2.4Preparing the audit program

Once the individual audit plan has fixed the audit objective and scope, the audit program brings them down to an executable level. The program concretely describes "to confirm this audit objective, in which area, using which audit technique, what evidence, when, and who obtains it," serving as the blueprint that steers the conduct of the audit without drift. This section covers why the program is needed, how it maps to the audit objective, and how it ensures the quality of the audit (uniformity, completeness, reviewability), framed as the judgment of an auditor preparing the program.

2.4.1The role and components of the audit program

• The audit program is a document that concretely sets, at the granularity of target, audit technique used, audit evidence to obtain, timing, and assignee, the series of procedures to achieve the audit objective. It is structured so one can trace the logic "audit objective -> what to confirm for it -> technique used -> evidence obtained."
• Each procedure is always mapped to a specific audit objective. A procedure not mapped to an objective becomes "wasted work where doing it became the goal," while a missing procedure for an objective means the audit objective cannot be achieved. The program is also a tool for confirming the completeness of coverage of the audit objectives.

2.4.2The audit quality the program ensures

• Uniformity: with a program, the audit is conducted by the same steps and the same criteria regardless of who the assigned auditor is, curbing auditor-to-auditor variation. It prevents person-dependent auditing and raises the reproducibility of conclusions.
• Completeness: it can be confirmed on the program, before execution, that procedures corresponding to the audit objectives are planned without omission. Reviewability: with a program, the audit supervisor or a third party can later review and verify that "the planned procedures were actually performed and the evidence was obtained," enabling a review of audit quality.

A systems auditor is preparing the audit program for an engagement whose individual audit plan set the objective "confirm that the design and operating effectiveness of controls over granting, changing, and revoking access rights to customer information are effective." The auditor first decomposes what needs to be confirmed to achieve this objective: (1) whether the rules for granting rights (the request and approval process) are documented and designed, (2) whether actual rights grants are made through approval per those rules (operating effectiveness), and (3) whether rights are revoked without delay upon resignation or transfer. Next, the auditor maps an audit technique and the evidence to obtain to each confirmation item: for (1), a document review of the regulations and procedures (evidence = the access-management regulation); for (2), reconciling rights-grant requests over a period against actual system rights settings and checking the approval trail (evidence = request records, approval logs, system settings); for (3), reconciling the list of departing employees against rights-revocation records (evidence = HR-change records, revocation logs). The key point here is that each procedure is always mapped to one of the confirmation items of the audit objective, and conversely a procedure that maps to none of them (for example checking a network configuration unrelated to the objective) is not included in the program. A procedure not mapped to the objective is a waste of resources and blurs the audit's focus. The auditor further assigns timing and an assignee to each procedure. The completed program thus simultaneously ensures (a) uniformity, so the audit is conducted by the same criteria regardless of who is assigned; (b) completeness, so it can be confirmed in advance that no procedure corresponding to the objective is missing; and (c) reviewability, so the audit supervisor can later verify that "the procedures were performed as planned and the evidence was obtained." Note, too, that the program is a blueprint prepared at the planning stage before the audit, while recording the results of actually performing the procedures and the evidence obtained is the role of the audit working papers (covered in the next chapter)—it is essential not to conflate the two.

2.4.3Section summary

• The audit program is a blueprint setting the procedures to achieve the audit objective at the granularity of target, technique, evidence, timing, and assignee
• Each procedure is always mapped to a specific audit objective, and procedures not mapped to an objective are excluded (balancing completeness and focus)
• The program is a planning-stage document ensuring the audit's uniformity, completeness, and reviewability (the execution record is the working papers)