
How to Build an Audit Work Program
Convert audit objectives into focused, evidence-producing procedures — linking each objective to its risk, evidence source, coverage and sampling logic, owner and expected workpaper output.
PDF • 6 Pages • Free

Convert audit objectives and risks into clear, reviewable procedures, recording the expected control, procedure steps, population or sample, evidence expected, results and reviewer clearance.
A work program turns audit objectives and risks into clear, reviewable procedures. When it is missing or vague, team members test different things in different ways and reviewers cannot trace how a conclusion was reached.
Use this template once objectives and key risks are agreed. The header records engagement, workstream, auditor, reviewer, start date and target completion. Part 1 links each audit objective to the risk addressed and the expected control or practice, then sets out procedure design: procedure steps, population or sample, and evidence expected. Part 2 is the execution record, showing who performed the work, when, and the result. A working table tracks each item with owner, due date, status and notes or evidence references.
The worked example uses a travel audit: the objective is to determine whether travel claims comply with policy, and the procedure analyzes all claims above the policy limit and tests supporting approval and evidence. The template's guidance asks you to write for the next reviewer, separate facts from management explanation and auditor judgment, and reference evidence rather than pasting it in. The completion page provides a final quality check, sign-off and a place to record outstanding follow-up.
© Salih Ahmed Islam

Convert audit objectives into focused, evidence-producing procedures — linking each objective to its risk, evidence source, coverage and sampling logic, owner and expected workpaper output.
PDF • 6 Pages • Free

Choose the strongest practical test method — inquiry, inspection, observation, reperformance or data analytics — for each control and assertion.
PDF • 6 Pages • Free

Build a practical risk and control matrix that links each business objective and risk to its control, owner, frequency and evidence, then records the planned test and conclusion.
PDF • 6 Pages • Free

Turn an engagement scope into a realistic time budget, allocating hours by risk, complexity, data effort and review needs rather than equally.
PDF • 6 Pages • Free