Executive Summary

In the performance of a risk-based audit, adequate planning is of paramount importance as it allows to direct the audit effort towards the areas expected to be most at risk of material misstatement. Additionally, adequate planning helps identify and resolve problems on a timely basis and allows the auditor to organize the engagement, including selecting suitably experienced team members to deal with specific risks, so that it can be performed in an effective and efficient manner.
ISA 300 in particular requires setting out an overall audit strategy and a detailed audit plan. The overall audit strategy should indicate the scope of the work, the resources to be allocated to specific high-risk areas in terms of experienced staff or hours and the timing of the work. A more detailed audit plan follows on from the approach identified in the audit strategy and indicates the audit procedures to be performed in respect of specific items in the financial statements and their timing.
The audit strategy and the audit plan are not necessarily separate documents or processes as they are strictly interrelated. For example the results of initial risk assessment procedures, like the entity’s business risk assessment or the assessment of internal control, will inform the planning for further audit procedures and, vice versa, the outcome of detailed audit procedures may be so different from what expected at the time of planning to require a modification of the audit strategy and audit plan. As such, the audit strategy and detailed audit plan are not necessarily developed in sequence in view of their interaction.
The risk assessment results and the annual audit plan are presented to senior management for comment and input prior to review and approval by the Board of Regents Audit Committee. The scope for each scheduled audit remains tentative until planning begins for