4042 Audit Scope and Approach

Dec-2022

What CSAE 3001 means for determining the audit scope and approach

CSAE 3001 requires that the audit team consider the concept of significance when planning and performing the assurance engagement, including when determining the audit approach (i.e. determining the nature, timing, and extent of procedures). An audit of a significant matter is one that may influence the decisions of the “intended users” (members of Parliament for performance audits and board of directors of the Crown corporation for special examinations).

CSAE 3001 also requires that the audit team obtains an understanding of the subject matter in order to be able to identify and assess the risks of significant deviations and provide the basis for designing and performing audit procedures to respond to the assessed risks and obtain sufficient appropriate evidence to support the audit conclusion.

The audit team bases its audit scope and approach on its understanding of the subject matter, its significance, and an assessment of the risks of deviations. The concepts of audit scope and approach are inter-related. Together with the audit objective (OAG Audit 4041 Audit objectives) and criteria (OAG Audit 4043 Audit criteria), they form the overall audit design. For more information, see OAG Audit 4010 Understanding the subject matter in planning an audit, OAG Audit 4020 Risk assessment, OAG Audit 4025 Internal controls, and OAG Audit 4044 Developing the audit strategy: audit logic matrix.

Identifying Audit Scope and Approach

Audit scope

The audit scope includes a description of what elements are included in the audit. Typically, scope includes the following three elements:

• what entities (or parts thereof) are included in the audit,
• what programs or activities or functions are included in the audit, and
• what is the period covered by the audit.

Scoping decisions include a rationale for including key elements as well as for elements explicitly not included.

Audit approach

The audit approach corresponds to the nature, extent, and timing of the work being undertaken in order for the audit team to provide reasonable assurance to the intended user of the report on the audit conclusion, against the audit objective.

Key considerations for audit scope and approach

The planning phase involves the important tasks of elaborating a detailed approach; documenting the nature, timing, and extend of procedures to be performed; and the reasons for selecting them. This work is iterative and is not necessarily undertaken in a linear fashion. It ensures that the audit team has a good understanding of what work to undertake and how to undertake it. It also helps ensure that sufficient appropriate evidence will be obtained to provide a reasonable basis to support the conclusion expressed in the report. The team should document the professional judgments used to make the selection of procedures to be performed and other key decisions during the planning phase. The audit logic matrix (OAG Audit 4044 Developing the audit strategy: audit logic matrix) and other risk tools and templates (OAG Audit 4020 Risk assessment) will help auditors document the decisions made and logic used.

The audit team needs to consider the following elements when making decisions about scope and approach:

• significance,
• auditability,
• period under examination,
• lines of enquiry,
• suitability of criteria,
• inclusion of follow-up work,
• using the work of others,
• audit effort required during the examination phase,
• evidence-gathering techniques and testing strategies required.

With the exception of suitability of criteria that is discussed under OAG Audit 4043 Audit criteria, each of these considerations are covered in the following sections.

Matters of significance

Carefully scoping the audit early in the process helps increase its efficiency and effectiveness. The statement of scope should be clear about any related areas that are not included. This information is set out in the audit logic matrix (OAG Audit 4044 Developing the audit strategy: audit logic matrix) along with planning documents provided to entities, such as the audit plan summary (OAG Audit 4090 Audit plan summary for performance audits), or the Special Examination Plan (OAG Audit 4100 Special examination plan). OAG Audit 7030 Drafting the audit report sets out how scoping considerations are described in the audit report.

The audit team identifies matters of significance to include in the scope of an audit, based on an understanding of the subject matter, risk assessment, and an evaluation of internal controls (if relevant).

Auditability

Auditability relates to the ability to carry out the audit according to professional standards and audit policies. Although some areas may be significant, they may not be auditable for one or more of the following reasons:

• the area is outside the mandate of the OAG;
• the audit team does not have or cannot acquire the required expertise;
• the area is undergoing significant and fundamental change;
• suitable criteria or approaches are not available to assess performance; or
• the information or evidence required is not available or cannot be obtained efficiently.

The audit team should refer to its assessment of engagement risk when considering auditability (OAG Audit 4020 Risk assessment).

Period covered by the audit

Another consideration relevant to the scope is the period covered by the audit. This is the time frame covered by the audit work for which a conclusion will be formed; for example, the three fiscal years before the audit.

The audit team may decide to have a shorter audit period, such as one-year. However, in consultation with the OAG Internal Specialist Research and Quantitative Analysis, the team may analyze multiple years of data to ensure sufficient appropriate evidence that includes a longer term trend analysis.

An important consideration when selecting the period covered by the audit is that the audit team must obtain sufficient appropriate evidence to conclude on the audit objective. It is important that the collective weight of the evidence provides persuasive support for the findings in the report (OAG Audit 1051 Sufficient appropriate audit evidence).

The audit team should select a time frame to enable it to assess the entity’s performance against the criteria for a period that is long enough to cover any events that the team wants to take into account, such as a change in operations. The audit team should examine all parts of the audit period. If different lines of enquiry or different audit tests cover different time periods, this should be disclosed in the About the Audit section of the report. The team should also include a rationale for the period(s) chosen. For example:

“The audit will assess practices in place during the period of the audit, 1 April 2019 to 31 March 2020. To assess whether commitments and standards reflect client needs and the organizations’ responsiveness to service quality issues, we also examined the files for activities that occurred during the period of 1 July 2017 to 31 March 2020. This three-year span was selected as there were significant changes to service delivery approaches in June 2019 and we expected to see evidence of the results of these changes.”

Lines of enquiry

Lines of enquiry are a way to organize the audit work and correspond to areas to be audited within the scope. Lines of enquiry address the issues that the audit team wants to examine. Each line of enquiry should clearly address the risks identified in the team’s risk assessment (OAG Audit 4020 Risk assessment).

The number of lines of enquiry may depend on the nature, scope, and complexity of the audit issues and the value that each line of enquiry will be adding. Lines of enquiry are organized around audit issues, subject areas, systems and practices, or stages in a process. For example, for an audit of contracting, there could be lines of enquiry for the contract awarding process, the administration of contracts, and payment.

Lines of enquiry are determined to help the audit team finalize its audit approach as documented in the audit logic matrix. See OAG Audit 4044 Developing the audit strategy: audit logic matrix.

Inclusion of follow-up work

The team determines if any recommendations or issues from previous audits will be included in the scope. In determining the audit approach to address past issues, teams should consider the action taken by management to address the issues and whether it has a reasonable level of assurance on actions taken in response. For follow-up work on a matter that has previously been audited, the audit team may change or broaden the scope to consider changing circumstances or the emergence of new risks since the time of the original audit.

Audit issues from the original audit may also be dropped for the follow-up work, if they are no longer of interest, no longer pose a significant risk, or become irrelevant or obsolete. The rationale for dropping them is documented in the audit file.

Using the work of others

While scoping the audit and determining the audit approach to be followed, the team needs to determine the possibility of using the work of others and relying on it. The team can consider relying on the work of internal audit; using the work of audited entity’s experts; and/or involving internal or external experts to assist with aspects of the audit work for which the team does not have sufficient experience or expertise.

As explained under OAG Audit 2070 Use of experts, OAG Audit 4030 Reliance on internal audit and OAG Audit 4045 Evidence-gathering methods, the team needs to assess whether the work performed by others is relevant before using it for the audit. It also needs to assess whether reasonable assurance can be obtained concerning the expertise, competence, and integrity of external experts and/or internal auditors.

Relying on the work of others and on existing information could reduce the number of hours and the extent of audit effort required.

Determining nature and extent of procedures including limitations

During planning, in order to allocate sufficient resources to the audit project, the audit team assesses and documents the expected extent of audit effort required to obtain reasonable assurance. This assessment requires professional judgment and should consider the concepts of significance (OAG Audit 2020 Significance) and risk, including the impact on engagement risk (OAG Audit 4020 Risk assessment).

Determining the nature and extent of audit procedures is also driven by sources of evidence as set out in the audit logic matrix (see OAG Audit 4044 Developing the audit strategy: audit logic matrix), by evidence-gathering techniques to be used during the audit (OAG Audit 4045 Evidence-gathering methods) and possible scope limitations (i.e. inability to obtain sufficient appropriate evidence), and its impact on the conclusion (OAG Audit 7040 Audit conclusion).

Next steps

The audit scope and approach, including lines of enquiry, should be included in the audit logic matrix (OAG Audit 4044 Developing the audit strategy: audit logic matrix), which also includes the objectives, criteria and their sources, audit questions, data sources, and other information. The team must document its scope and approach decisions and the professional judgment exercised. The use of templates and tools discussed in OAG Audit 4020 Risk assessment and OAG Audit 4025 Internal controls facilitate the teams’ documentation.