Audit Planning, Strategy and Materiality

Introduction and context

Audit planning is the disciplined process through which the auditor decides what work is necessary, when it will be performed, by whom, and how the results will support an audit opinion. Planning is not a merely administrative exercise. It connects the auditor’s understanding of the entity and its environment with assessed risks, materiality, audit procedures, staffing, supervision, and communication.

International Standards on Auditing (ISAs), particularly ISA 300, ISA 315 (Revised 2019), ISA 320, ISA 330, and ISA 450, provide the principal framework. Planning begins before detailed testing and continues throughout the engagement. It must be revised when new evidence, unexpected transactions, control deficiencies, or changes in circumstances affect the original risk assessment.

A well-planned audit seeks reasonable assurance—not absolute assurance—that the financial statements are free from material misstatement, whether caused by fraud or error.

Learning objectives

By the end of this chapter, students should be able to:

1. Explain the relationship between audit strategy, audit plan, risk assessment, and audit evidence.
2. Develop an overall audit strategy and a detailed audit plan.
3. Determine overall materiality, performance materiality, and specific materiality where appropriate.
4. Distinguish inherent risk, control risk, and detection risk, including significant risks under revised ISA 315.
5. Allocate audit resources, coordinate specialists, and document supervision and review.
6. Revise audit procedures when evidence changes the initial assessment.
7. Evaluate ethical, technological, and professional implications of planning decisions.

1. The architecture of audit planning

1.1 Overall audit strategy

The overall audit strategy establishes the scope, timing, and direction of the audit and guides the development of the more detailed audit plan. It ordinarily addresses:

• reporting objectives and deadlines;
• significant characteristics of the engagement, such as the reporting framework, locations, subsidiaries, and industry;
• preliminary materiality considerations;
• areas with higher assessed risks, including fraud risks and significant risks;
• reliance on internal controls and use of substantive procedures;
• involvement of component auditors, internal auditors, IT auditors, valuation specialists, tax specialists, or other experts;
• allocation of work among partners, managers, seniors, assistants, and specialists;
• communications with those charged with governance; and
• the expected use of technology, including data analytics.

The strategy is high-level. It should not become a checklist that mechanically dictates procedures before the auditor understands the entity.

1.2 Detailed audit plan

The audit plan translates the strategy into procedures. For each relevant assertion, class of transactions, account balance, or disclosure, it identifies the nature, timing, and extent of planned risk assessment procedures, tests of controls, and substantive procedures.

A simplified planning relationship is:

The plan should identify who performs each procedure, the expected completion date, the relevant working paper, and the reviewer. It should also explain how procedures respond to assessed risks rather than merely listing standard programs.

1.3 Planning is iterative

Planning does not end when fieldwork begins. For example, an unexpected inventory shortage may increase the assessed risk of inventory existence and valuation. The auditor may then expand attendance at counts, test more locations, involve a specialist, or revise materiality if the entity’s actual results differ substantially from preliminary information.

The auditor documents the reason for significant changes, the effect on procedures, and the conclusion reached.

2. Understanding the entity and assessing risk

ISA 315 requires the auditor to obtain an understanding of the entity and its environment, the applicable financial reporting framework, and the system of internal control relevant to the audit. The purpose is to identify and assess risks of material misstatement at both financial-statement and assertion levels.

2.1 Sources of understanding

Useful sources include:

• prior-year financial statements and audit documentation;
• budgets, forecasts, board minutes, contracts, and management reports;
• discussions with management, internal audit, legal advisers, and operational personnel;
• observation and inspection of processes and facilities;
• industry, regulatory, economic, and technological information;
• walkthroughs of significant transaction flows; and
• preliminary analytical procedures.

Analytical procedures may compare current ratios with prior years, budgets, industry benchmarks, or plausible relationships. They identify unusual trends but do not, by themselves, establish that a misstatement exists.

2.2 Assertions

Assertions are representations by management, explicit or otherwise, embodied in the financial statements. Common assertions include:

Risk assessment should be sufficiently precise. “Revenue is risky” is less useful than “manual year-end sales entries may be recorded without shipment, creating an occurrence and cutoff risk.”

2.3 Inherent, control, and detection risk

Inherent risk is the susceptibility of an assertion to misstatement before considering related controls. It is influenced by complexity, estimation uncertainty, change, subjectivity, fraud incentives, and susceptibility to management bias.

Control risk is the risk that a misstatement that could occur in an assertion will not be prevented, or detected and corrected, on a timely basis by the entity’s internal control.

Detection risk is the risk that audit procedures will not detect a misstatement that exists and that could be material, individually or in combination with other misstatements.

The audit risk model is a conceptual planning model:

where AR is audit risk, RMM is risk of material misstatement, and DR is detection risk. In traditional decomposition, RMM = IR × CR, where IR is inherent risk and CR is control risk. The model illustrates an inverse planning relationship: when assessed RMM is higher, the auditor generally needs to reduce acceptable detection risk through more persuasive, better-timed, or more extensive procedures. It is not a precise statistical calculator and should not be used to justify unsupported numerical probabilities.

2.4 Significant risks under revised ISA 315

Under ISA 315 (Revised 2019), a significant risk is an identified risk of material misstatement that is assessed close to the upper end of the spectrum of inherent risk, or that is required to be treated as a significant risk in accordance with the requirements of another ISA. This is the current formulation; it is not defined merely as a risk that “requires special audit consideration.”

Examples may include complex revenue recognition, major management estimates with high estimation uncertainty, or transactions with related parties outside the normal course of business. The classification depends on the facts and the auditor’s assessment, not on the account title alone.

3. Materiality and performance materiality

3.1 Meaning and purpose

Materiality concerns the magnitude or nature of an omission or misstatement that, individually or in combination, could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements. Materiality is judged in the context of the financial statements as a whole and the needs of users.

Materiality affects:

• the identification and assessment of risks;
• the nature, timing, and extent of audit procedures;
• the evaluation of identified misstatements; and
• the form of the audit opinion.

Materiality is not a substitute for professional judgment. A small misstatement may be material because of its nature—for example, a related-party transaction omitted from disclosure, a breach of a loan covenant, or a fraudulent transaction by senior management.

3.2 Selecting a benchmark

The benchmark should reflect what users consider important. Common benchmarks include profit before tax for a stable profit-oriented entity, revenue for a low-margin or rapidly changing business, total assets for an asset-based entity, and expenditure for some not-for-profit organizations.

A preliminary quantitative calculation can be expressed as:

The percentage is not prescribed universally. The auditor considers size, ownership, financing, industry, volatility, user expectations, and qualitative factors. The calculation is a starting point, not an automatic answer.

3.3 Worked example: overall materiality

Illustrative entity data:

• profit before tax: CU 4,800,000;
• revenue: CU 72,000,000;
• total assets: CU 39,000,000.

Suppose the auditor selects profit before tax and applies 5% as an initial benchmark percentage:

If profit is unusually volatile or affected by a non-recurring gain, revenue or normalized profit may be more representative. The auditor must document why the benchmark and percentage are appropriate.

3.4 Performance materiality

Performance materiality is an amount set below overall materiality to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements exceeds overall materiality. It is not simply a fixed percentage required by ISA 320.

For illustration, if overall materiality is CU 240,000 and the auditor sets performance materiality at 75% after considering the entity’s history of misstatements and control environment:

The percentage is a professional judgment. A history of numerous misstatements, weak controls, or high estimation uncertainty may justify a lower amount.

The auditor may also set a clearly trivial threshold below which misstatements need not be accumulated because they would clearly not be material individually or in aggregate. “Clearly trivial” does not mean “immaterial” in every possible circumstance; it is a substantially lower threshold used for efficient accumulation.

3.5 Specific materiality

For particular classes of transactions, account balances, or disclosures, a lower materiality level may be appropriate where users are likely to focus on that information. Examples include directors’ remuneration, related-party transactions, regulatory capital, or sensitive covenant disclosures.

Materiality is reassessed when actual results become available. If actual profit before tax is CU 3,600,000 and the same 5% benchmark remains appropriate, revised overall materiality would be:

The auditor considers the effect on performance materiality, sample sizes, and completed work. A revision is not automatically required whenever results change; it is required when the changed information makes the original amount inappropriate.

4. Responding to assessed risks

ISA 330 requires the auditor to design and implement overall responses to assessed risks and further audit procedures whose nature, timing, and extent are responsive to those risks.

4.1 Overall responses

Overall responses may include assigning more experienced personnel, increasing supervision, incorporating unpredictability, emphasizing professional skepticism, obtaining more persuasive evidence, or changing the timing of procedures.

For example, where management has a strong incentive to meet earnings targets, the auditor may assign a senior team member to revenue testing, include unpredictable selections, examine post-year-end returns, and increase partner review.

4.2 Tests of controls

Tests of controls evaluate whether controls operated effectively during the period. They are relevant when the auditor intends to rely on controls or when substantive procedures alone cannot provide sufficient appropriate audit evidence for an assertion.

A test of a three-way match may inspect purchase orders, receiving reports, and invoices for evidence of authorization and matching. Testing one carefully selected item can establish that a control exists, but not necessarily that it operated consistently throughout the year.

4.3 Substantive procedures: a mandatory baseline

ISA 330 requires the auditor to design and perform substantive procedures for each material class of transactions, account balance, and disclosure, irrespective of the assessed risks of material misstatement. This requirement is fundamental. Substantive procedures are not merely “normally necessary.”

Substantive procedures consist of substantive analytical procedures and tests of details, used alone or together. Tests of details may inspect invoices, confirm receivables, recalculate depreciation, observe inventory, or examine subsequent cash receipts. Substantive analytical procedures evaluate plausible relationships and investigate significant deviations.

For significant risks, the auditor must perform substantive procedures that are specifically responsive to that risk. Where the response to a significant risk consists only of substantive procedures, those procedures must include tests of details. In addition, substantive procedures must be designed for each material class, balance, and disclosure even where assessed risk is low.

5. Timing, extent, and audit evidence

5.1 Timing

Interim testing can be efficient when controls are stable and the auditor performs roll-forward procedures to cover the remaining period. Year-end testing may be preferable where risk is concentrated near year-end, such as cutoff, unusual journal entries, or management estimates.

Evidence obtained closer to the reporting date may be more relevant for balances subject to change. However, timing decisions must consider the risk of changes between the test date and year-end.

5.2 Extent and sampling

Extent includes sample size and the number of locations, periods, or items tested. It is influenced by risk, tolerable misstatement, expected misstatement, population characteristics, and the reliability of other evidence.

For a simple illustrative random sample, if the population contains 10,000 invoices and the auditor selects 60 items using a defensible sampling method, the sample is not automatically sufficient merely because it is 0.6% of the population. Sufficiency depends on risk and expected deviation or misstatement, not on a universal percentage rule.

If a monetary-unit sampling approach is used, the auditor must follow the assumptions and calculation method of that approach. It should not be confused with classical-variable sampling or attribute sampling. Professional standards require sufficient appropriate evidence, not a predetermined sample percentage.

5.3 Sufficiency and appropriateness

Sufficiency concerns quantity; appropriateness concerns relevance and reliability. Evidence from an independent external source is often more reliable than internally generated evidence, but reliability also depends on the source’s competence, objectivity, and controls over information. More evidence of poor quality does not necessarily compensate for a lack of reliable evidence.

6. Resource allocation, specialists, and group audits

6.1 Assigning the team

The engagement partner should assign work according to competence, experience, independence, time availability, and the complexity of the task. High-risk estimates and significant risks generally require experienced personnel and closer review.

A practical allocation schedule may include:

The auditor remains responsible for the audit opinion. Using an expert does not transfer that responsibility.

6.2 Auditor’s expert and management’s expert

An auditor’s expert assists the auditor in obtaining sufficient appropriate evidence. The auditor evaluates the expert’s competence, capabilities, objectivity, and the adequacy of the expert’s work for the audit purpose.

A management’s expert prepares information used in the financial statements, such as a property valuation or actuarial estimate. The auditor evaluates the expert’s competence and objectivity, understands the work, and assesses whether it supports the related assertions. The auditor cannot simply accept an expert report without critical evaluation.

6.3 Group audits

For a group audit, the group engagement team determines component materiality, communicates instructions, evaluates component risks, and coordinates the work of component auditors. Communication should cover identified risks, ethical and independence requirements, significant findings, uncorrected misstatements, and reporting matters. Geographic distance and time-zone differences should be addressed in the strategy, not left to the end of the engagement.

7. Documentation, supervision, and revision

Audit documentation should enable an experienced auditor with no previous connection to understand the procedures performed, evidence obtained, significant judgments, conclusions, and the basis for those conclusions. Planning documentation commonly includes the engagement acceptance decision, strategy memorandum, materiality calculation, risk assessment, fraud discussion, staffing plan, timetable, audit programs, and changes made during the audit.

Supervision includes directing assistants, monitoring progress, resolving technical issues, reviewing work, and ensuring that conclusions are supported. Review depth should correspond to risk and the experience of the preparer.

The plan must be revised when:

• controls fail more frequently than expected;
• substantive testing identifies an unexpected error pattern;
• a new litigation claim or financing arrangement arises;
• estimates become more uncertain;
• fraud indicators appear;
• actual results make preliminary materiality inappropriate; or
• an intended source of evidence is unavailable or unreliable.

A revised plan should state what changed, why it changed, which risks are affected, what additional procedures are required, and how the conclusions will be communicated.

8. Illustrative case: Northstar Components Ltd

Background

Northstar Components Ltd manufactures electronic parts and reports under an accrual-based financial reporting framework. It has revenue of CU 72 million, profit before tax of CU 4.8 million, and total assets of CU 39 million. The company is close to breaching a debt covenant based on earnings before interest, tax, depreciation, and amortization. Sales staff receive bonuses based on reported annual revenue.

Problem

The preliminary strategy identified revenue occurrence and cutoff, inventory obsolescence, and management bias in estimates as important areas. During interim work, the auditor found several sales invoices dated 30 December for goods shipped on 4 January. Management explained that the goods had been “reserved” for customers.

Analysis

The evidence increases the risk that revenue is recognized before control transfers. The risk is close to the upper end of inherent risk because of incentive, judgment, and the identified exception pattern. It is therefore a candidate for treatment as a significant risk under the revised ISA 315 framework, subject to the auditor’s complete assessment.

The auditor sets initial overall materiality at CU 240,000 and performance materiality at CU 180,000. The plan includes substantive procedures for revenue because it is material, regardless of the risk rating, and procedures specifically responsive to the significant risk.

Approach and solution

The auditor:

1. tests dispatch records and customer acceptance for year-end sales;
2. examines credit notes and returns after year-end;
3. confirms selected customer balances and invoice dates;
4. tests cutoff using shipments immediately before and after year-end;
5. expands testing because the initial exception rate exceeds expectations;
6. evaluates whether controls over shipment and invoicing operated effectively;
7. discusses the covenant incentive with those charged with governance; and
8. assesses whether management’s proposed adjustment is complete.

The auditor also reassesses inventory obsolescence after identifying slow-moving items and involves an appropriate valuation specialist for a complex estimate.

Outcome

Northstar records CU 310,000 of premature revenue as a correction. Since the amount exceeds performance materiality and affects the revenue assertion, the auditor performs expanded procedures. After correction and additional testing, the remaining projected misstatement is below overall materiality and no pervasive misstatement is identified. The final conclusion depends on all evidence, including other accumulated misstatements and disclosures.

Learning points

The case demonstrates that planning is dynamic; incentives can elevate inherent risk; a significant risk requires targeted responses; substantive procedures remain required for every material class, balance, and disclosure; and evidence from one area can require reassessment of another area and of resource needs.

9. Technology, ethics, and contemporary practice

Data analytics can compare complete populations, identify unusual journal entries, match dispatches to invoices, and detect duplicate payments. Analytics do not eliminate the need to understand data completeness, accuracy, extraction logic, access rights, and the meaning of exceptions. An unusual item is a prompt for investigation, not proof of error.

Artificial intelligence may assist with document classification, contract review, anomaly detection, and audit-workpaper search. Professional judgment, confidentiality, explainability, and human review remain essential. Client data should not be entered into unauthorized external systems. The auditor must understand model limitations, potential bias, and whether outputs are reproducible and sufficiently reliable.

Ethically, planning must protect independence and professional skepticism. Commercial pressure to reduce hours cannot justify inadequate evidence. The auditor should consider threats arising from self-review, familiarity, advocacy, intimidation, or financial interests. Governance communication should be timely and candid, particularly regarding significant risks, difficult judgments, uncorrected misstatements, and limitations in evidence.

Challenges and limitations

Materiality judgments vary with users and circumstances, so two competent auditors may select different but defensible benchmarks. Risk models simplify complex professional judgments. Sampling can leave undetected misstatements, while analytics can produce false positives or false negatives. Specialists may use assumptions that are technically sound but sensitive to management’s forecasts. Finally, a carefully documented plan cannot compensate for weak professional skepticism or poor execution.

Best practice is therefore to combine standards-based planning, entity-specific risk analysis, appropriately designed procedures, competent supervision, reliable technology, transparent documentation, and continuous reassessment.

Chapter Summary

Audit planning links the engagement’s objectives to risk assessment, materiality, procedures, staffing, evidence, and reporting. The overall audit strategy establishes scope, timing, and direction; the detailed audit plan specifies procedures and responsibilities. Risk assessment considers inherent risk, control risk, and detection risk, with the audit risk model serving as a conceptual aid rather than a mechanical calculator.

Materiality is based on what could influence users’ decisions and requires both quantitative and qualitative judgment. Overall materiality, performance materiality, specific materiality, and the clearly trivial threshold serve different purposes. ISA 330 requires substantive procedures for every material class of transactions, account balance, and disclosure, irrespective of assessed risk, while significant risks require specifically responsive procedures.

Effective planning also requires appropriate allocation of personnel, supervision, coordination of specialists and component auditors, and timely revision when evidence changes. Technology can improve coverage and efficiency, but it does not replace professional judgment, independence, confidentiality, or skepticism.

Key Terms

Audit plan: Detailed schedule of audit procedures, timing, extent, responsibilities, and review.

Audit strategy: Overall scope, timing, direction, and resource approach for an audit.

Audit risk: Risk that the auditor expresses an inappropriate opinion on materially misstated financial statements.

Benchmark: Financial measure used as a basis for estimating materiality.

Clearly trivial threshold: Amount below which misstatements need not be accumulated because they would clearly not be material in aggregate.

Control risk: Risk that internal control fails to prevent or detect a misstatement timely.

Detection risk: Risk that audit procedures fail to detect an existing material misstatement.

Inherent risk: Susceptibility of an assertion to misstatement before controls are considered.

Materiality: Magnitude or nature of information that could influence users’ decisions.

Performance materiality: Amount below overall materiality designed to reduce aggregation risk.

Professional skepticism: An alert and questioning mind that critically evaluates evidence.

Reasonable assurance: High, but not absolute, level of assurance obtained through audit procedures.

Risk of material misstatement: Combination of inherent and control risk.

Significant risk: Risk assessed near the upper end of inherent risk or required to be treated as significant by another ISA.

Specific materiality: Lower materiality set for particular sensitive balances, transactions, or disclosures.

Substantive procedure: Audit procedure designed to detect material misstatement at assertion level.

Test of controls: Procedure evaluating whether a control operated effectively.

Tolerable misstatement: Application of performance materiality to a particular sampling procedure or population.

Review Questions

Short Answer Questions

1. Distinguish an overall audit strategy from a detailed audit plan.
2. Define performance materiality and explain its purpose.
3. What is a significant risk under revised ISA 315?
4. Why must materiality include qualitative considerations?
5. Identify two circumstances requiring revision of an audit plan.

Long Answer Questions

1. Explain how an auditor moves from understanding the entity to designing responses to assessed risks.
2. Discuss the selection of a materiality benchmark, including the limitations of percentage-based calculations.
3. Explain how staffing, supervision, specialists, and component auditors affect audit quality.
4. Describe the relationship among inherent risk, control risk, detection risk, and audit evidence.
5. Explain the requirements for substantive procedures under ISA 330 and distinguish them from tests of controls.

Analytical / Application Questions

1. An entity reports CU 6 million profit before tax, but CU 2 million arises from a one-time asset disposal. Revenue is CU 80 million and assets are CU 50 million. Analyze which benchmark might be most appropriate and identify additional information needed before setting materiality.
2. During year-end testing, 8 of 40 sampled sales invoices lack evidence of shipment before year-end. Analyze the effect on the risk assessment, planned procedures, supervision, and possible materiality reassessment.
3. A group auditor delegates testing of a foreign subsidiary’s inventory valuation to a component auditor who uses a valuation specialist. Design the communication, evaluation, and review steps needed to support the group opinion.

Multiple Choice Questions with Answers

Question 1

Which statement best describes an overall audit strategy?

A. A list of every invoice selected for testing

B. The overall scope, timing, direction, and resource approach for the engagement

C. A schedule containing only substantive procedures

D. The final list of uncorrected misstatements

Correct Answer: B. The overall scope, timing, direction, and resource approach for the engagement

Question 2

Under revised ISA 315, a significant risk is an identified risk of material misstatement that is:

A. Always caused by fraud

B. Assessed near the upper end of the inherent-risk spectrum or required to be treated as significant by another ISA

C. Found only in the revenue account

D. Important only because it requires a larger sample

Correct Answer: B. Assessed near the upper end of the inherent-risk spectrum or required to be treated as significant by another ISA

Question 3

Profit before tax is CU 4,800,000 and the selected benchmark percentage is 5%. What is overall materiality?

A. CU 24,000

B. CU 96,000

C. CU 240,000

D. CU 960,000

Correct Answer: C. CU 240,000

Question 4

If overall materiality is CU 240,000 and performance materiality is set at 75%, performance materiality is:

A. CU 60,000

B. CU 180,000

C. CU 240,000

D. CU 315,000

Correct Answer: B. CU 180,000

Question 5

What does ISA 330 require for each material class of transactions, account balance, and disclosure?

A. Only inquiry of management

B. Substantive procedures, irrespective of assessed risk

C. A test of controls in every case

D. No procedures where controls are strong

Correct Answer: B. Substantive procedures, irrespective of assessed risk

Question 6

Which risk is the susceptibility of an assertion to misstatement before related controls are considered?

A. Detection risk

B. Control risk

C. Inherent risk

D. Engagement risk

Correct Answer: C. Inherent risk

Question 7

Which item is most likely to justify specific materiality lower than overall materiality?

A. A routine stationery expense

B. A related-party transaction disclosure important to users

C. A duplicated internal working paper

D. An immaterial rounding difference

Correct Answer: B. A related-party transaction disclosure important to users

Question 8

What is the primary purpose of performance materiality?

A. To guarantee that no error remains

B. To reduce the probability that aggregate undetected and uncorrected misstatements exceed overall materiality

C. To replace overall materiality

D. To determine the audit fee

Correct Answer: B. To reduce the probability that aggregate undetected and uncorrected misstatements exceed overall materiality

Question 9

Which event most clearly requires the auditor to reconsider the audit plan?

A. The audit team uses standardized working-paper headings

B. Unexpected evidence indicates a substantial increase in inventory valuation risk

C. The client provides documents in electronic format

D. A routine review is completed on schedule

Correct Answer: B. Unexpected evidence indicates a substantial increase in inventory valuation risk

Question 10

Which statement about an auditor’s expert is correct?

A. Using an expert transfers responsibility for the audit opinion

B. The auditor need not evaluate the expert’s objectivity

C. The auditor evaluates the expert’s competence, capabilities, objectivity, and work for the audit purpose

D. An expert may determine the auditor’s materiality without explanation

Correct Answer: C. The auditor evaluates the expert’s competence, capabilities, objectivity, and work for the audit purpose