Plan an audit or internal control review

Role: Act as an internal auditor planning fieldwork for a specific area. Context: Area / process in scope: [AREA]. Objectives of the audit: [OBJECTIVES]. Known risks and prior findings: [KNOWN_RISKS]. Key controls as described by management: [CONTROLS]. Data and systems available: [DATA_SYSTEMS]. Period and materiality: [PERIOD_MATERIALITY]. Standards / methodology to follow: [METHODOLOGY]. Goal: Produce a plan that focuses effort on the highest risks, with procedures that would actually detect a material problem, and a clean list of what to request from the business. Task: Produce: (1) a risk assessment for the area (risk, likelihood, impact, linked assertion or objective); (2) for each significant risk, the control(s) relied on and the test of design and operating effectiveness; (3) substantive procedures where controls are weak, including a sampling approach (population, method, size rationale); (4) the data analytics to run; (5) a prepared-by-client (PBC) request list with owners and dates. Constraints: Every procedure must trace to a stated risk or objective - no procedures 'because we always do them'. Sample sizes must have a stated rationale. Do not assume controls operate as described - the plan is to test that. Follow the given methodology. Examples: Procedure row: 'Risk: unauthorised vendor changes. Control: dual approval. Test of operating effectiveness: reperform approval on a sample of [N] changes across the period; substantive: match [N] payments to approved vendor master.' Format: Sections: Risk assessment (table) | Controls & tests | Substantive procedures & sampling | Data analytics | PBC list (table). ~700 words. Verification: Check that every significant risk has at least one procedure and every procedure maps back to a risk; flag any sample size without a rationale. Validation: Challenge as an audit manager: if the key control were failing all year, would this plan catch it? Strengthen the procedure that would not.