PCAOB Audit Planning: A Practical Guide for External Auditors

Oct 8

7 min read

Why Effective Audit Planning Is the Foundation of Audit Quality

A successful financial statement audit begins long before auditors start testing transactions, confirming balances, or examining supporting documentation.

It begins with audit planning.

Under PCAOB AS 2101 — Audit Planning, auditors are required to establish an overall audit strategy and develop an audit plan that addresses the nature, timing, and extent of planned procedures.

But effective planning involves much more than completing a standard planning checklist or updating last year's audit program.

It requires auditors to understand the company, identify significant risks, establish materiality, assign appropriate personnel, and design audit procedures responsive to the risks of material misstatement.

The purpose of audit planning is not simply to organize the engagement. It is to determine how the auditor will obtain sufficient appropriate audit evidence to support the audit opinion.

1. Understand the Requirements of PCAOB AS 2101

PCAOB AS 2101 establishes requirements for planning an audit of financial statements.

The standard addresses several important activities:

Establishing the overall audit strategy.
Developing the audit plan.
Considering the company's business and industry.
Evaluating the audit's scope and reporting objectives.
Identifying necessary engagement resources.
Considering the work of specialists and other auditors.
Coordinating audit activities.
Updating the audit strategy and plan when circumstances change.

The audit strategy establishes the overall direction of the engagement.

The audit plan translates that strategy into specific procedures.

Both should reflect the engagement's circumstances and assessed risks.

2. Start with the Company's Business and Risks

Before designing audit procedures, the engagement team needs to understand the organization being audited.

This includes its business model, operating environment, industry, regulatory obligations, financing arrangements, and significant accounting practices.

Important planning questions include:

How does the company generate revenue?
What transactions create the greatest financial reporting risks?
What significant estimates and judgments affect the financial statements?
Has the company experienced changes in management, systems, financing, or operations?
What fraud risks could result in material misstatements?

Auditors should consider both external and internal factors.

A company experiencing declining sales, liquidity pressures, covenant violations, or significant management turnover may present risks different from those identified in the prior year's audit.

A risk-based audit plan must reflect the company as it exists today—not merely as it existed during the previous audit.

3. Connect Planning to PCAOB AS 2110

PCAOB AS 2110 — Identifying and Assessing Risks of Material Misstatement — is closely related to AS 2101.

AS 2110 requires auditors to perform risk assessment procedures and identify risks at the financial statement and assertion levels.

Planning should address:

Significant accounts and disclosures.
Relevant financial statement assertions.
Inherent risk factors.
Fraud risks.
Internal control considerations.
Significant changes in the business.
Areas involving substantial judgment or estimation.

The results of risk assessment should directly influence the audit plan.

For example, if revenue recognition presents a significant fraud risk, the audit plan should include procedures specifically responsive to that risk.

A generic revenue audit program may not be sufficient.

4. Establish Materiality Early

PCAOB AS 2105 — Consideration of Materiality in Planning and Performing an Audit — addresses materiality judgments.

Auditors should determine materiality based on the company's circumstances and the needs of reasonable investors.

Materiality affects the nature, timing, and extent of audit procedures.

Important considerations include:

Overall materiality.
Tolerable misstatement.
Relevant quantitative benchmarks.
Qualitative considerations.
Risks involving sensitive disclosures.
Changes in financial performance.

Materiality is not merely a mathematical calculation.

For example, a relatively small misstatement could be significant if it changes a reported loss into a profit, affects compliance with a debt covenant, or conceals an important trend.

The audit plan should explain the rationale for significant materiality judgments.

5. Develop an Appropriate Audit Strategy

The overall audit strategy should establish how the engagement will be performed.

Important strategic decisions include:

Staffing: Are the assigned personnel sufficiently experienced for the engagement's risks?
Supervision: How will engagement partners and managers supervise the audit?
Timing: Which procedures should occur during interim periods, and which must be performed at year-end?
Specialists: Are valuation, tax, information technology, or other specialists needed?
Internal controls: Will the auditor test controls, and is an integrated audit required?
Locations: Does the company have significant subsidiaries, components, or foreign operations?
Technology: How will the engagement team obtain and evaluate electronic audit evidence?
Reporting: What filing deadlines and regulatory requirements affect the engagement?

A properly designed strategy should direct resources toward the areas presenting the greatest audit risk.

6. Translate the Strategy into an Audit Plan

The audit plan should identify the procedures necessary to address the assessed risks.

A practical planning matrix can help demonstrate the relationship between risk and audit response.

Audit area	Identified risk	Planned response
Revenue	Improper revenue recognition	Test contracts, cutoff, and significant transactions
Accounts receivable	Overstated balances	Confirm balances and evaluate subsequent collections
Inventory	Existence and valuation	Observe counts and test costing and obsolescence
Estimates	Management bias	Evaluate methods, assumptions, and underlying data
Debt	Incomplete liabilities or disclosures	Examine agreements and confirm significant obligations
Journal entries	Management override	Test entries selected using fraud-risk criteria

This matrix is illustrative. Actual procedures must be tailored to the company's circumstances and the relevant assertions.

The objective is to demonstrate:

Identified Risk → Planned Audit Response → Audit Evidence → Audit Conclusion

7. Incorporate Fraud Risk into Planning

PCAOB AS 2401 — Consideration of Fraud in a Financial Statement Audit — establishes important requirements concerning fraud.

Fraud considerations should be integrated throughout the audit planning process.

Auditors should evaluate:

Incentives and pressures to commit fraud.
Opportunities for fraudulent financial reporting.
Management override of controls.
Revenue recognition risks.
Significant unusual transactions.
Related-party transactions.
Management bias in accounting estimates.

Fraud risk assessment should not become a separate checklist that has little influence on the audit plan.

When fraud risks are identified, the planned procedures should address those risks directly.

8. Plan for Internal Control Considerations

Auditors must understand relevant internal controls as part of risk assessment.

For integrated audits, PCAOB AS 2201 establishes requirements for auditing internal control over financial reporting.

Planning should consider:

Entity-level controls.
Significant processes and accounts.
Relevant assertions.
Control design.
Operating effectiveness.
Information technology general controls.
Management review controls.
Identified control deficiencies.

Even when an audit does not include a separate opinion on internal control over financial reporting, the auditor's understanding of relevant controls affects the assessment of risk and the design of substantive procedures.

9. Plan for Audit Evidence

PCAOB AS 1105 — Audit Evidence — requires sufficient appropriate audit evidence.

The engagement team should consider whether the planned procedures will produce evidence that is relevant and reliable.

Examples include:

External confirmations.
Inspection of contracts and documents.
Observation of physical inventory.
Recalculation and reperformance.
Substantive analytical procedures.
Testing of accounting estimates.
Evaluation of system-generated reports.

Auditors should also consider how they will evaluate the completeness and accuracy of company-produced information used as audit evidence.

An audit procedure is only useful if it produces evidence capable of addressing the identified risk.

10. Plan Supervision and Review

PCAOB AS 1201 — Supervision of the Audit Engagement — addresses supervision and review responsibilities.

Planning should identify areas requiring increased involvement by experienced engagement personnel.

These may include:

Significant fraud risks.
Complex accounting estimates.
Going-concern considerations.
Related-party transactions.
Significant unusual transactions.
Complex revenue arrangements.
Significant accounting changes.

Engagement partners and managers should not wait until audit completion to review the most difficult judgments.

Early involvement can improve audit quality and reduce the need for extensive late-stage revisions.

11. Update the Audit Plan When Risks Change

Audit planning is a continuing process.

New information may require auditors to revise their strategy or procedures.

Examples include:

Unexpected financial results.
Discovery of significant control deficiencies.
New fraud allegations.
Changes in management.
Unanticipated accounting transactions.
Liquidity deterioration.
Contradictory audit evidence.

The engagement team should document significant changes to the audit plan and explain why the changes were necessary.

A good audit plan is disciplined but not inflexible.

12. Document the Planning Process

PCAOB AS 1215 — Audit Documentation — establishes documentation requirements relevant to the planning process.

Planning documentation should provide a clear record of:

The overall audit strategy.
Significant risks identified.
Materiality judgments.
Planned audit procedures.
Staffing and supervision considerations.
Significant changes in the plan.
The rationale for important professional judgments.

A reviewer should be able to understand how the engagement team identified risks and designed procedures responsive to them.

Documentation should demonstrate the auditor's reasoning—not simply that a checklist was completed.

13. Common PCAOB Audit Planning Deficiencies

Common planning weaknesses include:

Reusing prior-year audit programs without reassessing risks.
Failing to identify significant accounts and relevant assertions.
Inadequate consideration of fraud risks.
Weak linkage between risk assessment and audit procedures.
Insufficient involvement of experienced personnel.
Inadequate consideration of complex estimates.
Failure to evaluate significant changes in the business.
Poor documentation of materiality judgments.
Failure to revise the plan when new risks emerge.

These weaknesses can affect the quality of audit evidence and the defensibility of the final audit opinion.

14. A Practical PCAOB Audit Planning Checklist

Before moving into substantive audit execution, the engagement team should be able to answer the following questions:

Have we established an appropriate overall audit strategy?
Do we understand the company's business and operating environment?
Have we identified significant accounts, disclosures, and relevant assertions?
Have we assessed fraud risks?
Have we established and documented materiality?
Are planned procedures responsive to assessed risks?
Have we considered relevant internal controls?
Do we have the appropriate personnel and specialists?
Have we established adequate supervision and review?
Have we planned to obtain sufficient appropriate audit evidence?
Have we documented significant planning judgments?
Do we have a process for revising the audit plan as circumstances change?

If the engagement team cannot answer these questions, the audit may not be ready to proceed into full execution.

The Bottom Line

PCAOB audit planning is not an administrative exercise.

It is the process through which auditors determine how to obtain sufficient appropriate evidence while addressing the risks of material misstatement.

Effective planning integrates the requirements of AS 2101, AS 2110, AS 2105, AS 2401, AS 2301, AS 1105, AS 1201, and AS 1215.

The central relationship is:

Understand the Business → Identify Risks → Establish Materiality → Design Procedures → Obtain Evidence → Evaluate Results

A well-planned audit does not guarantee that every problem will be identified.

But poor planning can undermine even the most extensive audit testing.

Audit quality begins with understanding the risks—and developing a plan that addresses them.