How to Plan a Compliance Audit Engagement, Step by Step

Engagement planning is the sequence of client-acceptance, independence, contracting, and documentation steps a practitioner completes between first approach and the start of fieldwork on an audit or assurance engagement. Its output is a record rather than a test result: a dated go/no-go decision, a written independence declaration, a documented offer and acceptance, minutes of a pre-engagement meeting, and a signed engagement letter. An undisclosed conflict, a scope nobody wrote down, or a fee made contingent on the findings is a planning defect rather than a fieldwork defect, and it appears in the planning record or in the gap where a planning record should have been.

The five stages run between initial approach and the start of fieldwork: client and engagement risk screening, independence clearance, a documented offer and acceptance, the pre-engagement meeting, and the signed engagement letter. The sections below cover each stage in order, the boundary at which planning ends and the client's own document-request phase begins, and the failure patterns that trace back to a stage that was skipped or rushed.

Step 1: Screen the client and the engagement

Before any willingness is communicated, the practitioner determines whether the client and the engagement are worth the independence, capacity, and reputational exposure they carry. This screen runs whether the practitioner was approached directly or is responding to a competitive tender, and it runs again at renewal, not just at first contact.

Risk category	What's being assessed
Client acceptance / engagement risk	Is the prospective client highly leveraged, habitually litigious, in the news for the wrong reasons, or otherwise carrying elevated inherent risk the practitioner would be inheriting.
Performance risk	Does the firm actually have the capacity, technical skill, and industry knowledge to deliver, or would this engagement stretch past what the team can competently cover.
Engagement contract risk	Is the proposed scope, timeline, or fee structure one the firm can commit to without excessive exposure if something goes sideways mid-engagement.
Reputation risk	Would association with this client damage the firm's standing, independent of the client's financial risk profile.
Commercials	Is the proposed fee commensurate with the scope and risk being taken on, and never contingent on what the engagement finds.

The same five factors govern a mid-engagement withdrawal decision, not just the initial accept/decline call. If a factor surfaces later that would have blocked acceptance had it been known at the start, that's grounds to reassess whether the engagement should continue, not a reason to quietly finish it out.

The completion criterion here is a documented go/no-go decision, dated, naming the specific factors considered. A verbal "sure, why not" from a partner in a hallway is not a client-acceptance record, and it's the first thing a quality-control reviewer will ask to see if the engagement is ever questioned.

Step 2: Clear independence and conflicts of interest

Before any willingness is communicated, the practitioner confirms that neither the practitioner nor the firm holds a conflict of interest with the prospective client serious enough to bar the engagement outright, and separately identifies anything lesser that still has to be disclosed. The test has two tiers rather than a single pass/fail line.

Tier	Rule	Effect
Disclosable	A financial interest, indebtedness, or prior-employment relationship below the practitioner's controlling independence threshold.	May accept, with the fact disclosed in writing before acceptance.
Substantial conflict	A financial interest, indebtedness, or employment relationship that exceeds the threshold, or that would seriously impair independence given the specific facts regardless of the numbers.	Cannot accept, disclosure does not cure it.

A recurring failure point is the combination rule: independence frameworks generally do not stop at the individual signing the engagement letter. A partner's holding, or in some frameworks a financially dependent family member's, can push the firm over the line even where the assigned practitioner personally holds nothing. Screening only the signer and skipping the rest of the firm is a recurring way this check misses a real conflict.

The exact numeric thresholds (ownership percentage, indebtedness ceiling, employment lookback period) come from whichever independence framework governs the engagement rather than from a universal rule. In the United States that is the AICPA Code of Professional Conduct's independence rule and, for SEC-registered issuers, Regulation S-X Rule 2-01; internationally it is the IESBA International Code of Ethics. The current, controlling number is pulled from the governing framework before it is applied to a real engagement, rather than worked from memory or last year's figure.

The completion criterion is a written independence declaration, signed before Step 3 begins, stating either that no conflict exists or naming the specific disclosable conflict and confirming it doesn't rise to the substantial-conflict bar.

Step 3: Get a documented offer and a documented acceptance

A specific offer and a specific acceptance are exchanged before any paperwork is drafted, so both sides negotiate from the same understanding of scope, timeline, and fee. There are two paths to the same discipline. In a direct appointment, either party can initiate: the client's offer specifies scope, timeframe, and proposed fee, and the practitioner's acceptance confirms agreement and flags any additional terms before the engagement letter is drafted. In a competitive or tender process, the same ground gets covered in a pre-bid meeting before the technical bid goes in, earlier in the sequence but with the same content.

The exchange is kept separate from the engagement letter because it serves a distinct purpose. It is the negotiating record: what was asked for, what was added, and what was agreed before the formal instrument existed. Folding it directly into the engagement letter draft eliminates that history, which is the material a scope or fee dispute would draw on.

An email or a letter is enough; no specific form is required. The completion criterion is a dated offer and a dated acceptance, with any additional terms raised in the acceptance carried forward into the pre-engagement meeting agenda.

Step 4: Run the pre-engagement meeting

The pre-engagement meeting is the last checkpoint before signature. In person or on a structured call, both sides confirm that they understand the engagement the same way before the terms are locked into a signed letter.

• Terms of engagement. Confirm what was agreed in the offer and acceptance, and resolve any gaps.
• Prior-year results. Review the prior test, audit, or exam report and its findings if this is a recurring or successor engagement.
• Reporting framework. Confirm the applicable framework is appropriate and acceptable to the practitioner.
• Business and control environment. Build a working understanding of the client's operations and internal control system, design and operation both.
• Independence disclosure. State, verbally and for the minutes, anything identified in Step 2. The written declaration is the record; this is the confirmation in front of the people who will rely on it.
• Commercial terms. Confirm the fee and how it's billed.
• Timeline and milestones. Set the dates for the audit process itself and the report.

Everything discussed in this meeting is covered by the practitioner's confidentiality obligation whether or not the engagement is ultimately signed. Where a predecessor is being displaced, this is also the point to have already pulled and reviewed the outgoing practitioner's prior report and findings, not after the meeting. For a PCAOB-supervised engagement, that means the outgoing auditor's opinion and any related communications, the same discipline the SOX ICFR audit guide covers from the issuer's side.

The completion criterion is a held, minuted meeting, with any gap between the Step 3 offer and acceptance and this meeting's discussion resolved and carried into the engagement letter draft.

Step 5: Draft and sign the engagement letter

Everything agreed in Steps 1 through 4 is converted into one written instrument, signed by both sides, before fieldwork starts. The engagement letter is the governing document for the whole engagement and the record referred to if a dispute about scope or responsibility surfaces later. Before drafting, the practitioner confirms that the applicable reporting framework is acceptable and that management agrees to acknowledge its own responsibility: preparing the records in accordance with that framework, maintaining internal controls sufficient to produce records free of material misstatement, and giving the practitioner unrestricted access to information and personnel.

A complete engagement letter covers six things at minimum:

1. The objective and scope of the engagement.
2. The respective responsibilities of the practitioner and the client.
3. The written representations management will provide, including particulars of any predecessor practitioner.
4. The period within which the report will be submitted, with milestones if any.
5. Commercial terms: fees and reimbursement of out-of-pocket expenses.
6. Limitations of the engagement, stated in writing rather than left implicit.

The fee has to fairly reflect the size, nature, and risk of the work, and it can never be made contingent on findings or results. Competing purely on price is a documented driver of independence and quality erosion, and belongs in the Step 1 risk screen rather than in the firm's positioning.

Terms do not change mid-engagement without a revised letter. Where the scope, timeline, or fee shifts once fieldwork is underway, the change is documented in a supplementary letter rather than in an email thread. Where a client-imposed limitation would force the practitioner to disclaim an opinion, the engagement does not proceed under that limitation unless the practitioner is required by law to accept it.

For a recurring engagement, the letter is reviewed every year to confirm it is still current, but it does not need to be reissued unless the terms have changed, the engagement period has expired, or the scope shifted since the initial appointment. Where the engagement displaces an incumbent, the practitioner sends the predecessor written notification of the appointment before accepting it, with positive evidence of delivery, and allows a defined period for the predecessor to raise any relevant concern before proceeding. No sign-off from the predecessor is required; the requirement is communication rather than consent, and anything raised is treated as confidential input to the Step 1 risk screen.

The completion criterion is a letter signed by both the practitioner and an authorized signatory of the client's appointing body, with any predecessor communication completed and its wait period observed.

Where planning ends and fieldwork begins

The signed engagement letter is the boundary. Everything above it is planning: deciding whether to take the client, clearing independence, agreeing terms, confirming understanding, and putting it in writing. Everything after it is fieldwork, and fieldwork's own opening move is a document and data request, a separate deliverable that translates the letter's scope into a concrete list of policies, records, and interviews the client has to produce before anything gets tested or scored. That request is built from the terms the letter just set, not before it. Running Step 1's client-acceptance screen after documents are already in hand defeats the purpose of the screen.

The institution on the other side of that request is going through its own version of this discipline, usually described from the officer's chair rather than the practitioner's. The BSA/AML independent testing guide covers what a compliance program owner should expect once that third-pillar review starts, which is the mirror image of the planning sequence above.

Where engagement planning fails later

• Independence cleared informally, never documented. A conflict surfaces after the fact with no written declaration showing it was considered and cleared.
• Offer and acceptance existed only as a conversation. A scope or fee dispute has nothing in writing to point back to.
• Pre-engagement meeting skipped or reduced to a scheduling email. Both sides show up to fieldwork with different assumptions about what's in scope.
• Fee tied, even loosely, to findings. The engagement's credibility is compromised before the first workpaper is opened.
• Scope changed mid-engagement with no revised letter. The engagement is running on terms nobody actually signed.
• Predecessor never contacted. A professional-courtesy and standards requirement gets treated as optional, and whatever the predecessor would have flagged never reaches the new practitioner's risk assessment.

These are planning failures inherited by fieldwork rather than fieldwork failures, and each traces back to a stage in this sequence that was skipped, rushed, or never written down.

Primary sources

• AICPA, AU-C Section 210, Terms of Engagement: the U.S. clarified auditing standard governing agreement on engagement terms, including the example engagement letter.
• IAASB, International Standard on Auditing (ISA) 210, Agreeing the Terms of Audit Engagements: the international counterpart to AU-C 210.
• AICPA Code of Professional Conduct: the Independence Rule and its Conceptual Framework for Independence, governing U.S. practitioner independence and conflicts of interest.
• IESBA, International Code of Ethics for Professional Accountants: Section 320 (Professional Appointments) and Part 4A (International Independence Standards), the international independence and client-acceptance framework.
• 17 CFR 210.2-01 (SEC Regulation S-X, Rule 2-01): Qualifications of Accountants, the independence requirements governing auditors of SEC-registered issuers.