How is an audit planned: the overall audit strategy and the audit plan (ISA 300)

In September the audit firm "Tiniq Hisob Audit" LLC agreed with "Bo'zsuv Sut" LLC to audit its financial statements for 2026. At the first meeting the engagement partner, Nodira, told the team: "We are not opening a single document yet. First we decide what we test, when, and who does it." This article is about exactly that stage: which two documents are prepared in planning, what goes into them and how they change during the audit.

Conditions: the audit firm, company, names, dates and tables are hypothetical, compiled by the author.

In Uzbekistan the international standards on auditing are the standards of auditing activity (Law "On Auditing Activity", Article 9). Planning is covered by ISA 300 "Planning an Audit of Financial Statements". The paragraph numbers below are given according to national editions that reproduce the international text of the standard (the UK and Ireland, New Zealand).

Is planning a single stage of the audit?

No. The application material of ISA 300 stresses that planning is not a discrete phase of the audit but a continual and iterative process that goes on until the audit is completed. A plan drawn up at the start is not "frozen" until the end.

The standard distinguishes two outputs of planning:

Who takes part in planning?

ISA 300, paragraph 5: the engagement partner and other key members of the engagement team are involved in planning the audit, including planning and participating in the discussion among engagement team members. The application material also gives the reason: their experience makes planning more effective.

There are also conversations with the company's management. For example, Nodira asked the chief accountant of "Bo'zsuv Sut" on which day the year-end inventory count would take place. But under the standard, even when such discussions take place, the overall audit strategy and the audit plan remain the auditor's responsibility.

What is done before planning?

ISA 300, paragraph 6: at the beginning of the current engagement the auditor performs the following preliminary activities:

1. Performs the procedures required by ISA 220 regarding the continuance of the client relationship and of this specific engagement.
2. Evaluates compliance with relevant ethical requirements, including independence.
3. Establishes an understanding of the terms of the engagement with the client, as required by ISA 210.

These activities help to identify in advance circumstances that could interfere with planning and performing the audit.

What goes into the overall strategy?

The strategy sets the scope, timing and direction of the audit and guides the development of the audit plan. According to the standard's material, the strategy also includes decisions on resources: which resources are deployed to specific areas (for example, an experienced team member for a high-risk area or an expert for a complex matter), when they are used (at an interim stage or around the reporting date) and how the work is managed, directed and supervised.

A short version of the strategy for "Bo'zsuv Sut":

What goes into the audit plan?

ISA 300, paragraph 9: the audit plan includes a description of:

1. The nature, timing and extent of planned risk assessment procedures.
2. The nature, timing and extent of planned further audit procedures at the assertion level.
3. Other planned audit procedures required so that the engagement complies with ISAs.

If the strategy says "where we are going", the plan says "what we do at each step". An extract from the plan for the revenue area at "Bo'zsuv Sut":

When is the plan changed?

ISA 300, paragraph 10: the auditor updates and changes the overall strategy and the audit plan as necessary during the course of the audit.

In January Nodira learned that at the end of December the company had signed a new contract with a large retail chain with a broader right to return unsold products. This increased the risk in the revenue area. The team made two changes to the plan: a balance confirmation letter was sent to the chain, and January returns were tested separately. In the strategy, the manager's time allocated to the revenue area was increased.

What is documented?

ISA 300, paragraph 12: the audit documentation includes:

1. The overall audit strategy.
2. The audit plan.
3. Significant changes made during the audit to the strategy or the plan, and the reasons for them.

In the January example above it is exactly the third item that applies: what changed and why is recorded.

What does the timeline look like?

Practical checklist

Before closing planning, the engagement partner should be able to answer "yes" to the following questions:

1. Have independence and ethical requirements been checked?
2. Have the terms of engagement been agreed with the client?
3. Did the engagement partner and key members take part in the team discussion?
4. Are scope, timing, direction and resources recorded in the strategy?
5. Has a preliminary materiality level been set?
6. Does the plan show the nature, timing and extent of procedures for each significant area?
7. Are significant changes during the audit being recorded together with their reasons?

How does this help the company's accountant?

The company does not prepare the auditor's plan, but it can help: telling the auditor early about the inventory count date, new large contracts and changes in the accounting software makes the plan right from the start. News delivered late leads to changes in the plan, and therefore to extra time.