Engagement Work Programs

Why Engagement Work Programs Matter
An engagement work program is the bridge between what an internal auditor intends to accomplish and how it will actually be accomplished. Without a documented work program, an engagement drifts: procedures are performed because they are familiar rather than because they address a risk, evidence is collected without a clear purpose, and conclusions become difficult to defend. For the CRMA candidate, the work program is central to the Risk-Based Audit Planning and Engagements domain because it is the point at which risk assessment is converted into specific, testable action. Examiners expect you to understand that a work program is not a checklist inherited from last year; it is a tailored, risk-driven plan that must be approved before fieldwork begins and adjusted as new information emerges.

What Is an Engagement Work Program?
Under the 2017 International Standards for the Professional Practice of Internal Auditing, Standard 2240 (Engagement Work Program) states that internal auditors must develop and document work programs that achieve the engagement objectives. Implementation Standard 2240.A1 adds that work programs must include the procedures for identifying, analyzing, evaluating, and documenting information during the engagement, must be approved prior to implementation, and any adjustments must be approved promptly. The Global Internal Audit Standards (effective 2025) carry this forward in Standard 13.6 (Work Program), requiring internal auditors to develop a work program that identifies the tasks needed to achieve the engagement objectives and that is reviewed and approved by the chief audit executive or a designee before implementation.

In practical terms, the work program documents:
• The engagement objectives and scope it supports
• The specific risks and controls that will be examined
• The detailed procedures (steps) to be performed for each objective or risk
• The nature, timing, and extent of testing, including sampling approaches
• Assignment of staff and estimated hours or budget
• Reference to supporting documentation and working papers
• Evidence of review and approval, including sign-off on changes

How It Works: From Risk Assessment to Procedures
The work program is the final deliverable of engagement planning, and it depends on everything that comes before it. The logical sequence is:

1. Understand the activity under review. The auditor gathers information about the process, its objectives, systems, key personnel, and prior audit results. Standard 2201 (Planning Considerations) requires attention to the activity's strategies and objectives, the significant risks, the adequacy of risk management and control processes, and opportunities for improvement.
2. Perform the engagement-level risk assessment. Standard 2210.A1 requires a preliminary assessment of the risks relevant to the activity. Risks are identified, rated for likelihood and impact, and linked to the controls management relies upon.
3. Set engagement objectives. Objectives must reflect the results of the preliminary risk assessment (2210.A1). Objectives answer the question: what is this engagement trying to conclude about?
4. Define scope. Scope (Standard 2220) must be sufficient to achieve the objectives and should specify systems, records, personnel, locations, and the period covered, including items owned by third parties where relevant.
5. Allocate resources. Standard 2230 requires appropriate and sufficient resources based on the nature and complexity of the engagement, time constraints, and available staff.
6. Develop the work program. Each engagement objective is decomposed into the risks that threaten it, the controls that mitigate those risks, and the procedures needed to evaluate design adequacy and operating effectiveness. Procedures typically include inquiry, observation, inspection of documents, reperformance, analytical review, and data analysis. The program specifies sample sizes, populations, time periods, and the evidence standard required.
7. Obtain approval. The CAE or designee reviews the program to confirm that it is aligned with objectives, that procedures are proportionate to risk, and that resources are realistic. Fieldwork should not begin until approval is documented.
8. Execute and adjust. As fieldwork proceeds, new risks, control failures, or scope limitations may require changes. Adjustments are permitted and expected, but each must be documented and approved promptly, with the rationale recorded.

Characteristics of a Strong Risk-Based Work Program
• Traceability: Every procedure traces back to a risk and an engagement objective. If a step cannot be linked to a risk, it is a candidate for removal.
• Proportionality: High-risk areas receive more extensive testing; low-risk areas receive lighter or no coverage. Effort follows risk, not habit.
• Specificity: Steps are written so that another competent auditor could perform them and reach a consistent conclusion. Vague steps such as review controls are replaced with precise actions, populations, and criteria.
• Flexibility: The program accommodates changes while preserving an approval trail.
• Alignment with criteria: Procedures evaluate the activity against suitable criteria (policies, laws, frameworks such as COSO, or leading practices) as required by Standard 2210.A3.
• Consideration of fraud and IT: Standard 2210.A2 requires consideration of the probability of significant errors, fraud, noncompliance, and other exposures when developing objectives, and these should flow into the program.

Standard Versus Tailored Work Programs
Some internal audit functions maintain standard or pro forma programs for recurring engagements such as branch audits or payroll reviews. These are acceptable only as a starting point. The exam consistently reinforces that even a standard program must be adapted to the specific engagement based on the current risk assessment, changes in the control environment, prior findings, and emerging issues. Using a prior-year program without modification is a classic distractor representing poor practice.

Relationship to Working Papers and Supervision
The work program is itself a working paper and serves as the index for the rest of the engagement file. As each step is completed, the auditor records who performed it, when, the working paper reference, and the result. This supports Standard 2340 (Engagement Supervision) because supervisors use the program to confirm that all planned procedures were performed, that deviations were approved, and that conclusions are supported by evidence. It also supports quality assurance reviews after the engagement concludes.

Work Programs for Consulting Engagements
For consulting engagements, Standard 2240.C1 states that work programs may vary in form and content depending on the nature of the engagement. There is more flexibility, but the principle of documenting what will be done to meet the agreed objectives remains. The exam may test whether you recognize that consulting work programs are permitted to be less formal but are still required.

Common Pitfalls Tested on the Exam
• Beginning fieldwork before the program is approved
• Modifying procedures during fieldwork without documenting and obtaining approval for the change
• Writing procedures that are not linked to identified risks or objectives
• Over-testing low-risk areas while under-testing high-risk areas
• Copying the prior program without updating the risk assessment
• Treating the work program as fixed and refusing to adjust when significant new information arises
• Omitting the nature, timing, and extent of testing, leaving too much to individual judgment
• Confusing the engagement work program (engagement level) with the annual audit plan (function level)

Exam Tips: Answering Questions on Engagement Work Programs

Tip 1 – Know the sequence. Many questions ask what should happen first, next, or before fieldwork. The order is: understand the activity, perform the preliminary risk assessment, set objectives, define scope, allocate resources, develop the work program, obtain approval, then execute. If an option places the work program before the risk assessment or objectives, it is wrong.

Tip 2 – Approval before implementation is non-negotiable. Any scenario in which an auditor starts testing while the program is still being drafted or awaiting approval describes a deficiency. Likewise, changes made mid-engagement must be approved promptly, not at the end.

Tip 3 – Follow the risk. When asked which procedures to include or how to allocate testing effort, choose the option that directs effort toward the highest-rated risks and key controls. Options that treat all areas equally or that rely on a standard checklist are distractors.

Tip 4 – Watch for the distinction between the work program and the annual plan. The annual audit plan is the CAE's risk-based schedule of engagements for the function; the engagement work program is the procedure-level document for a single engagement. Questions sometimes swap these to test comprehension.

Tip 5 – Recognize what belongs in a program. If asked which element should be included, procedures for identifying, analyzing, evaluating, and documenting information are always correct. Items such as the final audit report wording or management's corrective actions are not part of the program.

Tip 6 – Use the Standards vocabulary. Look for keywords such as must be documented, must be approved prior to implementation, adjustments approved promptly, and procedures that achieve engagement objectives. The correct answer usually mirrors the language of Standard 2240 or Standard 13.6.

Tip 7 – Consulting flexibility. If the scenario involves a consulting engagement, remember that the program may vary in form and content, but it is still required. Do not select an option saying no program is needed.

Tip 8 – Prefer the most complete and defensible answer. When two options seem plausible, choose the one that preserves documentation, approval, and traceability to risk. The exam rewards disciplined professional practice over expediency.

Tip 9 – Read scenario questions for the actual problem. If an auditor finds that a key control was not in the original program, the best response is to update the program, document the change, obtain approval, and perform the additional testing, not to ignore it or to complete the original steps and raise it later.

Worked Example
During fieldwork on an accounts payable engagement, an auditor discovers that a new vendor master file approval control was introduced three months ago and is not addressed in the approved work program. What is the most appropriate action?
A. Complete the approved program and mention the new control in the report.
B. Test the new control immediately and update the program at the end of fieldwork.
C. Revise the work program to include procedures for the new control and obtain prompt approval before performing the additional testing.
D. Defer the new control to next year's engagement.

Answer: C. The new control is relevant to a significant risk, so the program must be adjusted. Standard 2240.A1 requires that adjustments be approved promptly, which rules out B. Options A and D fail to address a known risk-relevant change, undermining the engagement's ability to achieve its objectives.

Summary
The engagement work program operationalizes risk-based auditing. It must be developed from the engagement risk assessment and objectives, must document specific procedures and the nature, timing, and extent of testing, must be approved before fieldwork, and must be adjusted with documented approval when circumstances change. For the CRMA exam, anchor your answers in sequence, approval, risk alignment, and Standards terminology, and you will consistently identify the correct response.