1.1 Why We Plan: Business First, Audit Second (Start Here)
Audit planning is deciding, before the work starts, what an engagement must achieve and how it will get there, starting from what the business is trying to do and what could go wrong. A plan sets the scope, the timing and the direction of the work, names the risks that matter, and puts the right people on them.
Planning is not a form to complete before the real audit begins. It is the point at which most of the engagement’s quality is decided. A team that understands the business asks for the right reports, tests the processes that actually exist and spends its hours where things could go wrong. A team that does not will work hard on the wrong things.
Why business first
A plan built from last year’s file tests last year’s business. Organisations change every year: they enter new markets, change systems, sign new kinds of contract, outsource work and lose or gain key people. Each change moves risk. If the plan does not start from those changes, it will miss them.
So this course always starts in the same place: strategy, objectives, how the business makes money and what has changed. Only then does it turn to audit risk, materiality, scope, people and budget. This order works whether you audit financial statements for shareholders, review a process for an audit committee, or examine a public body’s value for money.
The two risks
Two risks run through every module. The first is the risk of failure to plan: no plan, a copied plan, a plan made in a vacuum or a plan made too late. The second is the risk of engagement failure: the engagement does not deliver the right conclusion, on time, within the rules and with trust intact. The first risk usually causes the second.
| Risk | What it looks like | Who pays |
|---|---|---|
| Failure to plan | Last year’s programme rolled forward; no meeting with management before fieldwork; risks listed but not linked to work; planning squeezed into the first day of fieldwork | The audit team, in overruns and rework; management, in wasted time |
| Engagement failure | A wrong opinion or conclusion; a missed risk; a large overrun; an independence breach; managers who stop co-operating; regulatory findings or legal action | The board and users, who rely on a conclusion that is wrong; the firm or function, in reputation and fees |
Meet the two audits
The course follows two audits at Kuvanya Group, a fictional group with a bank, a mobile network, a mobile-money business, a mining supplier and a shared services hub across six countries.
- Audit 1, planned with the business. Seruwa & Partners, a fictional audit firm, wins the tender to audit the group’s financial statements for the year ending 31 December 2026. It is the firm’s first year. The plan starts from the group’s strategy and changes, and holds up when the business moves.
- Audit 2, the copied plan. Kuvanya’s internal audit team plans a review of procurement at Kuvanya Mining Supplies by rolling last year’s programme forward. It misses three changes, overruns and damages trust. In Module 2 it is paused, scored and re-planned from the business, and the re-plan carries through to Module 5.
- A public sector variant. The Auditor-General’s office plans a performance audit of the Power Authority’s maintenance procurement, so you can see how topic selection and audit design work in the public sector.
Nomsa Dube’s internal audit team has grown to three people with Tanaka Rusike’s arrival six months ago from an external firm, so the team now has 480 audit days a year to plan.
| Name | Role | Audit |
|---|---|---|
| Refilwe Seane | Group engagement partner, Seruwa & Partners (Johannesburg) | Audit 1 |
| Mubanga Siame | Group audit manager, Seruwa & Partners (Lusaka) | Audit 1 |
| Nomsa Dube | Head of Internal Audit, Kuvanya Group (Harare) | Audit 2 |
| Tanaka Rusike | Internal auditor, Kuvanya Group (Harare) | Audit 2 |
| Femi Adebayo | Internal auditor, data analytics (Lagos) | Audit 2 |
| Tendai Musarurwa | Group CFO (Harare) | Audit 1 |
| Dr Adaeze Okafor | Independent non-executive director and Audit and Risk Committee Chair (Abuja) | Both |
| Pieter van Wyk | Operations Manager, Kuvanya Mining Supplies (Rustenburg) | Audit 2 |
| Kagiso Molefe | Procurement Officer, Kuvanya Mining Supplies | Audit 2 |
| Brian Otieno | Group IT Manager (Nairobi) | Audit 1 |
| Lindiwe Nkosi | Group Company Secretary (Johannesburg) | Audit 1 |
| Esther Nakato | Audit lead, the Auditor-General’s office | Public sector variant |
How the course works
- Two risks and Three views. Each teaching lesson ends with a short box on what happens if the step is skipped and how it protects the engagement, then a table showing the step through the eyes of the auditor, the manager and the board.
- Same step, two rulebooks. Where external audit, internal audit and public sector audit follow different standards for the same step, a short table sets them side by side.
- Worked grids. Worked examples with figures are spreadsheet grids. Copy each one into Excel starting at cell A1, then type the formulas from the “How it is worked” list. “Then copy it down to” and “then copy it across to” mean Excel’s fill-down and fill-across.
- Toolkits. Each module ends with a tool you can use on your next engagement, worked on the case and given blank.
| Module | Tool | What it does |
|---|---|---|
| 1 | Business understanding canvas | Puts the business on one page before any risk is assessed |
| 2 | Planning health check | Scores a plan on twelve critical success factors before fieldwork |
| 3 | Engagement risk register | Lists what could make the engagement fail and who owns each response |
| 4 | Risk–response matrix and budget | Links each risk to work, people and hours |
| 5 | Planning memo, file guide and checklist | Records the plan and the reasons for it, in order |
Standards are shown by number and title as they stood in October 2026. Several are being revised, and countries adopt them on their own timetables, so each lesson says what to confirm. The full list of standards and editions is in lesson 5.4.
The course assumes the basics of internal audit covered in Internal Audit Fundamentals (course 9) and the reading of accounts and budgets covered in Finance for Non-Finance Managers: Read the Numbers, Make Better Decisions (course 47).
This course draws on the International Standards on Auditing and International Standards on Quality Management of the IAASB, the IIA’s Global Internal Audit Standards and Topical Requirements, and INTOSAI’s performance audit standards, as they stood in October 2026. IAASB, ISA, ISQM and ISA for LCE are trademarks of IFAC; IPPF is a registered trademark of The IIA; ISSAI pronouncements are issued by INTOSAI. Framework names belong to their issuing bodies; this course explains them in its own words and is not endorsed by them. The course does not prepare you for any certification exam.
About the case company: Kuvanya Group, its subsidiaries (Kuvanya Bank, KuvaTel, KuvaPay, Kuvanya Mining Supplies and Kuvanya Shared Services), its client “the Power Authority”, the audit firm Seruwa & Partners, “the Auditor-General’s office” and every person named in this course are fictional. They were created by EunoiaData for teaching purposes only. Any resemblance to real organisations or people is coincidental. Countries, standards and regulators are real and are described as they stood in 2026. The real cases in lesson 5.3 are summarised from regulators’ published decisions.
Example: A newly appointed internal auditor at a fictional hospital trust in Ndola inherits a ten-year-old audit programme for the pharmacy. Before she opens it, she asks the chief executive one question: what has changed? The answer, a new dispensing system and a supplier who now holds stock on site, becomes the first page of her plan, and half of the old programme is retired.
Two risks
| Risk | What it means here |
|---|---|
| If this step is skipped | The team plans from habit: last year’s file, last year’s hours, last year’s risks. The first sign of trouble comes in fieldwork, when it is expensive to fix. |
| How this step protects the engagement | Starting from the business makes the plan fit this year’s organisation, so the hours go to real risks and the conclusion rests on the right evidence. |
Three views
| View | What it means here |
|---|---|
| The auditor | Planning is where the engagement’s quality is decided. Start every plan with the question “what has changed?” before you open last year’s file. |
| The manager | A good plan means fewer pointless requests and earlier warnings. Expect the auditor to ask about your strategy and changes, and be ready to answer. |
| The board | Ask how the plan reflects this year’s strategy and changes. A plan that looks like last year’s is a warning sign. |
Words to know
| Term | What it means |
|---|---|
| Audit planning | Deciding, before the work starts, what the engagement must achieve and how |
| Overall audit strategy | The scope, timing and direction of an external audit, which guides the detailed plan |
| Audit plan | The detailed procedures, their timing and extent, that carry out the strategy |
| Engagement plan | An internal auditor’s objectives, scope, criteria, resources and work programme for one engagement |
| Business risk | A risk that could stop the organisation achieving its objectives and strategies |
| Engagement risk | A risk that the engagement itself fails: wrong conclusion, overrun, breach or lost trust |
Check before you act: Standards, their editions and the dates they apply change, and countries adopt them on their own timetables. This lesson explains them in plain words as at October 2026; confirm the version that applies to your engagement with the standard-setter, your regulator or your professional body.
Key takeaway
Plan from the business first: what it is trying to do, how it makes money and what has changed. A plan that starts from last year’s file risks both failure to plan and engagement failure.
Enjoyed this lesson? Get the full course: Audit Planning Toolkit: Business-First Planning for External and Internal Auditors
Unlock every lesson, the module quizzes and your certificate on completion.