AS 1215 – Audit Documentation
9
U.S. GAO. Yellow Book: Government Auditing Standards
10
eCFR. 2 CFR Part 200 Subpart F – Audit Requirements