An audit program is the written, step-by-step plan an audit team follows during an engagement. It sets out exactly which procedures will be performed, on which accounts or controls, by whom, when, and to what depth, translating the auditor’s high-level strategy into instructions a staff member can pick up and execute. Professional standards require this plan to be documented before fieldwork starts, with the nature, timing, and extent of every procedure specified.1Public Company Accounting Oversight Board. AS 2101 Audit Planning Without it, an engagement risks missing significant risks, duplicating work, or reaching an opinion that isn’t supported by the evidence collected.
What the Program Is For
Two things happen before fieldwork: the team identifies risks of material misstatement, and it decides how much to rely on the client’s internal controls. Those judgments live in the audit strategy. The audit program is where that strategy becomes concrete. Instead of an idea about which accounts matter most, you get a list of tests, each tied to a specific objective and assigned to a specific person.
That structure is what makes supervision possible. A reviewer can check that each planned test was performed, that it was performed correctly, and that the conclusions drawn actually follow from the evidence. The engagement partner is personally responsible for confirming the planned scope was carried out and properly documented.2Public Company Accounting Oversight Board. AS 1201 Supervision of the Audit Engagement Years later, when a regulator or peer reviewer looks back at the engagement, the program is the document that shows what the firm intended to do and whether it did it.
What Goes Into an Audit Program
Programs vary widely by client and industry, but the structural pieces are consistent.
Objectives and Scope
The program opens by stating what the auditor is trying to establish. Objectives tie back to financial statement assertions: does the inventory exist, are all liabilities recorded, is revenue accurate, does the company actually own the assets it lists? Each material account gets mapped to the assertions most likely to be misstated, and the program’s objectives flow from that mapping.3Public Company Accounting Oversight Board. AS 2110 Identifying and Assessing Risks of Material Misstatement
Scope sets the boundary lines: which accounts, which periods, which locations. Clear scope keeps the team from drifting into areas that weren’t risk-assessed.
Materiality
Before designing tests, auditors set a materiality figure for the financial statements as a whole. This is the dollar amount below which a misstatement wouldn’t reasonably change an investor’s decision. PCAOB standards require it to be a specific number, not a general concept, and it drives how much testing the program has to include.4Public Company Accounting Oversight Board. AS 2105 Consideration of Materiality in Planning and Performing an Audit
Underneath overall materiality sits tolerable misstatement, often called performance materiality, set lower to leave a buffer for undetected errors. If overall materiality is $500,000, tolerable misstatement might be $300,000. Certain sensitive accounts, like related-party transactions or executive compensation, can get their own lower thresholds.4Public Company Accounting Oversight Board. AS 2105 Consideration of Materiality in Planning and Performing an Audit
The Procedure List
This is the core of the program. Procedures are concrete instructions, not general goals. Rather than “verify cash,” a well-written step reads something like “obtain the December 31 bank statement and reconciliation, trace all reconciling items over $10,000 to supporting documentation, and confirm balances directly with the bank.” Procedures fall into two groups:
- Tests of controls, which evaluate whether the client’s internal controls are designed properly and operating as intended. Testing whether purchase orders above a set dollar amount consistently received the required approval is a common example.
- Substantive procedures, which test account balances and transactions directly for misstatement. Sending confirmations to customers, recalculating depreciation, and physically counting inventory all fall here.
The mix between the two depends on how much the auditor plans to rely on the client’s controls. Strong controls over cash disbursements may let the team reduce substantive work there. Weak controls over revenue recognition typically push the program toward heavier substantive testing.5Public Company Accounting Oversight Board. AS 2301 The Auditors Responses to the Risks of Material Misstatement
Assignments, Timing, and Sign-Offs
Each procedure carries a time estimate and a name. Complex, judgment-heavy work such as evaluating fair value estimates goes to experienced staff; routine reconciliations go to less senior team members. This isn’t only a scheduling matter. PCAOB standards require that the skill of the person performing a procedure match the risk of the task.5Public Company Accounting Oversight Board. AS 2301 The Auditors Responses to the Risks of Material Misstatement
The program also has designated slots for the preparer’s sign-off after finishing a procedure and the reviewer’s sign-off after checking it. The reviewer has to evaluate whether the work was actually done, whether the objectives were met, and whether the results support the conclusions.2Public Company Accounting Oversight Board. AS 1201 Supervision of the Audit Engagement
How the Program Is Built
Building the program is one of the most judgment-heavy parts of an engagement. It starts with risk assessment and ends with written procedures tailored to the specific client.
Risk Assessment First
The auditor performs risk assessment procedures to identify where material misstatements could occur. That work covers the client’s industry, its operations, its internal controls, and any anomalies in the financial data. Risks get identified at two levels: broad, financial-statement-level concerns like management integrity or a deteriorating financial position, and specific, assertion-level risks tied to particular accounts.3Public Company Accounting Oversight Board. AS 2110 Identifying and Assessing Risks of Material Misstatement Fraud risk gets its own dedicated assessment. Every significant risk identified must be answered somewhere in the program.
Mapping Risks to Assertions
Once risks are identified, they get matched to financial statement assertions. For transactions, the main assertions are occurrence, completeness, accuracy, cutoff, and classification. For balances, the assertions shift to existence, rights and obligations, and valuation. The procedures then target the assertions most at risk. If the concern with accounts receivable is existence, the program calls for direct confirmation with customers. If the concern with inventory is valuation, the program emphasizes testing for obsolescence and comparing carrying values to net realizable value.
Sampling
Most programs don’t test every transaction. They specify sample sizes and selection methods for each procedure. The required sample size depends on the test’s objective and the acceptable level of sampling risk, and higher assessed risk generally translates to larger samples.6Public Company Accounting Oversight Board. AS 2315 Audit Sampling
Unpredictability
PCAOB standards require auditors to build unpredictability into the procedures selected each year, varying the tests performed, the locations visited, or the timing of the work. The reason is direct: if management can anticipate what the auditor will look at, management can prepare accordingly.5Public Company Accounting Oversight Board. AS 2301 The Auditors Responses to the Risks of Material Misstatement
How the Program Is Used in the Field
Once the program is finalized, execution follows a structured path: assignment, fieldwork, documentation, and review.
Assignment and Briefing
The engagement manager distributes procedures based on experience and complexity. Before testing starts, supervisors are required to communicate three things to each team member: the objectives of the procedures, the nature and timing of the work, and any matters that could affect either the work or how results are evaluated.2Public Company Accounting Oversight Board. AS 1201 Supervision of the Audit Engagement Skipping the briefing is where execution problems begin. A staff auditor working through a procedure without understanding its purpose may gather technically complete but substantively useless evidence.
Documentation
Every test produces workpapers that link back to the specific procedure in the program. Workpapers include the underlying evidence (invoices, bank statements, contracts, system screenshots), the auditor’s analysis of it, and the conclusion reached. Exceptions get flagged for discussion with the team and, if significant, with client management.
Changing the Program Mid-Engagement
Programs aren’t locked in once fieldwork starts. If the team runs into unexpected control deficiencies, unusual transactions, or evidence that contradicts management’s representations, the program needs to change. The engagement partner has to evaluate significant issues that arise and respond appropriately, which may mean expanding sample sizes, adding procedures, or testing areas that weren’t originally in scope.2Public Company Accounting Oversight Board. AS 1201 Supervision of the Audit Engagement If materiality is reassessed lower during the engagement, the standards require an evaluation of whether existing procedures are still sufficient.4Public Company Accounting Oversight Board. AS 2105 Consideration of Materiality in Planning and Performing an Audit
Review
After fieldwork ends, senior team members review completed workpapers against the program to confirm that every planned procedure was performed, documented, and concluded on. The engagement partner carries ultimate responsibility even when review is delegated, and all review must be completed before the audit report is released.2Public Company Accounting Oversight Board. AS 1201 Supervision of the Audit Engagement
Types of Audit Programs
The structure above applies broadly, but programs look different depending on the engagement’s purpose.
Financial Statement Audit Programs
The most common type. These programs focus on whether the financial statements are presented fairly under the applicable accounting framework, typically GAAP. Procedures are heavily assertion-based, and the deliverable is the auditor’s opinion on the statements as a whole.
Integrated Audit Programs (SOX 404)
Public company audits typically cover both the financial statements and the effectiveness of internal control over financial reporting, as required by Section 404 of the Sarbanes-Oxley Act.7U.S. Securities and Exchange Commission. Sarbanes-Oxley Disclosure Requirements The program has to be designed so that control testing serves both purposes at once: supporting the opinion on internal controls and informing the risk assessment for the financial statement audit.8Public Company Accounting Oversight Board. AS 2201 An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements These programs use a top-down approach, starting with entity-level controls and working down to process-level controls over significant accounts, and they test both design effectiveness and operating effectiveness.
Compliance Audit Programs
Compliance audits test whether an organization is following specific laws, regulations, or contracts. Procedures target the controls and transactions tied to the relevant rules, whether that’s the Foreign Corrupt Practices Act,9U.S. Department of Justice. Foreign Corrupt Practices Act Unit loan covenants, or healthcare billing rules. A notable subcategory is the Single Audit, required for non-federal entities that spend $1,000,000 or more in federal awards during a fiscal year. Single audit programs follow both generally accepted government auditing standards and the OMB’s Uniform Guidance, and they require a risk-based approach to determine which federal programs count as “major programs” subject to detailed testing.10eCFR. 2 CFR Part 200 Subpart F Audit Requirements
Operational Audit Programs
Operational audits look at how efficiently and effectively a business process runs rather than at the accuracy of financial numbers. Scope can cover supply chain logistics, manufacturing throughput, IT operations, or HR practices. The output is usually recommendations to management, not a formal opinion.
IT Audit Programs
IT audit programs address risks that don’t show up in traditional financial testing: access controls, backup and recovery, network security and encryption, system change management, and compliance with frameworks like HIPAA or PCI-DSS. Because financial processes now run through technology, IT findings often affect the financial statement audit directly. A material weakness in IT general controls can undermine the reliability of every automated control and system-generated report the financial auditors planned to use.
Internal vs. External Programs
External audit programs are designed to produce an opinion for outside stakeholders like investors and regulators. Internal audit programs serve the organization’s own management and board and tend to cover a broader range of topics, including risk management, operational efficiency, and strategic alignment. External programs are generally more detailed in their financial testing because of the higher assurance standard required.
How Technology Is Changing the Program
Programs today look different from those written a decade ago. Instead of pulling a sample of 50 invoices from a population of 10,000, auditors can use technology-assisted analysis to scan entire transaction populations and flag anomalies, unusual patterns, or items outside expected parameters. The auditor’s work shifts from manually vouching documents toward investigating the exceptions the technology surfaces.
The PCAOB has amended its standards on audit evidence (AS 1105) and risk responses (AS 2301) to address technology-assisted analysis, defined as analyzing information in electronic form with technology-based tools. The amendments take effect for audits of fiscal years beginning on or after December 15, 2025, and are meant to keep auditors accountable for obtaining sufficient appropriate evidence rather than accepting technology outputs at face value.11Public Company Accounting Oversight Board. Amendments Related to Aspects of Designing and Performing Audit Procedures that Involve Technology-Assisted Analysis of Information in Electronic Form AI and machine learning tools are also being used for continuous monitoring, tracking controls and risk indicators in real time and analyzing unstructured data like contracts and emails alongside structured financial data. The technology doesn’t replace the program. It changes what goes into it. Procedures still need to be documented, assigned, and reviewed; some of them now involve configuring and validating automated tools rather than pulling binders of support.
Which Rulebook Applies
The standards governing an audit program depend on the client. Public company audits fall under PCAOB standards, which tend to be more prescriptive. Private company audits follow AICPA clarified auditing standards (the AU-C sections). Both frameworks require a documented plan and procedures responsive to assessed risks, but the requirements around internal control testing and documentation are more extensive for public companies because of the Sarbanes-Oxley integrated audit requirement.8Public Company Accounting Oversight Board. AS 2201 An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements Government audits add another layer: entities subject to the Government Accountability Office’s Government Auditing Standards, commonly called the Yellow Book, have to meet additional requirements around independence, reporting, and program scope.12U.S. Government Accountability Office. Government Auditing Standards 2024 Revision When federal funds are involved and the Single Audit threshold is met, Uniform Guidance requirements apply on top.
Retention requirements track the same public/private split. Sarbanes-Oxley requires audit firms to retain documentation on public company engagements for at least seven years from the report release date, with 45 days after that date to assemble the complete final set.13Public Company Accounting Oversight Board. AS 1215 Audit Documentation Appendix A AICPA standards for private company engagements require retention for at least five years from the report release date. If the engagement is later selected for PCAOB inspection or peer review, the program and workpapers are what the reviewers pull first.