The overall audit strategy and audit plan
What ISA 300 expects in the overall audit strategy and the detailed audit plan, who approves them, and how both stay current as the audit changes.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Ask a partner where the audit strategy for a recurring client is, and the answer is often "in my head, and in last year's file". The partner may well know the client better than any document could describe it. The trouble starts when the senior who does the work was not in that head, when the reviewer asks why inventory was tested at an interim date, or when an inspector asks to see the planning that shaped the whole engagement.
ISA 300 separates planning into two documents with different jobs: the overall audit strategy and the audit plan. Neither needs to be long on a small audit. Both need to exist, be approved by the right person and change when the audit changes.
Two documents, two jobs
The overall audit strategy sets the scope, timing and direction of the audit and guides the development of the plan. It is the partner's view of the engagement: what kind of audit this is, where the risk sits, when the work happens and who does it.
The audit plan is the detail beneath it. ISA 300 requires it to describe the nature, timing and extent of the planned risk assessment procedures, the further audit procedures at assertion level, and any other procedures needed to comply with the ISAs.
A useful test: the strategy should make sense to someone who never opens a working paper; the plan should tell a senior exactly what to do on Monday morning.
| Question | Answered in |
|---|---|
| What framework, reporting deadlines and locations shape the audit? | Strategy |
| Which areas carry the most risk, and what is materiality? | Strategy |
| Which team members, specialists and reviewer are needed, and when? | Strategy |
| Which procedures respond to each assessed risk, at which assertion? | Plan |
| How many items, from which population, at what date? | Plan |
Scope, timing and direction
In setting the strategy, ISA 300 asks the engagement team to identify the characteristics that define the scope, such as the financial reporting framework, any industry-specific reporting and the locations involved. It asks for the reporting objectives, so the timing of the audit and of communications can be planned around deadlines. It asks for the factors that will direct the team's effort: materiality, areas of higher risk, significant changes in the business or its reporting, and what was learnt from the preliminary engagement activities and earlier work for the client.
On a small owner-managed company this can be a short memorandum. It should still answer real questions. Is this the first year on IFRS for SMEs? Has the client changed its accounting package? Is there a bank covenant date that makes the reporting deadline non-negotiable? A strategy that could be pasted onto any client is not doing its job.
Team, specialists and the quality reviewer
The strategy also decides resources: who is on the team, how much senior time goes to the risky areas, whether a valuer or IT specialist is needed, and whether there will be an engagement quality reviewer.
In Achekam, a partner can name an engagement quality reviewer for an engagement. The reviewer must be a partner or senior manager not on the engagement team, and must clear the audit report before it can be issued. For a South African firm, Achekam does not require a reviewer for any engagement type; naming one is the firm's decision, made under its own quality management policies. Make that decision at planning, not at the end, so the reviewer sees significant judgements while they can still change the work.
Specialists can be recorded on an audit through the Specialists & Experts screen. Do not plan around the Audit Resource Pools and Delivery Centres screens: they stay empty because no route or screen adds a pool or a centre.
For timing, staff can compare each engagement's planned hours with the hours logged, and see a people-by-weeks capacity plan in which a week with no capacity recorded shows as "not set". That is a quick way to check that the strategy's timetable has the people behind it.
Recording and approving the strategy
In Achekam, the audit strategy is recorded and approved on the Planning screen. Materiality, which the strategy depends on, is proposed separately with a benchmark and written rationale and approved by the engagement partner, never the preparer; Achekam suggests no percentage. How that approval works is covered in setting and approving materiality on an audit.
The Engagement Control Tower saves its work on the server for the chosen engagement, which makes it a natural home for the engagement-level overview. Treat the ISA numbers on its badges as labels, not evidence that the standard has been met; the evidence is what the team records.
From strategy to plan: generating the papers
The plan becomes concrete when the working papers exist. Achekam can generate an engagement's working papers from the methodology: it reads the engagement's facts, a person confirms what it cannot read, another person approves the profile, and a dry run shows which papers will be created before any are. A sole practitioner may approve their own profile with a written attestation. The steps are described in generating working papers from the methodology.
Once generated, the papers sit in the Working Paper Control Centre, which shows the file as an index with progress by status and can group the same papers by preparer, reviewer, risk or statement line. Grouped by risk, the index is a fair picture of the plan: each risk, and the papers that answer it.
Updating the plan as the audit moves
ISA 300 expects the strategy and plan to be updated as necessary during the audit, and requires the file to record significant changes and the reasons for them. Common triggers:
- draft figures that move materiality or reveal a balance larger than expected;
- a control the plan relied on that turns out not to operate;
- a new transaction, such as a property disposal or a loan restructure;
- a change of client staff or system partway through the year.
When one of these happens, change the plan and write down why. If materiality changes, have it re-approved; in Achekam a new approval replaces the old one, which is kept, so the file shows both.
A planning checklist
- Write the strategy before fieldwork starts, in terms specific to this client.
- Decide on an engagement quality reviewer at planning, not at completion.
- Have materiality approved by the engagement partner before samples are planned.
- Generate or prepare the papers so each assessed risk has a response.
- Check the timetable against people's recorded capacity.
- Record every significant change to the strategy or plan, with the reason.
The ACCA's article on planning an audit of financial statements summarises ISA 300's requirements, including the overall strategy, the detailed plan and why planning continues throughout the engagement.
A test for your next file
Give this year's strategy memo to a team member who has never worked on the client and ask them to explain, in a few sentences, where the risk is and why the work is timed as it is. If they cannot, the memo is a form, not a strategy.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
