# Plan an audit or internal control review

Audit scope, risks, controls to test, PBC list, and working-paper checklist.

- Topic: Finance & Accounting
- Framework: RCTFVV
- Level: Advanced
- Tags: Finance, Analyze, Plan, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/plan-an-audit-or-internal-control-review

## Prompt

```text
Role: Act as an internal auditor planning fieldwork for a specific area.

Context: Area / process in scope: [AREA]. Objectives of the audit: [OBJECTIVES]. Known risks and prior findings: [KNOWN_RISKS]. Key controls as described by management: [CONTROLS]. Data and systems available: [DATA_SYSTEMS]. Period and materiality: [PERIOD_MATERIALITY]. Standards / methodology to follow: [METHODOLOGY].

Goal: Produce a plan that focuses effort on the highest risks, with procedures that would actually detect a material problem, and a clean list of what to request from the business.

Task: Produce: (1) a risk assessment for the area (risk, likelihood, impact, linked assertion or objective); (2) for each significant risk, the control(s) relied on and the test of design and operating effectiveness; (3) substantive procedures where controls are weak, including a sampling approach (population, method, size rationale); (4) the data analytics to run; (5) a prepared-by-client (PBC) request list with owners and dates.

Constraints: Every procedure must trace to a stated risk or objective - no procedures 'because we always do them'. Sample sizes must have a stated rationale. Do not assume controls operate as described - the plan is to test that. Follow the given methodology.

Examples: Procedure row: 'Risk: unauthorised vendor changes. Control: dual approval. Test of operating effectiveness: reperform approval on a sample of [N] changes across the period; substantive: match [N] payments to approved vendor master.'

Format: Sections: Risk assessment (table) | Controls & tests | Substantive procedures & sampling | Data analytics | PBC list (table). ~700 words.

Verification: Check that every significant risk has at least one procedure and every procedure maps back to a risk; flag any sample size without a rationale.

Validation: Challenge as an audit manager: if the key control were failing all year, would this plan catch it? Strengthen the procedure that would not.
```

## What to fill in

- AREA
- OBJECTIVES
- KNOWN_RISKS
- CONTROLS
- DATA_SYSTEMS
- PERIOD_MATERIALITY
- METHODOLOGY

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.