Day 1: Preliminary Assessment and Engagement Hypothesis

Understanding the Process and Context

• Define process objectives, flows, accountable parties
• Gather policies, data, prior assurance results
• Identify changes capable of altering exposure
• Prepare a concise engagement context summary

Engagement Risks and Controls

• Connect risk with specific business objective
• Identify key controls before selecting tests
• Distinguish design weakness from operating failure
• Build a preliminary risk-control matrix

Stakeholders and Expectations

• Identify process owners and affected stakeholders
• Separate management expectations from auditor responsibility
• Define information requiring early agreement
• Prepare questions for the opening meeting

Day 2: Objectives, Scope, and Work Program

Engagement Objectives and Criteria

• Write objectives defining internal audit evaluation
• Select internal or criteria for judgment
• Link objectives with priority engagement risks
• Review audit objectives lacking evidence

Scope Boundaries and Resources

• Define locations, systems, periods, populations
• Exclude areas not to engagement objectives
• Estimate team capabilities and available time
• Set scope balancing exposure and capacity

Testing Procedures and Sampling

• Define procedure and evidence per risk
• Choose sampling method based on purpose
• Combine data analysis with manual inspection
• Prepare a coherent audit work program

Day 3: Plan Approval and Early Execution Management

Planning Practical Memorandum

• Summarize context risks objectives and scope
• Define methodology resources and key milestones
• Document assumptions and constraints affecting delivery
• Prepare memorandum ready for supervisory review

Supervisory and Quality Review

• Test work-program consistency with risks/procedures
• Identify tests unsupported by stated objectives
• Adjust testing depth according to exposure
• Conduct a structured supervisory review

Adapting to New Information

• Define triggers for scope/procedure changes
• Document and approve changes during engagement
• Prevent drift toward immaterial issues
• Simulate unexpected change in engagement risk

• Complete engagement planning using realistic audit case files
• Risk-control matrices connecting assessment with testing
• Scope and sampling exercises revealing overreach or insufficient coverage
• Group supervisory review of planning memoranda