SA 300 requires the auditor to establish an overall audit strategy before developing a detailed audit plan — two distinct outputs, deliberately kept separate, because they answer different questions. The strategy sets the scope, timing and direction of the audit at a high level: which locations, which reporting framework, how materiality will be approached, where the significant risks are expected to lie. The plan translates that strategy into specifics: the nature, timing and extent of risk assessment procedures and further audit procedures, and who on the team will perform them. Planning is not finished once this is written — SA 300 explicitly requires it to be updated as the audit progresses and new information emerges.
What the strategy actually has to establish
- 01Characteristics of the engagement that define its scopeThe applicable financial reporting framework, industry-specific reporting requirements, the number of locations, and whether component auditors are involved.
- 02Reporting objectives, timing and required communicationsThe deadline for the audit opinion, interim reporting requirements if any, and planned communications with management and those charged with governance.
- 03Factors significant in directing the team's effortsPreliminary materiality, areas with higher assessed risk from prior experience or current knowledge, and the involvement of experts if any are expected to be needed.
Why the plan is a separate, more detailed document
| Audit strategy | Audit plan | |
|---|---|---|
| Level of detail | High level — scope, approach, resourcing | Detailed — specific procedures, by whom, by when |
| When it's set | Early, often before detailed risk assessment is complete | Developed from the strategy, informed by the risk assessment under SA 315 |
| Typical content | Engagement scope, reporting timetable, preliminary risk areas, resource allocation | Nature, timing and extent of risk assessment procedures, and of further audit procedures at the assertion level |
Common practice, not a requirement
A plan written before the strategy decisions that should inform it — scope, preliminary materiality, where resources will go — tends to read as a generic procedure list rather than a document genuinely shaped by this engagement's specific risk profile, which is exactly the gap SA 300's two-step sequence is meant to prevent.
Why planning doesn't stop once fieldwork starts
SA 300 explicitly treats planning as a continuous, iterative process. A risk identified mid-fieldwork, an unexpected finding, or a change in the entity's circumstances should feed back into the strategy and plan, with the changes documented — not absorbed informally into whatever testing happens to follow. A planning memo that was accurate in week one but was never revisited as the engagement's understanding deepened is, by the end of fieldwork, describing an audit that no longer matches the one actually performed.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Audit workflow & automationSA 315: identifying and assessing the risks of material misstatementA risk assessment that doesn't name a specific assertion isn't a risk assessment under SA 315 — it's a general impression written down.
- Audit workflow & automationSA 320: materiality in planning and performing an auditOverall materiality and performance materiality are not the same number with a safety margin added — they answer two different questions.
- Audit workflow & automationStatutory audit planning checklistUnderstanding the entity, setting materiality, risk assessment at planning, and briefing the team against a realistic timeline — a rounded planning reference.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.