Engagement Procedures and Work Program

Introduction
Engagement planning is the foundation of every internal audit and consulting engagement. Within planning, the engagement work program and the engagement procedures it contains are where strategy becomes concrete action. The work program translates objectives, scope, and identified risks into specific steps that internal auditors will perform to gather evidence and reach conclusions. On the CIA Challenge Exam, this topic appears often in scenario questions that ask which procedure best achieves an objective, who must approve the work program, or what the work program must contain.

1. Why Engagement Procedures and the Work Program Are Important
a) They link risk to action. Planning identifies the significant risks and the controls that address them. The work program sets out exactly how those risks and controls will be tested, so effort goes to what matters most.
b) They support conformance with the Standards. Under the IIA's Global Internal Audit Standards (Standard 13.6, Engagement Work Program), internal auditors must develop and document a work program to achieve the engagement objectives. Under the earlier IPPF (Standards 2240 and 2240.A1), work programs had to include procedures for identifying, analyzing, evaluating, and documenting information, and had to be approved before work began.
c) They help ensure sufficient, reliable, relevant, and useful evidence. Well-designed procedures produce evidence that supports findings and conclusions. Without them, conclusions may be unsupported.
d) They enable supervision and quality assurance. The work program is the benchmark against which supervisors check whether planned work was done, documented, and reviewed.
e) They promote efficiency and consistency. Assigning procedures, staff, and time budgets helps control cost and keeps work on schedule.
f) They provide accountability. Each step is signed off, cross-referenced to working papers, and traceable. This supports the reliability of the final engagement communication.

2. What It Is: Key Definitions
Engagement work program: A document that lists the procedures to be followed during an engagement, designed to achieve the engagement objectives. It is the detailed, step-by-step plan for performing the fieldwork.
Engagement procedures: The specific tasks or techniques internal auditors perform to gather and evaluate evidence, such as inspecting documents, observing processes, or performing analytical review.
Engagement plan versus work program: The engagement plan sets out objectives, scope, timing, resources, and the risk assessment. The work program sets out the specific procedures used to carry out that plan. On the exam, do not treat the two terms as the same thing.

Typical contents of a work program (consistent with Standard 13.6 and its guidance):
- Engagement objectives and scope
- Criteria used to evaluate the activity under review
- Specific tasks or procedures to be performed, including the nature, timing, and extent of testing
- Methodologies and tools, such as sampling approaches and data analytics
- Resources assigned to each task, with time budgets
- References to related working papers and sign-off fields for preparer and reviewer

Approval requirements:
- The work program must be approved by the chief audit executive (or a designee) before the engagement is carried out.
- Any changes must be approved promptly. Changes may be needed when new risks or information appear during fieldwork.
- For consulting engagements, the form and content of the work program may vary with the nature of the engagement. It must still be documented and must address the objectives agreed with the client.

3. How It Works: Building and Using the Work Program
Step 1: Start from the planning outputs. Review the engagement objectives, scope, and the risk and control assessment. This assessment is often documented in a risk and control matrix. Each significant risk should map to one or more procedures.

Step 2: Decide what kind of test is needed.
- Tests of controls (compliance tests) check whether key controls are designed properly and operating effectively.
- Substantive tests check directly for errors, irregularities, or misstatements in transactions and balances.
- When controls are strong and tested as effective, substantive testing can be reduced. When controls are weak, auditors usually expand substantive testing.

Step 3: Select the procedures (evidence-gathering techniques).
- Inquiry: Asking questions of personnel. It is the weakest form of evidence on its own and should be corroborated.
- Observation: Watching a process as it is performed, such as an inventory count. It is reliable only for the moment observed.
- Inspection or examination: Reviewing documents, records, or physical assets.
- Confirmation: Obtaining written verification from an independent third party, such as a bank or customer. This evidence is highly reliable.
- Recalculation: Checking the mathematical accuracy of computations.
- Reperformance: Independently carrying out a control or procedure to see whether it gives the same result.
- Analytical procedures: Comparing and evaluating relationships among financial and nonfinancial data, such as ratios, trends, and reasonableness tests, to spot unusual items.
- Walkthroughs: Following a transaction from start to finish to understand a process and confirm how controls are designed.
- Data analytics and CAATs: Testing entire populations, finding duplicates, gaps, or anomalies, and matching data across files.

Step 4: Choose the direction of testing.
- Vouching runs from the recorded entry back to the source document. It tests existence, occurrence, or validity: did the recorded item really happen?
- Tracing runs from the source document forward to the records. It tests completeness: was everything that happened actually recorded?

Step 5: Determine nature, timing, and extent.
- Nature is the type of procedure.
- Timing covers interim work versus period-end work, and surprise versus scheduled tests.
- Extent covers sample size and whether to use statistical or judgmental sampling.
- Higher risk calls for more reliable procedures, larger samples, and testing closer to period-end.

Step 6: Assign resources and obtain approval. Match staff skills to tasks, set time budgets, and obtain approval from the CAE or designee before fieldwork begins.

Step 7: Execute, document, and adapt. Perform the procedures, record results in working papers, and cross-reference them to the work program. If new risks or limitations appear, update the program and get prompt approval for the changes.

Step 8: Supervise and review. Supervisors review completed steps to confirm that objectives were met and evidence is sufficient. This is part of the engagement's quality assurance.

4. Evidence Reliability Hierarchy (Frequently Tested)
- Evidence from independent external sources is more reliable than evidence produced inside the organization.
- Evidence the auditor obtains directly, through observation, recalculation, or reperformance, is more reliable than evidence obtained indirectly or by inquiry.
- Documentary evidence is more reliable than oral evidence.
- Original documents are more reliable than copies.
- Internal evidence is more reliable when it is produced under effective internal controls.

5. Exam Tips: Answering Questions on Engagement Procedures and Work Program
Tip 1: Match the procedure to the assertion or objective. First ask what the question is trying to prove. For existence or occurrence, choose vouching or physical inspection. For completeness, choose tracing from source documents to records. For valuation, choose recalculation or comparison to market prices. For ownership or rights, choose inspecting titles or contracts. For a control's operating effectiveness, choose reperformance or observation.

Tip 2: Learn the direction-of-testing trap. Many distractors swap vouching and tracing. Remember this rule:
- Testing whether recorded sales are valid means starting with the sales journal and going to the shipping documents.
- Testing whether all shipments were billed means starting with the shipping documents and going to the sales invoices.

Tip 3: Remember who approves and when. The work program must be approved by the CAE or designee before work begins. Changes must be approved promptly. Answers saying the engagement client, senior management, or the board approves the work program are usually wrong.

Tip 4: Distinguish the plan from the work program. If the question asks about objectives, scope, and risk assessment, it is about the engagement plan. If it asks about specific steps to collect evidence, it is about the work program.

Tip 5: Choose the most reliable evidence when asked for the best procedure. Inquiry alone is rarely the best answer. Prefer external confirmation, direct observation, or reperformance over management's statements.

Tip 6: Use analytical procedures for overall reasonableness and for finding anomalies. When a question describes unexpected trends or asks how to identify areas for further testing efficiently, analytical review is often correct. It is used in planning, during fieldwork, and in the final review.

Tip 7: Know the limits of observation. Observation gives evidence only for the time it was performed. Employees may behave differently when watched. To show that a control operated throughout a period, look for reperformance or tests of documentation across the period.

Tip 8: Recognize risk-based scaling. If controls are weak or fraud risk is high, the correct answer usually expands substantive testing, uses larger samples, or adds surprise procedures. It rarely reduces testing.

Tip 9: Consulting is more flexible. For consulting engagements, the work program's form and content can vary with what was agreed with the client. It is still documented and still approved.

Tip 10: Read for keywords.
- Before fieldwork points to approval of the work program.
- Population-wide testing points to data analytics or CAATs.
- Understand the process points to a walkthrough or flowchart.
- Independent verification points to confirmation.
- Accuracy of calculations points to recalculation.

Tip 11: Eliminate extreme or out-of-scope options. Discard answers in which internal auditors take on management responsibilities, such as designing or implementing controls during an assurance engagement. That impairs objectivity and is not an engagement procedure.

Tip 12: Practice applying the Standards, not memorizing them. The CIA Challenge Exam favors scenario-based questions. For each one, identify:
- The objective
- The risk
- The assertion
- The most reliable and efficient procedure

6. Quick Example
Question: An internal auditor wants to determine whether all goods received were recorded as liabilities. Which procedure is most appropriate?
Answer approach: This is a completeness objective. The auditor should trace receiving reports to the accounts payable records. Vouching recorded payables back to receiving reports would test validity, not completeness, so that would be the distractor.

Summary
The engagement work program is the documented, approved roadmap of procedures that turns planning into evidence. Key points to remember:
- It must include the procedures needed to achieve the objectives.
- It must be approved by the CAE or designee before work starts, and changes must be approved promptly.
- It should be risk-based, matching procedures to assertions and choosing the most reliable evidence available.

On the exam, focus on three things: the purpose behind each procedure, the direction of testing, the evidence reliability hierarchy, and the approval rules. These cover most questions on this topic.