4070 Audit Programs

Nov-2018

What the CSAE 3001 means for developing audit programs

The CSAE 3001 requires that audit team members design audit procedures to respond to the identified risks of significant deviation in order to obtain reasonable assurance to support the audit conclusion. When designing audit procedures, the CSAE 3001 also requires audit team members to consider the objective, scope, timing, and direction of the engagement, as well as the reliability and relevance of information to be used as evidence.

The audit programs are essential “maps” of how the team will obtain evidence to assess entities against the criteria and conclude against the objective. Audit team members should be aware of the potential need to modify the audit programs during the course of the audit as a result of evidence obtained, unexpected events, or changes in conditions of the audit.

Developing audit programs

As the audit logic matrix is being finalized, the audit team begins developing audit programs. Audit programs provide more detail than the audit logic matrix on the audit steps to be covered during the examination phase. Audit programs should be of sufficient detail to clearly communicate the nature of the work to be done, to ensure that the audit team members understand their responsibilities and to track progress. If audit procedures are incorporated in the ALM instead of developing separate audit programs, requirements in this section must still be followed.

The audit programs should be developed to collect sufficient appropriate audit evidence (OAG Audit 1051 Sufficient appropriate audit evidence) and to respond to the risks of significant deviation identified during the planning phase (OAG Audit 4020 Risk assessment) in order to obtain reasonable assurance to support the conclusion.

Each audit program includes

• the overall audit objective(s);

• the relevant line(s) of inquiry, criteria, and audit questions (as well as the systems and practices selected for special examination);

• the approach and methodology to be used for gathering evidence (e.g. sampling, review of documentation);

• the planned reliance on work performed and/or reports prepared by internal audit, OAG internal specialists, and consultants and specialists engaged by the entity (and the work performed by the annual audit team, if relevant);

• the information to be requested from entities;

• how the evidence will be analyzed;

• assignment of responsibilities to team members; and

• the estimated budget and timeline for each step and the resources required.

There are many ways to collect the data that will provide the required audit evidence. Questions about the best way to gather the right kind of data for analysis begin when the audit team is developing the audit logic matrix (OAG Audit 4044 Developing the audit strategy: audit logic matrix). The audit objectives and criteria determine the kind of data to be gathered, the appropriate tests, and the type of analysis to be conducted. OAG Audit 4045 Evidence-gathering methods and OAG Audit 1052 Audit procedures for obtaining audit evidence provides information on the data-gathering methods.

Audit teams consult relevant internal specialists when developing audit programs.

Resourcing the audit based on the planned work

Audit programs are the basis for developing detailed budgets for the examination and reporting phases of the audit. Once the audit team has determined the work that is required for the audit, work is allocated by team member and by month in order to develop the final budget for the audit. The audit director should do this keeping in mind the availability, level, and experience of team members; a realistic estimate of the time required for each task; and any other constraints.

Approval of audit programs

Audit programs (or audit procedures in the ALM) are developed by team members and approved by the audit director. Significant changes or subsequent modifications to the audit programs (or audit procedures in the ALM) should be documented by the team and approved by the audit director.

Next steps

As work proceeds in the examination phase, the audit team documents the work performed and the findings for each step. As a result of evidence obtained in the course of the audit, unexpected events or changes in conditions of the audit, audit programs might need to be modified. The auditor evaluates such information in terms of its impact on the audit programs and amends them when appropriate.

OAG Audit 7021 Evaluate the sufficiency and appropriateness of audit evidence describes the process for completing the audit program and analyzing audit evidence to ensure it is sufficient and appropriate.

Once completed, audit programs are the basis upon which the engagement leader will determine if sufficient appropriate evidence has been gathered to draw a conclusion against the audit objective (OAG Audit 7040 Audit conclusion).