Audit planning: from risk to evidence, between ISA Italia and voluntary engagements

Why planning determines audit quality

In many audit engagements, the difference between solid work and fragile work is not visible in the final report, but in what happened beforehand: understanding the entity, identifying risk areas, and defining procedures and the thresholds beyond which an error must be investigated. Planning is the stage at which the auditor turns the information gathered into a verifiable work programme. Without this stage, the evidence collected risks being abundant but irrelevant, or scarce precisely where risk is highest.

The International Standards on Auditing ISA Italia, adopted by decree of the Ragioniere generale dello Stato and updated over time, place planning among the auditor's central objectives. The quality control standard ISQC Italia 1 reminds eligible entities of the need for internal rules consistent with the size of the firm and the nature of the engagements. On this framework rests the Italian Code of Ethics and Independence, applicable from statutory audit engagements for financial years beginning on or after 1 January 2023, which addresses professional ethics, confidentiality, professional secrecy, independence and objectivity.

This article addresses a specific point: how planning is constructed and what changes, in practice, between a statutory audit and a voluntary engagement.

Understanding the entity before writing the procedures

Planning starts with understanding the context. The sector of activity is not enough: what is needed is the business model, operating cycles, revenue structure, main contracts, how the accounting information systems work, the personnel who manage the records, and the degree of segregation of duties.

A hypothetical example: a manufacturing company with a single warehouse and an integrated ERP system presents different risks from a service company that invoices on a contract basis and recognises revenue according to the stage of completion. In the first case the focus is on the existence and valuation of inventory; in the second, on the revenue recognition criterion and the estimate of contract costs. The same procedure applied indiscriminately to both contexts produces evidence of little significance.

At this stage the auditor also gathers information on the control environment: who authorises transactions, how accounts are reconciled, what controls exist and who performs them. This information is not only used to assess risk: it guides the choice between tests of controls and substantive procedures.

A frequently overlooked step is communication with management and, where required, with the governance bodies. Clarifying in advance timings, responsibilities and the documentation expected reduces interruptions and makes planning realistic.

Materiality, risk and the nature of procedures

Knowledge of the entity gives rise to the assessment of the risk of material misstatement, at both the financial statement level as a whole and the assertion level. On this basis materiality is determined and performance thresholds are defined.

Materiality is not a number chosen at will: it depends on the context, on the users of the financial statements and on the nature of the items. A threshold calculated on a percentage of revenue may not be adequate for an entity with thin margins, where a small change in cost has a material effect on the result.

From this follow concrete choices:

• which areas require extended substantive procedures instead of tests of controls, because internal controls are not reliable;
• which balances require external confirmations, physical inventory counts, circularisations or documentary examination;
• which accounting estimates, for example provisions for risks, impairments or accruals, require reasonableness analyses and review of historical data;
• what level of sampling is consistent with the risk identified.

A work programme that does not link each procedure to a specific risk is difficult to defend, even when the working papers are well ordered. In auditing, the logic matters as much as the document.

Evidence: what is needed, in what form, with what professional judgement

Evidence is what supports the auditor's conclusion. Its adequacy depends on relevance and reliability, not on quantity. A third-party confirmation of a balance has a different value from an internal statement; an original document has a different value from a copy; direct observation has a different value from a reconstruction after the event.

In practice, the evidence-gathering stage is also the point at which the limitations of the engagement emerge. If the entity does not have complete bank reconciliations, if inventory has not been counted, if part of the documentation is held by uncooperative third parties, the auditor must assess the effect on the conclusion and, if necessary, discuss it with the client before proceeding further.

The ethical code sets out independence and objectivity as conditions of the engagement. In planning this translates into concrete checks: absence of significant economic relationships with the client outside the engagement, absence of conflicts with other services provided to the same entity, and assessment of the threats and applicable safeguards. These are assessments that depend on the individual engagement and do not allow standard answers.

Statutory audit and voluntary engagements: same technique, different scopes

The statutory audit of financial statements is governed by Legislative Decree No. 39 of 27 January 2010, and entities registered in the Register of Statutory Auditors are required to observe the ISA Italia auditing standards and the quality control standard ISQC Italia 1. Within this scope the subject matter, the addressees and the auditor's responsibilities are defined by law and by the standards.

A voluntary engagement, by contrast, arises from a client request or an internal need, for example a financial statement analysis preparatory to a negotiation, a due diligence, a business plan or the accounting certification of costs for grants or financing. Here the professional does not automatically apply the entire framework of the statutory audit: they define with the client the subject matter, the level of assurance, the agreed procedures and the limitations of the work.

This distinction is decisive and must be clarified in writing. A voluntary engagement:

• may have a narrower scope than a full audit;
• may exclude areas or periods;
• may accept information provided by management without extensively verifying it;
• does not produce, unless otherwise agreed, an opinion on the financial statements in the proper sense of a statutory audit.

A common case is the accounting certification of costs for grant reporting. The auditor attests to the actual incurrence of eligible expenses and verifies the correspondence between the accounting documentation and what has been reported. This does not replace the technical assessment of the project, which remains with the competent party: whether a cost is eligible by its technical nature is a different question from whether it was actually incurred and correctly recorded.

Confusing the two levels exposes the professional to requests that fall outside the engagement and creates expectations that cannot then be met.

Documenting choices and keeping up with the regulatory framework

Planning is not a document drawn up once and filed away. During the engagement the need to modify procedures may emerge: internal control reveals more weaknesses than expected, a balance deviates from expectations, or a non-routine transaction requires further investigation. The documentation must reflect these changes and the reasons for them.

At the regulatory level, the framework of standards is evolving. The decrees of the Ragioniere generale dello Stato have updated the ISA Italia standards over time; decree prot. no. RR 127 of 23 March 2023 adopted the new Italian Code of Ethics and Independence; decree prot. no. RR 12 of 30 January 2025 introduced the Italian Ethics and Independence Standard for sustainability reporting assurance, in force for assurance engagements relating to financial years beginning on or after 1 January 2024. These are references that an auditor must verify directly on the official sources, because the subjective scope of application and the coordination with Legislative Decree No. 39 of 2010 and Legislative Decree No. 125 of 2024 cannot be reconstructed from memory.

Limitations and practical conclusions

No planning eliminates professional judgement. Thresholds, samples and procedures are tools, not automatic answers. Two experienced auditors can arrive at different programmes starting from the same entity, if they read the risks differently.

The fixed point is that the client must know what they are receiving. If the engagement is a statutory audit, the scope is that of the standards and the law. If it is voluntary, the scope is the agreed one, and it must be written down: what is verified, what is not, with what level of depth, within what timeframes, and with what responsibilities of management in preparing the documentation.

In short, useful planning does three things: it links procedures to the entity's actual risks, defines the evidence required and its limitations, and clearly distinguishes the type of engagement. On these foundations the work becomes defensible, even when the conclusions are not the ones the client hoped for.

General information content. For assessments relating to your company, it is necessary to examine the specific case.