The profession’s rule: no conclusion without evidence, and no evidence without documentation. Whatever is not written in the working papers cannot be defended six months later.
1 The stages of an engagement
Planning
Understanding the activity and setting objectives and scope
Opening meeting
Notifying management and agreeing coordination
Work programme
The testing steps for each objective
Fieldwork
Gathering evidence and testing controls
Discussion
Presenting the findings to management
Reporting
Issuing the results and recommendations
Six connected stages — and most engagement failures start from incomplete planning
2 Planning: understand before you test
- Understand the activity: what does it do? Where does the process start and end? Who touches it?
- Set the engagement objectives: what exactly do we want to be satisfied about?
- Set the scope: the period, the branches, the systems covered, and what is explicitly out of scope.
- Map risks and controls: what could fail? And which control is meant to prevent it?
- Allocate resources: who tests what, and in how many days.
A quick tool
Map the process end to end, and at every step ask two questions: what could fail here? and what prevents it today? — those two answers produce the whole work programme.
3 Testing methods
| Method | What it gives you | Its limits |
|---|---|---|
| Document inspection | Documented evidence that can be filed | Reveals nothing that was never documented |
| Field observation | Reality as it actually happens | Behaviour may change with the auditor present |
| Interview | Understanding context and reasons | An opinion that needs corroborating evidence |
| Reperformance | Confirmation that the control actually works | Takes time |
| Analysis and comparison | Surfacing anomalies in the data | Needs clean, complete data |
| Confirmations | Corroboration from an external party | Depends on others responding |
4 The sample
Populations are rarely tested in full, so a sample is selected. What matters is that the selection is justified and documented: how many items? Why that number? And how were the items chosen?
- Random: general, unbiased representation of the population.
- Risk-directed: focused on large amounts, sensitive parties or exceptions.
- Full testing: when the population is small or the risk very high.
The limits of extrapolation
If you tested a sample directed at high-risk cases, do not extrapolate its result to the whole population. State the selection method in the report so the figure is read in its proper context.
5 Working papers
A working paper is the record of what you did and what you found. A good one is understandable to another auditor who was not on the engagement, and answers: what did you test? How? What was the source? And what was the result?
| Engagement | Audit of the procurement cycle — Q1 |
| Objective | Confirm an approved purchase order exists before every payment |
| Population | 480 payment requests during the period |
| Sample | 40 requests: 25 random + 15 directed at amounts above 100,000 |
| Testing | Matching the payment request to the purchase order, the invoice and the goods receipt note |
| Result | 36 matched · 4 paid with no purchase order (3 of them above 100,000) |
| Source | System report PR-114 dated 10/4 + document images attached |
| Conclusion | The pre-approval control is not effective for urgent cases |
Lesson summary
- An engagement has six stages, starting with planning and ending with the report.
- Planning builds an understanding of the activity and sets objectives, scope, risks and controls.
- There are many testing methods, each with what it gives and what it does not.
- Sample selection is justified and documented, and the result of a directed sample is not extrapolated.
- A working paper is understandable to another auditor: what, why, how and with what result.
6 Test your understanding
Three quick questions
Pick the answer you believe is correct and you will see the result immediately.
1. In an interview the department head said the control is in place. Is that enough as evidence?
A verbal statement is an important source, but it is not sufficient evidence on its own.
2. Twenty items were selected, all from the large amounts. What limits the result?
A directed sample is useful for surfacing concentrated risk, but it is not a basis for statistical extrapolation.
3. What is the quality standard for a working paper?
Understandability and re-traceability are the standard — not length, and not signatures.