Module II: Audit Plan, Process, Documentation, and Internal Control
The Operational Architecture of an Audit Engagement
The successful execution of an independent audit depends upon methodical planning, structured documentation, and an in-depth evaluation of the entity's internal control architecture. Under the Standards on Auditing issued by the Institute of Chartered Accountants of India (ICAI)—specifically SA 300 (Planning), SA 230 (Documentation), SA 315 (Identifying and Assessing Risks of Material Misstatement), and SA 320 (Materiality)—auditing is conducted not as an ad-hoc inspection, but as a disciplined, risk-based operational process designed to accumulate sufficient appropriate audit evidence with maximum efficiency and professional skepticism.
1. Preliminary Engagement Activities and Preparation Before Audit
Prior to initiating substantive audit procedures or designing detailed audit plans, the auditor must perform rigorous preliminary engagement activities. These preliminary procedures establish whether the professional, statutory, and ethical conditions for accepting or continuing an audit engagement are fulfilled.
Client Acceptance and Continuance (SA 220 & SQC 1)
- Integrity of Management: Assessing the commercial reputation, corporate governance record, and operational integrity of owners, directors, and key management personnel.
- Engagement Team Competence: Evaluating whether the audit firm has the necessary technical capabilities, industry knowledge, professional personnel, and time resources.
- Ethical Requirements & Independence: Ensuring absolute compliance with independence rules, eliminating self-interest, self-review, or familiarity threats.
- Communication with Predecessor Auditor: In India, under Clause 8 of Part I of the First Schedule to the Chartered Accountants Act, 1949, communicating with the previous auditor in writing is mandatory prior to acceptance.
Preconditions for an Audit (SA 210)
- Acceptable Financial Reporting Framework: Confirming that the financial statements will be prepared in accordance with applicable frameworks (Ind AS, AS, Schedule III).
- Management's Acknowledged Responsibility: Obtaining written acknowledgment from management regarding their responsibility for:
- Preparation and fair presentation of financial statements.
- Design, implementation, and maintenance of adequate internal controls.
- Providing the auditor unrestricted access to all records, documentation, personnel, and additional information requested.
The engagement letter documents and confirms the auditor's acceptance of the appointment, the objective and scope of the audit, the extent of the auditor's responsibilities to the client, the form of any reports, and the responsibilities of management. It serves as an indispensable bilateral legal contract that mitigates misunderstandings regarding scope, liabilities, and inherent limitations of the audit.
2. Audit Planning: Principles, Architecture, and Benefits (SA 300)
Standard on Auditing (SA) 300, "Planning an Audit of Financial Statements," mandates that the auditor plan the audit so that it will be performed in an effective and timely manner. Audit planning is not a discrete, isolated phase of an audit; rather, it is a continuous and iterative process that often begins shortly after (or in connection with) the completion of the previous audit and continues until the completion of the current audit engagement.
Overall Audit Strategy vs. Detailed Audit Plan
Under SA 300, the planning process involves two interconnected structural instruments:
- Overall Audit Strategy: Sets the overarching scope, timing, and direction of the audit, guiding the development of the more detailed audit plan. It determines resource allocation (e.g., assigning experienced seniors to complex risk areas, engaging IT audit specialists, scheduling interim versus year-end verification dates).
- Detailed Audit Plan: More operational and granular than the overall strategy. It outlines the specific Nature, Timing, and Extent (NTE) of risk assessment procedures (SA 315), tests of controls (SA 330), and substantive audit procedures to be performed at the assertion level for each material class of transactions, account balance, and disclosure.
Tangible Benefits of Rigorous Audit Planning
- Focus on Critical Risk Domains: Directs audit attention to areas with high risk of material misstatement (e.g., complex revenue recognition, subjective fair value valuations, related-party transactions).
- Early Resolution of Complex Issues: Enables the timely identification and resolution of potential problems, disputed accounting treatments, or statutory ambiguities before reporting deadlines.
- Optimal Team Organization and Deployment: Facilitates proper selection, briefing, and allocation of engagement team members based on specialized industry skills and experience.
- Effective Direction and Supervision: Provides a clear supervisory framework for the audit manager and engagement partner to direct, review, and evaluate the work of junior audit assistants.
- Coordination with External Experts: Simplifies coordination with component auditors (SA 600), internal auditors (SA 610), and external valuation or actuarial experts (SA 620).
- Operational Economy and Speed: Prevents duplication of effort, avoids unproductive rabbit holes, and ensures adherence to statutory reporting schedules without budget overruns.
3. The Audit Program: Nature, Design, and Specimen Framework
An audit program is a detailed, written operational blueprint containing a series of systematic instructions and procedures to be executed by audit assistants to gather sufficient appropriate audit evidence. It translates the broad audit plan into daily actionable tasks, specifying the exact verification steps for every financial statement item.
Merits of an Audit Program
- Clear Distribution of Work: Clearly assigns duties and operational boundaries to individual audit assistants based on capability.
- Fixing Individual Accountability: Audit staff sign or initial each completed audit step, establishing clear personal responsibility for negligent oversight.
- Progress Tracking and Monitoring: Enables the audit partner or manager to monitor completed vs. pending audit tasks at any point during the audit.
- Documentary Defense Against Negligence: Serves as conclusive documentary evidence in court of the thoroughness and due care exercised by the auditor.
- Uniformity and Continuity: Ensures that successive audits across financial years maintain consistent quality and procedural depth.
Demerits and Rigidity (With Safeguards)
- Mechanical Routine & Loss of Initiative: Assistants may treat the program as a mechanical checklist, checking boxes without exercising active professional skepticism.
- Lack of Flexibility: Rigid adherence to a pre-printed program may prevent assistants from investigating suspicious anomalies not explicitly listed.
- Inadequate for Varied Entities: Standardized programs cannot address unique operational complexities across diverse manufacturing or financial clients.
- Essential Safeguards:
- Maintain the program as an open-ended, dynamic document subject to continuous modification.
- Encourage assistants to report unexpected patterns and suggest new audit procedures.
Specimen Substantive Audit Program: Audit of Trade Receivables (Sundry Debtors)
| Step No. | Audit Procedure / Operational Instruction | Standard / Ref. | Performed By & Sign |
|---|---|---|---|
| 1 | Extract aged debtor trial balance; reconcile total balance with general ledger control account. | SA 330 Substantive | Audit Senior (Initials) |
| 2 | Select sample of customer balances for direct external confirmation using positive confirmation letters. | SA 505 External Conf. | Audit Assistant (Initials) |
| 3 | Investigate and reconcile confirmation discrepancies, disputes, and timing differences (e.g., cash in transit). | SA 505 / SA 500 | Audit Senior (Initials) |
| 4 | Perform alternative audit procedures on non-replies (examine subsequent cash receipts, shipping notes, invoices). | SA 505 Alternative | Audit Senior (Initials) |
| 5 | Perform sales cut-off testing 5 days before and 5 days after balance sheet date to ensure proper period allocation. | SA 500 Cut-off | Audit Assistant (Initials) |
| 6 | Review aged analysis and evaluate adequacy of provision for bad and doubtful debts (ECL model under Ind AS 109). | SA 540 Accounting Est. | Engagement Partner |
4. Audit Documentation and Working Papers (SA 230)
Standard on Auditing (SA) 230, "Audit Documentation" (historically termed "Working Papers"), defines audit documentation as the record of audit procedures performed, relevant audit evidence obtained, and conclusions the auditor reached. It represents the comprehensive documentary bridge between the entity's underlying accounting records and the independent auditor's report.
Nature and Dual Purpose of Audit Documentation
Audit documentation serves two fundamental, legally vital purposes:
- Primary Purpose: Provides tangible, verifiable evidence of the auditor's basis for a conclusion about the achievement of the overall objectives of the auditor; and conclusive evidence that the audit was planned and performed in accordance with SAs and applicable legal and regulatory requirements.
- Secondary Operational Purposes:
- Assisting the engagement team to plan and perform the audit.
- Assisting members of the engagement team responsible for supervision to direct and supervise the audit work.
- Enabling the engagement team to be accountable for its work.
- Retaining a record of matters of continuing significance to future audits.
- Enabling the conduct of quality control reviews and inspections under SQC 1 and regulatory inspections by NFRA or ICAI Peer Review Board.
Form, Content, and Extent of Documentation: The Experienced Auditor Test
Under SA 230, the auditor must prepare audit documentation that is sufficient to enable an experienced auditor, having no previous connection with the audit, to understand:
- The nature, timing, and extent of the audit procedures performed to comply with the SAs and applicable legal and regulatory requirements.
- The results of the audit procedures performed, and the audit evidence obtained.
- Significant matters arising during the audit, the conclusions reached thereon, and significant professional judgments made in reaching those conclusions.
Classification of Audit Files: Permanent vs. Current Audit Files
To ensure systematic organization, audit documentation is traditionally segregated into two distinct files:
Permanent Audit File (PAF)
Contains information of continuous and recurring importance that remains relevant across multiple successive financial years:
- Memorandum and Articles of Association (MoA & AoA), Partnership Deeds, or Trust Deeds.
- Extracts of legal documents, long-term lease agreements, patent registrations, and loan debenture covenants.
- Historical analysis of share capital structure, reserves, and debt profiles.
- Detailed descriptions of the organizational hierarchy, accounting systems, and internal control flowcharts.
- Historical financial ratios, previous year audited statements, and long-term tax assessment orders.
Current Audit File (CAF)
Contains operational documentation relating strictly to the single financial year currently under examination:
- Current year's signed Engagement Letter (SA 210) and Management Representation Letter (SA 580).
- Current Overall Audit Strategy, Detailed Audit Plan, and completed Audit Programs.
- Trial balance, working balance sheet, and draft financial statements with lead schedules.
- Vouching schedules, substantive testing working papers, and bank/debtor confirmation replies.
- Audit query sheets, record of significant professional judgments, and engagement quality review notes.
Ownership: In the landmark English decision Chantrey Martin & Co. v. Martin (1953), upheld by the ICAI Council, it was ruled that audit working papers are the exclusive property of the auditor. The client has no legal right to demand custody or inspection of the auditor's working papers.
Confidentiality: The auditor is ethically bound under the ICAI Code of Ethics to maintain absolute confidentiality regarding information acquired during the audit. Working papers cannot be disclosed to any third party without specific client authorization, unless there is an overriding legal or professional duty (e.g., court subpoena, NFRA summons, or tax authority search warrant).
Retention Period: In accordance with Standard on Quality Control (SQC) 1, the retention period for audit engagements ordinarily is not shorter than seven (7) years from the date of the auditor's report (or group auditor's report, if later).
5. Internal Control, Internal Check, and Internal Audit
The credibility and efficiency of an audit depend directly upon the strength of the client's internal operational architecture. Standard on Auditing (SA) 315 and the global COSO (Committee of Sponsoring Organizations) framework define internal control comprehensively.
Internal Control Defined (SA 315 / COSO Framework)
Internal Control is the process designed, implemented, and maintained by those charged with governance, management, and other personnel to provide reasonable assurance about the achievement of an entity's objectives with regard to:
- Reliability of financial reporting.
- Effectiveness and efficiency of business operations.
- Safeguarding of enterprise assets against unauthorized acquisition, use, or disposition.
- Compliance with applicable laws, regulations, and statutory mandates.
The Five Integrated Components of Internal Control
| COSO Component | Operational Essence & Meaning | Practical Business Example |
|---|---|---|
| 1. Control Environment | The "tone at the top." Governance philosophy, ethical values, board independence, and management's commitment to competence. | Corporate code of conduct, active independent audit committee, whistleblower hotline. |
| 2. Risk Assessment Process | How management identifies, analyzes, and manages business, operating, and financial risks relevant to financial reporting. | Formal enterprise risk management (ERM) matrix assessing FX volatility, supply chain risks, cyber threats. |
| 3. Information System & Communication | Procedures and records established to initiate, record, process, and report entity transactions and maintain accountability. | Integrated ERP software (SAP S/4HANA) with automated audit trails and real-time ledger updates. |
| 4. Control Activities | Policies and procedures that help ensure management directives are carried out to mitigate identified risks. | Dual authorization for fund transfers, segregation of duties, physical access badges, periodic reconciliations. |
| 5. Monitoring of Controls | Ongoing evaluations and separate reviews to ascertain whether components of internal control are functioning effectively. | Internal audit departmental audits, routine supervisory oversight, post-implementation reviews. |
Tools Used by Auditors to Evaluate Internal Control
Before relying on internal controls to reduce substantive testing, the auditor must document and evaluate control design and operating effectiveness using four primary tools:
- Narrative Records: A written, sequential description of the system from transaction initiation to final financial statement recording. Best suited for simple, linear accounting systems in smaller enterprises.
- Checklists: A structured list of questions or instructions requiring simple yes/no responses. Used to verify whether specific control routines have been observed.
- Internal Control Questionnaire (ICQ): A comprehensive, pre-designed set of structured questions addressed to client management. Questions are designed such that a "Yes" indicates an effective control, while a "No" signifies a control deficiency requiring expanded substantive testing.
- Flowcharts: A graphical representation of the sequential flow of documents, operational operations, and authorization points across various enterprise departments. Highly effective for visualizing segregation of duties and identifying bottlenecks.
6. Internal Check: Operational Workflows in Critical Commercial Areas
Internal Check is an arrangement of accounting routines and operational duties whereby work performed by one employee is independently and automatically checked by another employee in the ordinary course of business, without duplication of effort.
Internal Check: Cash Receipts & Banking
- Mail Opening: Incoming mail containing cheques opened by two independent clerks; cheques immediately crossed "Account Payee Only."
- Listing & Register: Cheques and remittances entered immediately into a Rough Cash Book / Remittance Register.
- Receipt Generation: Official printed, sequentially pre-numbered receipts issued; electronic receipts automatically sent to payees.
- Daily Banking: Total cash and cheques deposited into the bank intact every afternoon; bank paying-in slips verified by head cashier.
- Segregation: Cashiers prohibited from making entries into debtors' ledgers or dispatching account statements to customers.
Internal Check: Cash Payments & Disbursements
- Three-Way Match: Payment vouchers prepared only upon matching the Purchase Order (PO), Goods Received Note (GRN), and Supplier Invoice.
- Hierarchical Sanction: Payments sanctioned exclusively by designated signing authorities based on financial delegation limits.
- Dual Signatures: All cheques or electronic RTGS/NEFT transfers require dual authorization (e.g., Finance Director + Plant Head).
- Voucher Cancellation: Supporting invoices immediately stamped "PAID & CANCELLED" with date and cheque number to prevent duplicate presentation.
- Petty Cash: Maintained strictly under the Imprest System with independent monthly physical verification.
Internal Check: Purchases & Trade Payables
- Purchase Requisition: Initiated by authorized storekeeper only when stock drops to re-order level; approved by departmental head.
- Tendering & Quotations: Purchase department solicits competitive quotations from approved vendors; evaluated by Purchase Committee.
- Purchase Order (PO): Pre-numbered POs issued; copies distributed to stores, inspection, accounts, and supplier.
- Goods Receipt & Inspection: Storekeeper prepares Goods Received Note (GRN); quality inspection team tests raw material specifications.
- Invoice Verification: Accounts department verifies arithmetic calculations, discounts, GST rates, and matches PO, GRN, and invoice.
Internal Check: Credit Sales & Debtors
- Order Processing: Customer orders reviewed and verified for terms, pricing, and product availability.
- Credit Approval: Credit department conducts independent solvency check and formally sanctions credit limits prior to order acceptance.
- Warehouse Dispatch: Goods dispatched only against authorized Sales Invoices / Delivery Challans signed by store manager.
- Invoice Preparation: Invoices generated electronically from dispatch data; sequentially numbered with automated ledger posting.
- Periodic Statements: Independent credit controllers dispatch monthly statements of accounts directly to customers for balance confirmation.
7. Audit Materiality and the Audit Risk Architecture (SA 320 & SA 315)
Auditing is inherently bounded by the concept of materiality. It is both economically impossible and practically unnecessary for the auditor to examine every single rupee of corporate transaction. Under Standard on Auditing (SA) 320, "Materiality in Planning and Performing an Audit," information is material if its omission or misstatement could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements.
The Three Levels of Materiality (SA 320)
- Overall Materiality (Financial Statement Level): The overarching monetary threshold established for the financial statements as a whole. Commonly determined using professional benchmarks:
• 0.5% to 1% of Gross Revenue / Turnover; or
• 5% to 10% of Profit Before Tax (PBT) for profit-oriented entities; or
• 1% to 2% of Total Assets / Equity. - Performance Materiality: The amount or amounts set by the auditor at less than materiality for the financial statements as a whole (typically set at 60% to 80% of overall materiality) to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality for the financial statements as a whole.
- Specific / Assertion-Level Materiality: Thresholds set for specific sensitive transaction classes, account balances, or disclosures where misstatements of lesser amounts than overall materiality could influence users (e.g., related-party transactions, directors' remuneration, statutory non-compliance penalties).