AUD, Auditing and Attestation

Sources for Planning an Engagement

Last reviewed 2026-09-14

The standards and authorities behind PocketCPA's AUD lessons on Planning an Engagement. The topic rests on AU-C 300.

About this topic

Planning is not a meeting held once in October. It runs the length of the audit, and the plan changes as the work turns up things nobody knew at the start.

Stated technically, planning is a continual, iterative process. It begins with preliminary activities and is revised as the audit unfolds. Good planning does three things: it directs effort toward the areas of greatest risk, it coordinates the team, and it sets the tone for the whole engagement.

Key points

• Audit planning establishes the overall strategy and develops the audit plan that allocates resources to significant areas.
• Risk assessment procedures are performed to understand the entity, its environment, and its internal control to identify risks of material misstatement.
• The auditor should discuss the susceptibility of the financial statements to material misstatement among the engagement team.
• Materiality and the audit strategy are set during planning but may be revised as the audit progresses.

What the lessons cover

1. Preliminary engagement activities
2. Strategy and plan
3. Direction, supervision, and involvement
4. Documenting the strategy and the plan, and changing both
5. Initial audit engagements
6. Multi-location engagements and audits involving other auditors (PCAOB)
7. Specialized skill or knowledge
8. Planning under GAAS and PCAOB standards, drawn apart

Authoritative references

Where these requirements sit in the literature.

• AU-C 300.05 puts the engagement partner and other key members of the engagement team inside planning, including planning and participating in the discussion among engagement team members. It is the paragraph that forbids delegating planning:
  • solely to junior staff.
  • to the client.
  • to the engagement quality reviewer.
• AU-C 300.06 carries the three preliminary engagement activities performed at the beginning of the current engagement:
  • continuance procedures on the client relationship and the specific engagement.
  • evaluating compliance with relevant ethical requirements including independence.
  • establishing an understanding of the terms of the engagement under AU-C 210.
  • Their purpose is to identify matters that might adversely affect the ability to plan and perform the audit before substantive work begins.
• AU-C 300.07 requires the overall audit strategy: it sets the scope, timing and direction of the audit and guides development of the audit plan. AU-C 300.08 lists what to take into account in establishing it, including:
  • ascertaining the reporting objectives to plan the audit's timing and the nature of required communications, at .08b.
  • ascertaining the nature, timing and extent of resources, such as deploying experienced staff and specialists to higher-risk areas, at .08e.
• AU-C 300.09 carries the audit plan, a description of:
  • (a) the nature and extent of planned risk assessment procedures.
  • (b) the nature, timing and extent of planned further audit procedures at the relevant assertion level.
  • (c) other planned procedures required so that the engagement complies with GAAS.
• AU-C 300.10 requires the auditor to update and change the overall audit strategy and the audit plan as necessary during the course of the audit. AU-C 300.12 then requires the audit documentation to hold three things:
  • the overall audit strategy.
  • the audit plan.
  • any significant changes made to either during the engagement, together with the reasons for those changes.
• AU-C 300.11 requires the auditor to plan the nature, timing and extent of direction and supervision of engagement team members and the review of their work.
• AU-C 300.A15 ties the appropriate extent of that direction, supervision and review to three factors:
  • the entity's size and complexity.
  • the assessed risks of material misstatement.
  • the capabilities and competence of the individual team members.
• AU-C 300.13 covers initial audit engagements, and adds two activities to the ordinary planning work:
  • performing client-acceptance procedures.
  • communicating with the predecessor auditor in accordance with AU-C 210, where there has been a change of auditors.
  • Reperforming the prior audit and obtaining the predecessor's permission to report are not required.
• AU-C 300.A2 describes the benefits of adequate planning:
  • devoting appropriate attention to important areas.
  • identifying and resolving potential problems on a timely basis.
  • It also confirms that planning removes no other requirement and transfers none of management's responsibility.
• AU-C 210.06 carries the two preconditions for an audit: an acceptable financial reporting framework, and management's agreement to the premise. The premise is management's responsibility for three things:
  • preparing the financial statements.
  • internal control relevant to their preparation.
  • providing the auditor with access to information and to persons within the entity.
  • AU-C 210.07 bars accepting an engagement whose proposed terms impose a scope limitation the auditor believes will lead to disclaiming an opinion, and AU-C 210.08 bars acceptance where the preconditions are absent, each unless law or regulation requires otherwise.
• AU-C 210.10 fixes the agreed terms:
  • the objective and scope.
  • the responsibilities of the auditor.
  • the responsibilities of management.
  • a statement about the inherent limitations of an audit and of internal control.
  • identification of the applicable financial reporting framework.
  • reference to the expected form and content of any reports, plus a statement that a report may differ from that expected form.
• AU-C 210.13 governs recurring audits, where no new letter is required annually but the auditor assesses whether the terms need revising.
  • AU-C 210.14 governs changes in terms, permitted only on reasonable justification.
  • AU-C 210.16 requires the new terms to be agreed and documented and keeps the report on the changed engagement from referencing the original engagement, except that reference to procedures is normal in an agreed-upon-procedures report.
• AS 2101.05 frames PCAOB planning: it includes establishing the overall audit strategy and developing an audit plan, and planning is not a discrete phase but a continual and iterative process that might begin shortly after the completion of the previous audit and continues until the completion of the current audit.
  • AS 2101.06 carries the preliminary activities, with .06c establishing the understanding of the terms with the audit committee, and its Note stating that the independence and ethics determination is not limited to preliminary activities and should be reevaluated with changes in circumstances.
• AS 2101.06A requires the engagement partner to determine whether the firm's participation is sufficient to serve as lead auditor, and provides that in an audit involving referred-to auditors that participation ordinarily is not sufficient if those auditors in aggregate audit more than 50 percent of the company's assets or revenues.
  • AS 2101.06B requires the lead auditor's involvement to be commensurate with the risks of material misstatement at the locations involved.
  • AS 2101.06C provides that only the lead auditor of the financial statements can be the lead auditor of internal control over financial reporting.
  • AS 2101.06G permits use of the work of an other auditor that plays a substantial role only if that firm is registered with the PCAOB.
• AS 2101.07 makes the nature and extent of planning activities depend on three things:
  • the size and complexity of the company.
  • the auditor's previous experience with the company.
  • changes in circumstances during the audit.
  • It also requires the auditor to evaluate whether listed matters, including the relative complexity of the company's operations, are important and how they will affect procedures.
• AS 2101.08 requires the overall audit strategy, and AS 2101.09 lists its four inputs:
  • the reporting objectives and the nature of required communications.
  • the factors significant in directing the engagement team's activities.
  • the results of preliminary engagement activities and the evaluation of important matters under paragraph .07.
  • the nature, timing and extent of resources necessary.
• AS 2101.10 requires the auditor to develop and document an audit plan describing:
  • (a) the planned nature, timing and extent of the risk assessment procedures.
  • (b) the planned nature, timing and extent of tests of controls and substantive procedures.
  • (c) other planned procedures required so that the engagement complies with PCAOB standards.
  • AS 2101.15 requires the strategy and plan to be modified if circumstances change significantly, including because of a revised assessment of the risks of material misstatement or the discovery of a previously unidentified risk.
• AS 2101.11 governs multi-location engagements:
  • determine the locations or business units at which to perform procedures and the nature, timing and extent of procedures there.
  • assess the risks of material misstatement to the consolidated statements associated with each.
  • correlate the amount of audit attention with the degree of risk.
• AS 2101.12 lists the seven factors relevant to assessing a location's risk and determining the procedures to perform there:
  • the nature and amount of assets, liabilities and transactions executed at the location or business unit.
  • the materiality of the location or business unit.
  • specific risks associated with the location that present a reasonable possibility of material misstatement.
  • whether the risks associated with the location apply to other locations or business units.
  • the degree of centralization of records or information processing.
  • the effectiveness of the control environment, particularly management's control over the exercise of authority.
  • the frequency, timing and scope of monitoring activities by the company or others at the location.
• AS 2101.13 permits taking relevant internal audit activities under AS 2605, or the work of others under AS 2201, into account.
• AS 2101.14 puts paragraphs .11 through .13 on the lead auditor in audits involving other auditors or referred-to auditors.
• AS 2101.16 requires the auditor to determine whether specialized skill or knowledge, including relevant knowledge of foreign jurisdictions, is needed for any of three purposes:
  • performing appropriate risk assessments.
  • planning or performing audit procedures.
  • evaluating audit results.
• AS 2101.17 requires the auditor, where such a person participates in the audit, to have sufficient knowledge of the subject matter to do three things:
  • communicate the objectives of that person's work.
  • determine whether that person's procedures meet the auditor's objectives.
  • evaluate the results as they relate to the nature, timing and extent of other planned procedures.
• AS 2101.18 requires two things before starting an initial audit:
  • procedures regarding the acceptance of the client relationship and the specific audit engagement.
  • communication with the predecessor auditor where there has been a change of auditors.
  • AS 2101.19 states that the purpose and objective of planning are the same for an initial and a recurring audit, but that an initial audit requires determining the additional planning activities necessary, including the audit procedures necessary to obtain sufficient appropriate evidence regarding the opening balances.
• AS 1201.03 makes the engagement partner responsible for three things:
  • the engagement.
  • its performance.
  • proper supervision of engagement team members, including those outside the partner's firm.
• AS 1201.05 requires supervisors to do three things:
  • inform team members of their responsibilities.
  • direct them to raise significant accounting and auditing issues.
  • review their work for performance, documentation, achievement of objectives and support for conclusions.
• AS 1201.06 sets the extent of supervision on four factors:
  • the nature of the company, including its size and complexity.
  • the nature of the assigned work for each team member.
  • the risks of material misstatement.
  • the knowledge, skill and ability of each team member.
• AS 1201.08 requires the lead auditor to inform an other auditor in writing of four things:
  • the scope of the work to be performed.
  • the identified risks of material misstatement associated with the location or business unit.
  • tolerable misstatement.
  • the clearly-trivial threshold, the amount below which misstatements need not be accumulated, where it has been determined.
• AS 1201.11 requires a written affirmation of compliance with those instructions.
• Appendix C of AS 1201 supplements paragraphs .05 and .06 for auditor-employed specialists and carries the Note excluding income taxes and information technology.
• AS 1210.01 limits the standard to a specialist engaged by the auditor's firm and excludes income taxes and information technology as specialized areas of accounting and auditing, directing those to AS 1201.
  • AS 1210.03 requires assessing the specialist's knowledge, skill and ability.
  • AS 1210.04 prohibits using the work of a specialist who lacks a sufficient level of them.
  • AS 1210.05 requires assessing objectivity including relationships with the company.
  • AS 1210.11 requires additional procedures or a different specialist where objectivity is affected, applying the procedures for a company's specialist where objectivity is low.
• AS 1301.05 and AS 1301.06 require the auditor:
  • to establish an understanding of the terms of the audit engagement with the audit committee.
  • to record it in an engagement letter.
  • to provide that letter to the audit committee annually.
  • to have it executed by the appropriate party or parties on behalf of the company, determining that the audit committee has acknowledged and agreed to the terms where the executing party is someone else.
  • AS 1301.08 requires inquiry of the audit committee about matters relevant to the audit.
  • AS 1301.09 requires communicating an overview of the overall audit strategy including the timing of the audit and discussing the significant risks identified during risk assessment procedures.
• AS 2110.49 through AS 2110.53 carry the discussion among engagement team members.
  • The key engagement team members discuss the company's selection and application of accounting principles including related disclosures and the susceptibility of the statements to material misstatement due to error or fraud (.49).
  • Key engagement team members are all those with significant engagement responsibilities, including the engagement partner (.50).
  • Communication continues throughout the audit as conditions change (.51).
  • The fraud portion is an exchange of ideas, or brainstorming, about how and where the statements might be susceptible to material misstatement due to fraud (.52).
  • The auditor emphasizes maintaining a questioning mind and exercising professional skepticism (.53).
• AICPA Code 1.200 governs the family-relationship question at acceptance. An immediate family member of a covered member, employed by an attest client in a key position, automatically impairs independence. The covered-member qualifier is load bearing: the rule reaches the engagement team, those who can influence it, and certain partners, not every employee of the firm. A key position is one carrying any of three things:
  • primary responsibility for significant accounting functions.
  • responsibility for preparing the financial statements.
  • influence over reported amounts.
  • A family member without such influence does not hold a key position, so the firm evaluates the self-interest and familiarity threats under the conceptual framework and applies safeguards.
• AU-C 600, AU-C 610 and AU-C 620 carry the GAAS requirements for three adjacent matters:
  • AU-C 600, group engagements.
  • AU-C 610, using the work of the internal audit function.
  • AU-C 620, using the work of an auditor's specialist.
  • All three are cited here at section level only, deliberately without paragraph numbers, and their depth belongs to the Planning for and Using the Work of Others lesson.

How PocketCPA uses these sources

Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.

See also

• Sources for every AUD topic
• Free AUD sample questions
• The CPA exam glossary