Audit Planning and Engagement Management

Introduction

Tax audits are not improvised inspections. They are structured professional engagements in which the auditor obtains and evaluates evidence to determine whether tax returns, tax computations, records, and related disclosures comply with applicable law and professional requirements. Effective planning is therefore the bridge between an audit mandate and a defensible conclusion.

In tax consultancy management, planning has two dimensions. The first is technical: identifying tax risks, relevant legislation, material transactions, filing obligations, and evidence requirements. The second is managerial: defining scope, allocating staff, agreeing timelines, controlling cost, communicating with stakeholders, supervising quality, and resolving issues. A technically sound audit can still fail if it is poorly managed; conversely, an efficient project cannot compensate for weak evidence or inappropriate professional judgment.

This chapter explains how to convert an engagement mandate into an executable audit strategy and work plan. It also considers opening meetings, information requests, resource planning, progress monitoring, stakeholder communication, scope control, ethics, technology, and quality assurance.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the purpose and stages of tax audit planning.
2. Distinguish an overall audit strategy from a detailed audit plan.
3. Assess client, tax, compliance, inherent, control, and detection risks.
4. Prepare an information request list and an evidence timetable.
5. Design resource, budget, communication, and escalation arrangements.
6. Conduct an effective audit opening meeting.
7. Manage scope, cost, quality, stakeholders, and progress.
8. Apply ethical, confidentiality, independence, and data-governance principles.
9. Evaluate the use and limitations of technology and artificial intelligence in audit management.

1. The Nature and Purpose of Audit Planning

Audit planning is the systematic process of deciding what work should be performed, when it should be performed, by whom, and with what level of supervision. It begins before detailed testing and continues throughout the engagement because new evidence can change the risk assessment and the work required.

Planning serves several purposes:

• It directs attention to significant tax risks rather than low-risk routine matters.
• It ensures that adequate and appropriate evidence is obtained.
• It coordinates specialists, client personnel, and audit team members.
• It establishes realistic deadlines and resource requirements.
• It reduces duplication, avoidable delay, and uncontrolled scope expansion.
• It creates an audit trail showing how professional judgments were made.
• It supports compliance with professional standards, legislation, and the engagement letter.

Planning is not merely an administrative exercise. It is an exercise of professional judgment. For example, a business with a simple domestic payroll may require limited specialist input, whereas a multinational undertaking related-party financing, permanent-establishment activities, transfer pricing, customs transactions, and indirect tax adjustments requires a coordinated, risk-based strategy.

1.1 The engagement life cycle

A typical tax audit engagement follows this sequence:

1. Pre-engagement and acceptance: assess independence, competence, conflicts, integrity, capacity, and terms of engagement.
2. Understanding the entity and environment: understand its business model, ownership, systems, transactions, tax profile, and regulatory environment.
3. Risk assessment and materiality: identify areas where material misstatement, non-compliance, fraud, or penalty exposure may arise.
4. Strategy and planning: determine scope, objectives, timing, staffing, specialists, procedures, and communication arrangements.
5. Opening meeting and information collection: confirm expectations and obtain initial records.
6. Testing and analysis: perform controls testing, substantive procedures, reconciliations, interviews, and analytical procedures.
7. Review and resolution: evaluate exceptions, obtain explanations, and complete supervisory and quality reviews.
8. Reporting and closure: communicate findings, agree or document disagreements, issue deliverables, archive evidence, and evaluate lessons learned.

These stages overlap. A significant unexplained variance identified during testing may require the auditor to revise the risk assessment, request additional documents, involve a specialist, or extend the timetable.

2. Engagement Acceptance and Preliminary Assessment

Planning begins with deciding whether the engagement should be accepted or continued. This decision protects both the client and the practitioner.

Important preliminary questions include:

• Is the firm independent, and are there any conflicts of interest?
• Does the team possess the necessary tax, accounting, industry, data, and legal competence?
• Is sufficient time and budget available to perform the work properly?
• Is management’s explanation of the engagement credible and complete?
• Are there indicators of money laundering, corruption, fraud, aggressive avoidance, or other illegal conduct?
• Does the proposed engagement comply with law, professional standards, and the firm’s risk policies?
• Are the scope, authority, access rights, deliverables, and fees clear?

An engagement letter should normally identify the parties, objective, period covered, responsibilities of management and the practitioner, access to records, confidentiality arrangements, reporting format, fee basis, timing, use of specialists, limitations on reliance, and procedures for changing scope. A clear engagement letter prevents misunderstandings and provides a reference point when requests exceed the original mandate.

3. Understanding the Client and the Tax Environment

The quality of risk assessment depends on the quality of the initial understanding. The auditor should develop a business and tax profile rather than simply collect a trial balance.

3.1 Business understanding

Relevant matters include:

• products, services, markets, and revenue channels;
• legal structure, ownership, related parties, and group relationships;
• locations, branches, agents, warehouses, and digital operations;
• major contracts and changes in the operating model;
• accounting systems, enterprise-resource-planning systems, and tax software;
• key personnel and the division of responsibilities;
• financing arrangements, acquisitions, restructurings, and disposals.

3.2 Tax understanding

The tax profile may include corporate income tax, value-added or sales tax, payroll taxes, withholding taxes, customs and excise duties, property taxes, transfer pricing, tax incentives, and sector-specific levies. The auditor should identify registration status, filing history, tax authority correspondence, assessments, appeals, audits, penalties, refunds, elections, rulings, and uncertain tax positions.

3.3 Sources of understanding

Evidence may be obtained from prior-year files, financial statements, general ledgers, tax returns, board minutes, budgets, contracts, organisation charts, process narratives, interviews, walkthroughs, external correspondence, public information, and data extracts. Information from management is useful but should be corroborated where risk is significant.

4. Risk Assessment and Materiality

4.1 A practical risk model

Tax audit risk is often explained as the possibility that an inappropriate conclusion is reached when material non-compliance or misstatement exists. A common conceptual model is:

Inherent risk is the susceptibility of an assertion or tax area to error or non-compliance before considering controls. Control risk is the risk that the client’s controls will not prevent or detect the problem. Detection risk is the risk that audit procedures will fail to identify it. This multiplicative model is a planning framework, not a precise mechanical calculation. The components are judgments and are not normally measured as objectively independent probabilities.

Examples of high inherent risk include complex transfer-pricing arrangements, uncertain tax treatments, cash-intensive revenue, rapidly changing legislation, large one-off transactions, tax incentives with detailed eligibility conditions, and transactions involving related parties or offshore jurisdictions.

4.2 Assertions and tax risks

Although tax audits do not always use exactly the same assertion terminology as financial statement audits, useful assertions include:

• Occurrence: the transaction or expense actually occurred.
• Completeness: all taxable income, liabilities, and reportable transactions are included.
• Accuracy: amounts and tax calculations are correct.
• Cut-off: transactions are recorded in the correct period.
• Classification: items are treated under the correct tax category.
• Rights and obligations: the entity is entitled to deductions, credits, exemptions, or refunds claimed.
• Presentation and disclosure: required information is properly reported.

For example, payroll withholding risk may involve incomplete payroll populations, incorrect employee classifications, inaccurate rates, or delayed remittance. Input VAT risk may involve unsupported invoices, blocked categories, duplicate claims, or claims relating to exempt activities.

4.3 Materiality and significance

Materiality is the importance of an omission or misstatement to users’ decisions or to the tax authority’s assessment of compliance. In tax work, significance may also arise from qualitative factors even when the amount is small. These include fraud, deliberate concealment, related-party transactions, breaches of law, regulatory precedents, and matters likely to trigger penalties or reputational damage.

Materiality should be documented in relation to the engagement objective and legal context. A threshold used to plan sampling does not replace professional judgment. Small errors may be aggregated, and an individually immaterial issue may become important when it indicates a systemic control failure.

5. The Overall Audit Strategy and Detailed Audit Plan

The overall audit strategy sets the direction, scope, timing, and emphasis of the engagement. It answers questions such as:

• Which tax periods and entities are included?
• Which taxes and significant risks require priority attention?
• Will the approach be primarily substantive, control-based, or combined?
• Are specialists required?
• What level of assurance and reporting is expected?
• What milestones and review points apply?

The audit plan translates the strategy into procedures. It identifies the risk, assertion, procedure, responsible person, timing, evidence expected, review requirements, and status.

A plan should be sufficiently detailed to guide staff but sufficiently flexible to respond to new evidence. Excessively rigid plans encourage mechanical compliance; excessively vague plans create inconsistency and weak supervision.

6. Preparing the Information Request List

An information request list, sometimes called a prepared-by-client list, converts audit needs into a controlled communication. Requests should be specific, logically grouped, prioritised, and linked to audit objectives.

A strong request identifies:

1. the document or data required;
2. the period covered;
3. the format required;
4. the responsible client contact;
5. the due date;
6. the reason or audit area, where appropriate;
7. confidentiality and secure-transfer instructions; and
8. the status and follow-up action.

The first request should normally seek foundational information: organisation charts, tax registrations, prior returns, trial balances, general ledgers, tax reconciliations, prior authority correspondence, accounting policies, system descriptions, and schedules of significant transactions. Later requests can be targeted to exceptions identified during testing.

Requests should avoid unnecessary duplication. If the same ledger supports income tax, VAT, and withholding-tax testing, the auditor should obtain one controlled extract and document its use across work programmes. The client should be told whether copies, read-only access, certified records, or original documents are required.

6.1 Information request register

A request register is both a coordination tool and evidence of timely project management. It should record whether a response is complete, relevant, reliable, and subject to restrictions.

7. Timelines, Dependencies, and Milestones

An audit timetable should distinguish activities, dependencies, deadlines, review time, client availability, and statutory dates. It should include contingency for delayed data, system problems, staff absence, specialist input, and unresolved findings.

A useful schedule contains at least:

• planning completion date;
• opening meeting date;
• initial information deadline;
• fieldwork period;
• interim status meetings;
• draft findings date;
• management response deadline;
• technical and quality review dates;
• closing meeting; and
• final report or filing date.

Dependencies must be explicit. For instance, testing of payroll withholding cannot be completed until a complete payroll population and remittance schedule are received. A transfer-pricing review may depend on the intercompany agreement, segmented financial data, and economic analysis.

A critical-path approach is useful: identify tasks whose delay directly delays the final deliverable. However, the shortest timetable is not always the best timetable. Review and response time are essential controls, not unused capacity.

8. Resource Planning and Budget Control

Resource planning assigns work according to competence, complexity, availability, and independence. A typical team may include an engagement partner or director, manager, senior auditor, associates, tax specialists, data analysts, and legal or valuation advisers.

Allocation should consider:

• technical difficulty and risk;
• need for industry or jurisdictional knowledge;
• language and communication requirements;
• data-analysis capability;
• reviewer independence from preparers;
• expected hours and deadlines; and
• continuity and development of staff.

A basic budget-monitoring relationship is:

If actual cost is lower than budget, the variance is negative; if actual cost exceeds budget, the variance is positive. When costs are measured through hours and billing or internal rates, a simple cost estimate is:

Here, i identifies each staff category, planned hours are hours assigned to that category, and cost rate is the relevant internal or agreed rate per hour. The formula assumes that hours and rates are measured on a consistent basis and excludes items such as taxes or disbursements unless they are included in the rate.

Budget information should never encourage premature completion or reduced audit quality. If additional hours are necessary because of a newly identified risk, the manager should document the cause, assess the effect on scope, seek approval where required, and communicate any fee implication promptly.

9. The Opening Meeting

The opening meeting establishes a professional working relationship and confirms the practical terms of the engagement. Participants commonly include the engagement team, tax director, finance manager, accounting-system owner, payroll or indirect-tax representatives, and relevant legal or compliance personnel.

An effective agenda covers:

1. introductions and roles;
2. purpose, scope, period, and deliverables;
3. applicable authority and confidentiality arrangements;
4. key risks and areas requiring specialist attention;
5. information request protocol and secure data transfer;
6. timetable, access arrangements, and meeting cadence;
7. client responsibilities and auditor responsibilities;
8. escalation routes for delays, disputes, or suspected misconduct;
9. sampling, interviews, system access, and use of external confirmations; and
10. questions, assumptions, and next actions.

The auditor should avoid presenting preliminary conclusions as final findings. The meeting is for alignment and transparency, not intimidation. A written record should capture attendees, matters agreed, unresolved questions, deadlines, and responsible persons.

10. Communication and Stakeholder Management

Audit communication should be timely, accurate, proportionate, and documented. Stakeholders differ in information needs. Senior management may need a concise view of exposure, cost, timetable, and decisions. Operational staff need precise requests and deadlines. The audit committee or board may require significant risks, control deficiencies, independence matters, and unresolved disagreements.

A communication protocol should specify:

• primary and secondary contacts;
• approved communication channels;
• response times;
• meeting frequency;
• format for action logs and issue reports;
• escalation thresholds;
• authority to approve scope or fee changes; and
• treatment of confidential, privileged, or personal information.

Issue reports should distinguish facts, criteria, cause, effect, risk, recommendation, management response, owner, and target date. The auditor should use neutral language and allow management to correct factual inaccuracies without surrendering independent judgment.

10.1 Escalation

Escalation is appropriate when there is a material delay, repeated non-response, suspected fraud, obstruction, a conflict of interest, a major scope change, potential illegal conduct, or a disagreement that may affect the conclusion. Escalation should follow the agreed hierarchy and should be documented. Informal discussions are valuable, but significant decisions should not depend solely on undocumented conversations.

11. Managing Scope, Change, and Uncertainty

Scope is controlled by reference to the engagement letter, approved change orders, risk assessment, and statutory responsibilities. Scope creep occurs when additional work is accepted informally without assessing its effect on objectives, resources, timing, independence, and fees.

A scope-change process should ask:

• What new matter has arisen?
• Why is it relevant to the original objective?
• Is it required by law or requested by management?
• What additional procedures and expertise are necessary?
• Does the team have capacity and competence?
• What are the revised deadlines and costs?
• Does the change require written approval or an amended engagement letter?

Some changes should not be accepted merely because they are commercially attractive. For example, a request to suppress an adverse finding, backdate evidence, or provide an assurance conclusion unsupported by work is unacceptable.

12. Monitoring Progress and Quality

Progress monitoring compares completed work, evidence received, open issues, hours used, and risks identified with the plan. Useful indicators include:

• percentage of requests received and validated;
• number and age of unresolved issues;
• hours incurred against budget;
• procedures completed versus planned;
• review points cleared;
• overdue client responses; and
• changes in assessed risk.

These indicators are diagnostic, not substitutes for professional judgment. A project can appear on schedule while important evidence remains unreliable.

Quality management requires appropriate direction, supervision, review, consultation, and documentation. Preparers should understand the purpose of their work. Reviewers should assess whether procedures address the identified risks, evidence supports conclusions, exceptions are resolved, and the file can be understood by an experienced practitioner with no prior connection to the engagement.

A quality review should consider:

• compliance with the engagement terms and applicable standards;
• independence and conflicts;
• appropriateness of risk assessment and materiality;
• sufficiency and reliability of evidence;
• treatment of contradictory evidence;
• accuracy of tax calculations and legal references;
• completeness of communication and management responses;
• consistency between findings and the final report; and
• proper archiving and retention.

13. Evidence, Documentation, and Working Papers

Working papers should demonstrate what was planned, what was performed, what was found, how exceptions were resolved, and why the conclusion is reasonable. Documentation should be contemporaneous, clear, indexed, cross-referenced, and protected from unauthorised alteration.

A useful working paper normally states:

• objective and relevant risk;
• source and period of information;
• procedure performed;
• population and sample, where applicable;
• results and exceptions;
• conclusion;
• preparer and date; and
• reviewer, date, and review notes.

Evidence quality depends on relevance, reliability, completeness, and authenticity. A system-generated report may be efficient but should be assessed for completeness and access controls. A management explanation may clarify an anomaly but may not be sufficient evidence on its own. Contradictory evidence must be investigated rather than ignored.

14. Technology, Data Analytics, and Artificial Intelligence

Technology can improve planning and supervision. Data analytics can compare tax returns with ledgers, identify unusual journal entries, reconcile payroll to withholding returns, detect duplicate invoices, stratify transactions, and examine all items in a population rather than relying only on a small sample.

Useful planning applications include:

• automated request registers and workflow dashboards;
• secure portals for evidence exchange;
• digital confirmation and approval trails;
• exception reports and continuous monitoring;
• document search and contract analysis; and
• data visualisation for tax exposures by entity, period, or tax type.

Artificial intelligence may assist with document classification, anomaly detection, summarising legislation, drafting request lists, and identifying inconsistent explanations. It must not replace professional judgment. Risks include fabricated citations, incomplete context, biased outputs, disclosure of confidential data, weak explainability, and overreliance on probabilistic results.

Governance controls should include approved tools, access restrictions, human review, source verification, audit trails, retention rules, testing for bias and errors, and a prohibition on entering confidential client information into unauthorised systems. The practitioner remains responsible for the conclusion even when technology performs part of the analysis.

15. Ethical, Regulatory, and Governance Considerations

Tax audit planning is inseparable from ethical conduct. Core principles generally include integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour. Local legislation and professional standards determine the precise obligations, but several principles are widely applicable.

Independence and conflicts: financial interests, close relationships, prohibited services, or excessive dependence on one client may impair objectivity. Threats should be identified, evaluated, and eliminated or mitigated; otherwise the engagement should be declined or terminated.

Confidentiality: tax records contain personal, commercial, payroll, and strategic information. Access should be limited to authorised persons, transferred securely, and retained according to law and policy.

Fraud and illegal acts: indicators should be documented and escalated under applicable law and professional requirements. The auditor must not conceal evidence, facilitate evasion, or advise a client to misrepresent facts.

Professional competence: rapidly changing tax rules require continuing education and consultation. Where the team lacks expertise, an appropriate specialist should be engaged.

Data protection: personal data should be collected for legitimate purposes, minimised, protected, and deleted or retained according to legal requirements.

16. Illustrative Case: Meridian Components Ltd.

Background

Meridian Components Ltd. is a medium-sized manufacturer with domestic sales, imports of raw materials, a related foreign purchasing company, and a payroll of 420 employees. It has engaged a tax consultancy to review corporate income tax, VAT, customs-related records, payroll withholding, and related-party transactions for the year ended 31 December.

Problem

The client requests a final report within six weeks because a financing review is scheduled. Initial information shows that sales increased by 28%, but reported VAT increased by only 7%. The general ledger contains several large year-end journal entries, and the related-party purchasing agreement has recently changed. The finance manager states that all records are available, but the first data upload is incomplete.

Analysis

The team identifies the following risks:

• incomplete or incorrectly timed sales reporting;
• unsupported input VAT claims;
• customs values inconsistent with purchase records;
• incorrect payroll withholding for temporary workers;
• transfer-pricing risk from the revised purchasing arrangement; and
• management pressure that could encourage insufficient testing.

The team classifies the engagement as high risk in selected areas and decides to use a combined approach: understand and test key controls, then perform substantive reconciliations and targeted transaction testing. A customs specialist and a data analyst are included.

Approach and solution

The engagement manager issues a prioritised request list. Within the first week, Meridian must provide the sales ledger, VAT returns, invoice population, import declarations, payroll registers, withholding remittances, related-party agreement, transfer-pricing analysis, and year-end journal listing. The manager agrees a secure portal and appoints the financial controller as the response owner.

At the opening meeting, the team explains that the six-week deadline is achievable only if complete data is delivered by the agreed dates. The team establishes twice-weekly status calls, a formal issue log, and escalation to the chief financial officer for requests overdue by more than three working days.

The data analyst reconciles sales invoices to the VAT return and investigates the sales-to-VAT growth difference. The payroll specialist compares employee classifications, payroll registers, and remittances. The customs specialist compares import declarations with purchase invoices and inventory receipts. The manager assigns the related-party agreement to the tax specialist and reserves time for technical review.

The first analysis identifies that a large export sale was posted in the sales ledger but was excluded from the VAT return because the export evidence was incomplete. This is not automatically a tax error: the treatment depends on applicable zero-rating conditions and documentary requirements. The team therefore requests shipping documents, customs evidence, and proof of export rather than immediately concluding that VAT is underdeclared.

The year-end journal review identifies manual entries posted by a senior accountant without the usual secondary approval. The team expands testing around cut-off and management override. It also discovers that temporary workers supplied through an agency were treated inconsistently for withholding purposes. The issue is escalated because the correct treatment depends on local law and contractual facts.

Outcome

Meridian supplies the missing data after escalation. The final report distinguishes confirmed errors, documentation deficiencies, and matters requiring legal advice. It recommends a documented export-evidence checklist, automated VAT reconciliations, approval controls for manual journals, consistent worker classification, and annual review of related-party pricing. The client accepts the recommendations and agrees a remediation timetable. The consultancy completes the report after technical and independent quality review, with no reduction in procedures despite the financing deadline.

Learning points

1. A deadline must be managed through dependencies and escalation, not by omitting necessary work.
2. A numerical difference is an investigation signal, not proof of non-compliance.
3. Risk assessment should change when new evidence appears.
4. Specialists are valuable when legal, customs, transfer-pricing, or data issues exceed the core team’s competence.
5. Clear documentation separates fact, law, judgment, and recommendation.

17. Challenges and Limitations

Audit planning is affected by incomplete records, changing legislation, weak client systems, unreliable data, staff turnover, unrealistic deadlines, cross-border restrictions, and disagreements over access or interpretation. Risk models can create false precision, especially when qualitative risks are converted into numerical scores without a sound basis. Dashboards may also encourage teams to measure activity rather than evidence quality.

Planning cannot eliminate uncertainty. It reduces avoidable uncertainty by identifying assumptions, assigning responsibility, establishing review points, and preserving the ability to revise the approach. Professional skepticism remains essential. A well-designed plan is not evidence that the work was properly performed; it is a framework that must be executed, supervised, and updated.

Best-Practice Checklist

Before fieldwork, the engagement manager should confirm that:

• acceptance, independence, competence, and conflicts have been assessed;
• the engagement letter defines objective, scope, responsibilities, and deliverables;
• the business and tax environment is understood;
• significant risks and materiality judgments are documented;
• the strategy and detailed work plan are consistent;
• information requests, owners, formats, and deadlines are agreed;
• staff, specialists, budget, and review capacity are available;
• the communication and escalation protocol is understood;
• secure data-transfer and confidentiality arrangements are in place; and
• the opening meeting record and action log have been issued.

During fieldwork, the manager should monitor evidence quality, open issues, budget, deadlines, risk changes, scope changes, and review notes. At closure, the team should ensure that findings are supported, management responses are recorded, quality review is complete, and the file is properly archived.

Chapter Summary

Audit planning converts an engagement mandate into a controlled programme of professional work. It begins with acceptance, independence, competence, and a clear engagement letter. The auditor then develops an understanding of the client’s business and tax environment, identifies risks and assertions, considers materiality, and prepares an overall strategy and detailed audit plan.

Effective execution depends on a precise information request list, realistic milestones, dependency management, appropriate staffing, budget monitoring, and an opening meeting that establishes responsibilities and communication protocols. Progress must be monitored through evidence-based indicators, while scope changes, delays, disagreements, and ethical concerns require documented escalation.

Quality is supported by supervision, review, reliable evidence, clear working papers, technical consultation, and secure data governance. Analytics and artificial intelligence can improve efficiency and risk detection, but they require human validation and cannot replace professional responsibility. The central principle is that audit quality, client service, cost, and timeliness must be managed together rather than traded off casually.

Key Terms

Audit planning: The process of deciding the scope, timing, procedures, resources, and supervision required for an audit.

Overall audit strategy: The high-level direction, scope, timing, and emphasis of an engagement.

Audit plan: The detailed procedures and assignments used to implement the audit strategy.

Engagement letter: The written agreement defining the objective, responsibilities, scope, deliverables, and terms of an engagement.

Inherent risk: Susceptibility to error or non-compliance before considering controls.

Control risk: Risk that controls will fail to prevent or detect an error or non-compliance.

Detection risk: Risk that audit procedures will fail to identify an existing problem.

Materiality: The significance of an omission or misstatement in the context of decisions or compliance.

Assertion: A proposition about a transaction, balance, or disclosure, such as completeness or accuracy.

Information request list: A controlled schedule of documents and data required from the client.

Critical path: The sequence of dependent tasks that determines the minimum completion time.

Scope creep: Uncontrolled expansion of work beyond the agreed engagement scope.

Issue log: A record of audit findings, owners, actions, deadlines, and status.

Professional skepticism: A questioning mindset that critically evaluates evidence and explanations.

Working paper: Documentation of procedures, evidence, findings, conclusions, and review.

Specialist: A person with expertise used to address technical or complex matters outside the core team’s competence.

Quality review: An evaluation of whether audit work, evidence, judgments, and reporting meet applicable requirements.

Data governance: Policies and controls governing the access, use, protection, retention, and disposal of data.

Audit trail: A documented sequence showing how information, procedures, judgments, and conclusions are connected.

Review Questions

Short Answer Questions

1. What is the difference between an overall audit strategy and a detailed audit plan?
2. Identify three matters that should be included in an engagement letter.
3. What are inherent risk, control risk, and detection risk?
4. State four items that should appear in an information request register.
5. Why is an opening meeting important to audit engagement management?

Long Answer Questions

1. Explain the stages of the tax audit engagement life cycle and show how planning continues throughout the engagement.
2. Discuss how an auditor should understand a client’s business and tax environment before designing audit procedures.
3. Explain how resource planning, budget monitoring, and quality review interact in a tax audit.
4. Describe a suitable communication and escalation protocol for a complex tax audit.
5. Evaluate the benefits and risks of using data analytics and artificial intelligence in tax audit planning.

Analytical / Application Questions

1. A client repeatedly fails to provide payroll records, while the statutory reporting deadline is approaching. Design an escalation and revised timetable that protects audit quality.
2. Sales increased substantially, but VAT reported increased only slightly. Explain the possible causes, evidence required, and procedures you would perform before reaching a conclusion.
3. During fieldwork, management requests that the auditor remove a supported adverse finding to preserve a financing arrangement. Analyse the ethical, governance, communication, and reporting response required.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the purpose of an overall audit strategy?

A. It lists every individual invoice selected for testing.

B. It establishes the engagement’s scope, timing, direction, and emphasis.

C. It replaces the engagement letter.

D. It records only the client’s responses to findings.

Correct Answer: B. It establishes the engagement’s scope, timing, direction, and emphasis.

Question 2

Which risk exists before considering the effectiveness of client controls?

A. Detection risk

B. Control risk

C. Inherent risk

D. Review risk

Correct Answer: C. Inherent risk

Question 3

Which item is most appropriate for an information request register?

A. A personal opinion about the client’s management

B. The request, responsible owner, due date, and status

C. Only the final audit conclusion

D. The auditor’s annual leave schedule

Correct Answer: B. The request, responsible owner, due date, and status

Question 4

What is the primary purpose of an opening meeting?

A. To announce final audit conclusions

B. To establish scope, responsibilities, timetable, access, and communication arrangements

C. To negotiate unrelated commercial contracts

D. To eliminate the need for written documentation

Correct Answer: B. To establish scope, responsibilities, timetable, access, and communication arrangements

Question 5

If actual cost is 1,200 hours and the budget is 1,000 hours, using the chapter’s variance convention, what is the budget variance in hours?

A. −200 hours

B. 200 hours

C. 1,000 hours

D. 1,200 hours

Correct Answer: B. 200 hours

Question 6

Which circumstance most clearly requires consideration of a scope-change process?

A. A request for an additional tax review outside the agreed objective

B. A routine review of an already planned working paper

C. A scheduled opening meeting

D. A standard file-indexing activity

Correct Answer: A. A request for an additional tax review outside the agreed objective

Question 7

Which principle requires the auditor to protect client tax and payroll information?

A. Confidentiality

B. Revenue recognition

C. Market segmentation

D. Cost absorption

Correct Answer: A. Confidentiality

Question 8

Why should a numerical difference between sales growth and VAT growth not immediately be treated as proof of non-compliance?

A. Numerical differences are always irrelevant.

B. The difference may have legitimate explanations requiring supporting evidence.

C. VAT returns never relate to sales.

D. Auditors may rely only on management’s opinion.

Correct Answer: B. The difference may have legitimate explanations requiring supporting evidence.

Question 9

What is a suitable use of data analytics in tax audit planning?

A. Automatically issuing an unsupported final conclusion

B. Identifying unusual transactions and reconciling tax returns to ledger data

C. Removing the need for professional judgment

D. Uploading confidential data to any public AI tool

Correct Answer: B. Identifying unusual transactions and reconciling tax returns to ledger data

Question 10

Which action best supports audit quality at closure?

A. Deleting unresolved review notes

B. Ensuring findings are supported, responses are documented, and quality review is complete

C. Ignoring contradictory evidence

D. Reducing procedures whenever the deadline is tight

Correct Answer: B. Ensuring findings are supported, responses are documented, and quality review is complete