Audit Planning Toolkit: Business-First Planning for External and Internal Auditors

Most audit failures start before fieldwork. A plan copied from last year, or written without the business in the room, looks fine on paper. Then the team asks for reports that no longer exist, tests a process that has changed, runs over budget and misses the risk that mattered.

This course teaches audit planning from the business outwards. You start with what the organisation is trying to do, how it makes money and what has changed this year, and only then turn business risk into audit risk, scope, materiality, people and budget. The approach works for external audits of financial statements, internal audit engagements and public sector performance audits.

Two risks run through every module

• The risk of failure to plan: no plan, a copied plan, a plan made in a vacuum or a plan made too late.
• The risk of engagement failure: a wrong conclusion, a missed risk, an overrun, an independence breach, damaged trust, or legal and reputational harm.

Every teaching lesson shows what happens if a planning step is skipped and how the step protects the engagement, seen by the auditor, the manager and the board.

What you will learn

• Read strategy, objectives, the business model and this year’s changes, and turn business risk into audit risk
• Spot a copied or late plan, and build a risk-based annual plan that fits your team’s capacity
• Write an overall strategy, a detailed plan, an internal audit work programme and a performance audit design
• Control engagement risk through acceptance, independence and terms, and plan first-year audits
• Plan for fraud, going concern, laws and regulations, related parties and significant risks
• Set materiality through the users’ eyes, revisit it when the business changes, and link each risk to a response
• Budget people and time from the risks, plan supervision and group audits, and scale for small entities
• Agree the plan with management and the board without making it predictable, and revise it as the business moves

Your toolkit

Each module ends with a tool for your next engagement, worked on the case and given blank: a business understanding canvas, a planning health check, an engagement risk register, a risk–response matrix with a budget, and a planning memo with a file guide and checklist. Worked figures are spreadsheet grids you can copy into Excel, with every formula listed.

The case

You follow two audits at a fictional African group with a bank, a mobile network, a mobile-money business and a mining supplier: one planned with the business, the other copied from last year, failed and re-planned. A public sector performance audit runs alongside. Every person, organisation and figure in the case is fictional and illustrative, not a benchmark. One lesson summarises three real cases from regulators’ published decisions.

Who it is for

External and internal auditors, audit managers, audit committee members and managers who work with auditors. The first lesson of each module covers the basics.

How standards are used

The course explains the International Standards on Auditing and on Quality Management, the Global Internal Audit Standards and INTOSAI’s performance audit standards in its own words, as at October 2026. Several are being revised and countries adopt them on their own timetables, so each lesson says what to confirm and with whom.

How the course works

Five modules, each with four lessons and a short scenario quiz. You need 70% on each quiz to complete the course and earn your certificate. The course does not prepare you for any certification exam.

This course explains published auditing and internal auditing standards in its own words. It is not endorsed by, or affiliated with, any standard-setter, regulator, professional body or audit firm named in it.